wailsapp/wails v3.0.0-beta.31

Wails v3.0.0-beta.31

on GitHub

Wails v3 Beta Release - v3.0.0-beta.31

Added

• Expose the @wailsio/runtime/cancellable subpath export so CancellablePromise can be imported without evaluating the root runtime entry (#6153)

Changed

• Require Go 1.26 or later: the v3 module now declares go 1.26.0, and projects generated by wails3 init and wails3 service init declare the same minimum

Fixed

• Fix binding generator output changing when building with Go 1.27, where encoding/json types such as Marshaler, Unmarshaler and RawMessage became aliases of encoding/json/v2 and encoding/json/jsontext types: they are rendered as any again and no models are emitted for encoding/json/v2 (#6292)
• Validate remote template URLs passed to wails3 init -t before cloning: only https://, http://, ssh://, git:// and user@host:path URLs are accepted, values are passed to git after --, and git is restricted to those transports during the clone
• Reject out-of-range x-wails-window-id header values in the HTTP runtime transport instead of silently truncating them to another window's ID
• Harden the updater's archive extraction against zip-slip: entry paths are now checked with filepath.IsLocal plus a containment check on the joined path, with tests for nested .., backslash, absolute-path and symlink write-through entries in zip and tar.gz archives
• Fix AppImages from wails3 generate appimage crashing on start outside Debian and Ubuntu with "Unable to spawn a new child process: … WebKitNetworkProcess". The bundled WebKit now runs the helper processes shipped in the AppImage. WebKit's bubblewrap sandbox stays on
• Fix -tags server builds failing to compile for Android and iOS, fixing #6271
• Fix the updater failing to swap on Linux when the temp dir is on another filesystem (such as a tmpfs /tmp) by staging beside the installed binary and copying across filesystems
• Fix the updater trying to replace the read-only mount of an AppImage instead of the .AppImage file
• Fix reserved wails: window control messages being accepted from iframes on macOS and iOS. They are now only accepted from the window's main frame; other messages from iframes still reach RawMessageHandler with their origin info
• Stop posting WindowDidUpdate and WindowWillUpdate on macOS: NSWindowDidUpdateNotification fires on every run-loop pass, so the page received ~120 empty evaluateJavaScript: calls per second, and on macOS 27.0 each of them consumed the transient activation of the user's click — navigator.clipboard.writeText() and other activation-gated APIs rejected with NotAllowedError from real clicks (#6170) by @APshenkin
• Fix default Windows info.json language to en-US (0409) so Explorer shows version details (#6210)
• Fix the Linux DMA-BUF renderer being turned off on laptops with an NVIDIA dGPU beside an AMD or Intel iGPU: on Wayland it is now turned off only when WebKit renders on NVIDIA (the app was offloaded to the dGPU, or the compositor runs on it), not whenever the nvidia module is loaded, which slowed rendering to a crawl on the iGPU; X11 sessions keep the old behaviour, since Xorg's render GPU is set by its configuration
• Handle cross-device rename failures in Linux updater with staged copy fallback in PR by @john-okeefe
• Fix WebviewWindow.SetMenu on Windows not redrawing the menu bar unless a menubar theme was configured, fixing #6103
• Fix WebviewWindow.SetMenu(nil) panicking on Windows instead of being a no-op like on macOS, fixing #6104
• Preserve changelog entries across competing pushes with retries in PR by @leaanthony
• Fix go mod vendor failing with pattern arm64/WebView2Loader.dll: no matching files found on every platform, by removing the embeds that referenced binaries never shipped in the module, fixing #5782 and #5376, in PR by @Grantmartin2002
• Prevent duplicate window teardown on macOS in PR by @charlesbalderson
• Handle WM_CONTEXTMENU for systray menu to open on right-click in PR by @wzk2025
• Fix all five InvokeSync* variants blocking their caller forever when the dispatched callback panics, fixing #6107, in PR by @RALIST
• Rebuilds destroyed GTK3 submenus safely in PR by @leaanthony
• Implement Windows worker forwarding shim for nested workers in PR by @taliesin-ai
• Fix OpenFile() on Windows ignoring PromptForMultipleSelection() when CanChooseDirectories(true): users can now pick several folders at once, as on macOS and Linux (#6263)
• Fix by-value double arguments to WebView2 COM methods on windows/arm64 — ZoomFactor, RasterizationScale, cookie Expires, and the print settings scale, page size and margins were affected there (the print-settings setters previously returned ErrDoubleArgUnsupported): affected calls now goes through a runtime.cgocall trampoline that loads d0, which Go's syscall path cannot (golang.org/issue/62583) by @APshenkin

Security

• Server mode (-tags server) now accepts /wails/runtime calls only as POST requests from the server's own origin or an origin listed in ServerOptions.WebSocketOriginPatterns; other methods receive HTTP 405 and other browser origins HTTP 403. Deployments behind a reverse proxy that rewrites the Host header should add their public origin to WebSocketOriginPatterns
• Server mode (-tags server) bound to a loopback address (the default localhost, 127.0.0.0/8 or ::1) now rejects requests with HTTP 403 unless the Host header is localhost, an IP literal, the bind host, or a host matching ServerOptions.WebSocketOriginPatterns, blocking DNS rebinding attacks against /wails/runtime and the WebSocket endpoints
• Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.31

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.