wailsapp/wails v2.17.0 on GitHub

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.0

Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead
wails init now warns that remote templates are code: the frontend:* commands in wails.json and the scripts they call run during wails build and wails dev. The warning lists the commands found in the generated wails.json and is also shown with -q. The template docs now describe this trust boundary.
Hardened the wails dev server against cross-origin and DNS-rebinding attacks on the IPC WebSocket. It previously accepted any origin and forwarded straight to the bound-method dispatcher, so a malicious page in the developer's browser could connect to ws://localhost:34115/wails/ipc and invoke the entire bound Go API. Every request's Host header is now checked against an allowlist (localhost, IP literals, the configured bind address, plus any hosts named in WAILS_DEV_ALLOWED_HOSTS), the IPC upgrade requires a same-origin Origin header, and a per-launch capability cookie (HttpOnly, SameSite=Strict) is required on the upgrade as defense in depth; the cookie is named per dev server port and refreshed before each reconnect, so open browser tabs reconnect after wails dev restarts the app. This protects against browser-based attacks; other processes running as the developer's own user are outside the dev server's threat model by @nft

Replaced the github.com/wailsapp/mimetype fork with upstream github.com/gabriel-vasile/mimetype v1.4.16 for asset MIME type detection

The wails dev hardening comes from #6036 by @nft, merged as part of #6288.

v2.15.0 and v2.16.0 were tagged without GitHub releases. Their changes are part of this release:

Fixed a memory leak in the macOS and Linux frontends where Calloc never freed the C strings it allocated for dialogs, menus and window setup by @4RH1T3CT0R7

Added EnableAutoplayWithoutUserAction macOS webview preference to allow HTML5 media to autoplay without a user gesture #5512 by @Eyalm321

fix: security hardening for v2 and v3 by @taliesin-ai in #6288
fix(v2/release): pin pnpm 10 for the versioned docs step by @taliesin-ai in #6293
Full Changelog: v2.14.0...v2.17.0