[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/wailsapp/wails/v2	v2.17.1 → v3.1.0

---

Release Notes

wailsapp/wails (github.com/wailsapp/wails/v2)

v3.1.0: Wails v3.1.0

Compare Source

Wails v3 Weekly Release - v3.1.0

Added

• add experimental CGO-free macOS and Linux backends in PR by @​taliesin-ai
• native YAML builds, portable packaging and signing in PR by @​taliesin-ai

Changed

• avoid copying discarded desktop metadata in PR by @​taliesin-ai
• format content lengths without fmt in PR by @​taliesin-ai
• select index roots without collecting candidates in PR by @​taliesin-ai
• reuse non-seekable file copy buffers in PR by @​taliesin-ai
• avoid allocating a reader for sniffing prefixes in PR by @​taliesin-ai
• skip MIME sniff reads for known extensions in PR by @​taliesin-ai
• prevent queue growth and shrink oscillation in PR by @​taliesin-ai
• avoid allocating discarded request contexts in PR by @​taliesin-ai
• skip disabled debug log preparation in PR by @​taliesin-ai
• allocate MIME sniff buffers lazily in PR by @​taliesin-ai
• reduce hyperlink formatting allocations in PR by @​taliesin-ai
• remove temporary bullet formatting allocations in PR by @​taliesin-ai
• reduce UUID string conversion to one allocation in PR by @​taliesin-ai
• reduce statement-handle formatting allocations in PR by @​taliesin-ai
• eliminate temporary name-based UUID digest allocation in PR by @​taliesin-ai
• avoid copying unfinished command-output lines in PR by @​taliesin-ai
• stream executable copies during package staging in PR by @​taliesin-ai
• avoid rescanning unfinished output lines in PR by @​taliesin-ai
• reuse compiled command routing patterns in PR by @​taliesin-ai
• avoid metadata lookups during runtime discovery in PR by @​taliesin-ai
• reduce localized fallback page allocations in PR by @​taliesin-ai
• avoid recompiling patterns for each processor in PR by @​taliesin-ai

Fixed

• implement SetTooltip for the system tray in PR by @​fan711
• read dark mode from the settings portal in PR by @​TechHutTV
• let Window.SetZoom go below 1.0 in PR by @​APshenkin
• deliver to each Go listener in emit order in PR by @​DevLumuz
• read event hooks under hookLock in Emit in PR by @​DevLumuz
• always advertise the tray Menu property so a tray created after Run is not dropped in PR by @​AlbinoGeek
• hold main-thread work sent before Run until Run starts in PR by @​AlbinoGeek
• use correct asset url in github updater provider in PR by @​gavidroselj
• keep request body when WebView2 omits Content-Length in PR by @​strraaa
• report macOS and GTK screens in DIP space (mixed-DPI bounds) in PR by @​julianstorer
• don't report a dismissed notification as a click in PR by @​bercedev
• stop dev processes when the terminal closes in PR by @​xmasdev
• map changelog runs to squash-merge commits in the evidence check in PR by @​taliesin-ai
• hold the taskbar-restart debounce for a second in PR by @​taliesin-ai
• keep size constraints through a fullscreen that starts there in PR by @​taliesin-ai
• do not resize a fullscreen or maximised window to fit a new constraint in PR by @​taliesin-ai
• do not raise a dialog before Run in the liquid-glass example in PR by @​taliesin-ai
• a dialog asked for before Run does nothing instead of waiting forever in PR by @​taliesin-ai
• fall back when desktop entry has no command in PR by @​taliesin-ai
• sniff current content without retaining filenames in PR by @​taliesin-ai
• recognize mixed-case asset extensions in PR by @​taliesin-ai
• release consumed content-sniffer buffers in PR by @​taliesin-ai
• release removed ringqueue references in PR by @​taliesin-ai
• honor header deletions before fallback selection in PR by @​taliesin-ai
• commit fallback response headers before flush in PR by @​taliesin-ai
• discover only exact index files in PR by @​taliesin-ai
• avoid bodies and full reads for non-seekable HEAD in PR by @​taliesin-ai
• fill MIME sniffing prefix across short reads in PR by @​taliesin-ai
• commit successful empty non-seekable responses in PR by @​taliesin-ai
• avoid duplicating expanded URI targets in PR by @​taliesin-ai
• preserve paths during field expansion in PR by @​taliesin-ai
• respect XDG desktop-file search directories in PR by @​taliesin-ai
• commit sniffer headers on empty flush in PR by @​taliesin-ai
• skip directories shadowing desktop entries in PR by @​taliesin-ai
• preserve targets found inside executable paths in PR by @​taliesin-ai
• release callback captures after timer fires in PR by @​taliesin-ai
• avoid false ldconfig library matches in PR by @​taliesin-ai
• constrain filesystem library fallback matches in PR by @​taliesin-ai
• remove cache invalidation data race in PR by @​taliesin-ai
• honor the optional logger configuration in PR by @​taliesin-ai
• avoid shared start URL mutation and stale ports in PR by @​taliesin-ai
• stop dev proxy retries on request cancellation in PR by @​taliesin-ai
• return 404 for missing bundled assets in PR by @​taliesin-ai
• handle bundled runtime HEAD requests in PR by @​taliesin-ai
• preserve escaped paths when routing services in PR by @​taliesin-ai
• order oversized numeric prerelease identifiers correctly in PR by @​taliesin-ai
• reject HTTP errors before saving tooling downloads in PR by @​taliesin-ai
• honor the launch deadline during desktop discovery in PR by @​taliesin-ai
• preserve request bodies across development proxy retries in PR by @​taliesin-ai
• close HTTP response bodies on every return path in PR by @​taliesin-ai
• preserve cancellation errors in parallel library searches in PR by @​taliesin-ai
• reject failed GitHub tag responses before decoding in PR by @​taliesin-ai
• preserve literal bracketed template paths in PR by @​taliesin-ai
• install wails3 once and preserve installer errors in PR by @​taliesin-ai
• ignore hidden entries and headers in comment blocks in PR by @​taliesin-ai
• surface stable release lookup errors in PR by @​taliesin-ai
• print plain messages without format interpretation in PR by @​taliesin-ai
• avoid write panics after loading JSON null in PR by @​taliesin-ai
• return snapshots for whole-store reads in PR by @​taliesin-ai
• propagate errors after partial row iteration in PR by @​taliesin-ai
• keep extraction destination paths literal in PR by @​taliesin-ai
• release prepared-statement handles on close and reopen in PR by @​taliesin-ai
• handle preparation racing with close or reopen in PR by @​taliesin-ai
• honor HEAD requests for the fallback index page in PR by @​taliesin-ai
• require complete hexadecimal statement handles in PR by @​taliesin-ai
• preserve the default in-memory database under concurrency in PR by @​taliesin-ai
• separate stderr from parsed HEAD output in PR by @​taliesin-ai
• generate runtime assets from embedded bundles in PR by @​taliesin-ai
• detect TODO, FIXME and TBD placeholders in PR by @​taliesin-ai
• validate release notes API responses in PR by @​taliesin-ai
• respect task directories in status checks in PR by @​taliesin-ai
• prevent same-file copy data loss in PR by @​taliesin-ai
• include the task directory in cache identity in PR by @​taliesin-ai
• probe ports once per check in PR by @​taliesin-ai
• avoid a panic when cache entries decode as null in PR by @​taliesin-ai
• increment numeric prereleases without integer limits in PR by @​taliesin-ai
• prevent legacy checks from hiding cache misses in PR by @​taliesin-ai
• run default tasks in the executor base directory in PR by @​taliesin-ai
• preserve literal percent signs in explorer commands in PR by @​taliesin-ai
• align precondition and task command directories in PR by @​taliesin-ai
• replace symlinks with generated regular files in PR by @​taliesin-ai
• preserve existing DMGs when builds fail in PR by @​taliesin-ai
• preserve quoted regex and path backslashes in PR by @​taliesin-ai
• validate generated icon sizes before image allocation in PR by @​taliesin-ai
• route command chains and redirections through the shell in PR by @​taliesin-ai
• preserve previous Linux packages on build failure in PR by @​taliesin-ai
• use platform-specific shell fallback execution in PR by @​taliesin-ai
• serve assets with repeated leading path slashes in PR by @​taliesin-ai
• recognize stable versions with build metadata in PR by @​taliesin-ai
• report resource-generation failures accurately in PR by @​taliesin-ai
• prevent races when replacing the active reporter in PR by @​taliesin-ai
• serialize concurrent cache-file saves in PR by @​taliesin-ai
• support multiple template equality candidates in PR by @​taliesin-ai
• normalize null saved category maps in PR by @​taliesin-ai
• show diagnostics from failed variable shell commands in PR by @​taliesin-ai
• keep shell chains out of the implicit Go cache in PR by @​taliesin-ai
• serialize Linux category persistence in PR by @​taliesin-ai
• cache Go outputs with quoted or escaped spaces in PR by @​taliesin-ai
• preserve Mac icons when encoding fails in PR by @​taliesin-ai
• stop discarding invalid Go test count flags in PR by @​taliesin-ai
• retain source permissions for new file copies in PR by @​taliesin-ai
• Fix assorted v3 nightly build issues and clean up dependencies in PR by @​taliesin-ai
• repair v3 release validation and fixture classification in PR by @​taliesin-ai
• resolve cross-platform release validation failures in PR by @​taliesin-ai

---

🗓️ This is a weekly release. Minor version numbers advance with time, not with features: a new minor is not a feature milestone. Nightly previews are published between weekly releases as -nightly pre-releases.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.1.0

Tip: always pin an exact version (e.g. @v3.1.0) in go.mod and CI rather than @latest.

v3.0.0: Wails v3.0.0

Compare Source

Wails v3.0.0

Wails v3 is here. Build desktop and mobile applications with Go and the web frontend you already know, using each platform's native WebView instead of a bundled browser.

v3 is a ground-up rework of Wails. Applications, windows, services, events and platform features are now explicit objects you create and talk to directly, so multiple windows, system trays and background services are a normal part of the model rather than workarounds. It has been nearly four years since the first v3 alpha in January 2023. Thank you to everyone who tested, reported, translated, reviewed and contributed along the way.

📣 Read the announcement: Wails v3.0.0 Released
📚 Documentation: wails.io · Migrating from v2: v2 to v3 guide

Install

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0
wails3 setup    # guided setup: checks your system and installs what Wails needs
wails3 init     # create a new project

Wails v3 requires Go 1.26 or newer. We recommend Go 1.26.10 or 1.27.3 (or later), which include a crypto/x509 security fix. Run wails3 doctor at any time to check your setup.

What's new in v3

Application model

• Multiple windows. Create, show, hide and close any number of windows at runtime, each with its own options, events and lifecycle.
• Services. Your backend is ordinary Go: register services with the application and their exported methods become callable from the frontend. Services can have startup and shutdown hooks and can serve HTTP routes.
• Manager APIs. Windows, menus, dialogs, events, screens, the clipboard and more are reached through clear manager objects on the application, instead of a single context-bound runtime package.
• Events. Application, window and custom events, with typed payloads, available from both Go and JavaScript, plus platform system events.

Bindings

• Generated with static analysis. wails3 generate bindings reads your Go source, so doc comments and real parameter names carry through to the generated TypeScript or JavaScript.
• Models and enums. Go structs become TypeScript classes or interfaces, and Go enums become TypeScript enums.
• Streams and raw messages. Stream data between Go and the frontend, or use raw messages and custom transports when you need full control.

Native user interface

• System tray. Tray icons with menus, light and dark icons, macOS template icons, and the option to attach a window to the tray icon.
• Menus. Application menus, context menus (including from HTML with WML attributes) and tray menus, all updatable at runtime.
• Dialogs. Native message, question, file open and save dialogs, plus custom dialogs.
• Frameless and custom windows. Frameless windows with native corners and shadows, custom title bars, drag regions and translucency, including native Liquid Glass on macOS 26 with a fallback on earlier versions.
• Notifications. Native desktop notifications with actions.
• Keyboard shortcuts. Window and application key bindings and global shortcuts; on macOS, letter accelerators follow the labelled key on AZERTY, QWERTZ, Dvorak and other layouts.
• And more:
  • clipboard;
  • file drag and drop, plus HTML drag and drop;
  • screen and environment information;
  • dock badges on macOS;
  • start at login;
  • opening URLs and files in the default browser;
  • notch windows on macOS;
  • a per-window permissions map for the camera, microphone, geolocation and notifications.

Platforms

• Windows (amd64 and arm64), macOS (Intel and Apple Silicon) and Linux (amd64 and arm64).
• Linux uses GTK4 and WebKitGTK 6.0 by default. The legacy GTK3 stack is still available with -tags gtk3 until v3.1.
• iOS and Android (experimental). The same main.go and frontend can run on mobile. Try it and tell us what you find; it isn't yet covered by the stability promise.
• Server builds. Run the same application and services as an HTTP server, with no native window.

Build, ship and update

• A build system you can see. Projects use a Taskfile-based build that you can read, extend and debug, instead of one opaque command.
• Cross-compilation, with platform guides for building on and for every desktop target.
• Code signing and installers. Signing for every platform, NSIS installers and MSIX packages for Windows, DMG and app bundles for macOS, and AppImage, deb, rpm and Arch packages for Linux.
• An in-app updater. Pluggable providers (including GitHub Releases), cryptographic verification, an atomic swap with rollback, and a default UI you can theme or replace.
• Single instance, file associations and custom URL protocols, so your app opens the files and links it owns.
• Obfuscated builds and access to private macOS APIs when you need them.

Developer experience

• wails3 setup, a guided setup wizard that checks and installs dependencies.
• wails3 dev, live development with frontend hot reload and Go rebuilds, which stops its background processes when your app exits.
• Templates for vanilla, React, Vue and Svelte, each in JavaScript or TypeScript, plus your own custom templates.
• Testing support, including end-to-end testing guides.
• An MCP service that lets AI tools drive and inspect a running Wails app.
• A new documentation site at wails.io, built with M-Press, with tutorials, guides and API reference translated into nine languages.

Moving from v2

v3 is a new major version, so moving to it is a real port rather than a version bump. The main changes are:

• the application and window lifecycle;
• services in place of context-bound bindings;
• direct application and window APIs in place of the v2 runtime package;
• regenerated frontend bindings.

The migration guide covers each one with before-and-after examples.

Wails v2 isn't going away. It continues to receive critical updates, and its documentation is now at v2.wails.io. The two CLIs (wails and wails3) are separate binaries with different module paths, so you can install both.

Security

This release fixes every published Wails v3 security advisory except one: GHSA-2p5f-2gx8-mh8m is only partly fixed. Cross-origin child frames on Linux are now blocked, and the cases that remain open are listed under Known limitations below. If you are on v3.0.0-beta.30 or earlier, please upgrade.

• Block reserved wails: messages from cross-origin child frames on Linux (GTK3 and GTK4) by injecting a guard script into all frames, mitigating GHSA-2p5f-2gx8-mh8m
• Update github.com/klauspost/compress to 1.18.7 (GHSA-259r-337f-4rfw) and golang.org/x/image to 0.45.0, and build with Go 1.26.10 to pick up the crypto/x509 fix (GO-2026-6809)
• Update vite to 8.2.4 or later in the runtime package, setup wizard, examples and project templates (GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22, GHSA-vfpm-58rq-9qcg, GHSA-r825-w8mm-5pxw, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv)

Known limitations

• Linux: the child-frame guard cannot stop a same-origin child frame (for example a srcdoc or about:blank iframe) from reaching the native message handler through its parent, because WebKitGTK gives the handler no frame information. Cross-origin frames, and sandboxed frames without allow-same-origin, are blocked. Do not embed untrusted same-origin content in a Wails window.
• Android (experimental): the window.wails JavaScript bridge is exposed to every frame in the WebView. Do not embed untrusted third-party content in the app's WebView. A fix is planned for 3.0.1.
• All platforms: bound-method calls from child frames go over HTTP to /wails/runtime, so the guard does not restrict them. Treat any iframe you embed as having access to your bound Go methods.

Changes since v3.0.0-beta.34

• Fix Windows apps crashing with panic: SetTextColor failed when painting the application menu bar on some Windows builds (#​6311)
• Fix Windows apps crashing in applyDarkMode when uxtheme.dll was unloaded while its functions were still in use (#​6358)
• Keep a staged update safe while a restart is pending, and validate an update before replacing the installed application, so a damaged update rolls back instead of breaking a working app (#​6350, #​6360)
• Fix wails3 update cli not finding v3 releases
• Project templates pin @wailsio/runtime to the version of the CLI that generated them

Releases from here on

• Weekly releases bump the minor version (v3.1.0, v3.2.0, ...).
• Nightly pre-releases preview the next weekly (v3.1.0-nightly.YYYYMMDD).
• Hotfixes bump the patch version.

Go's @latest always resolves to the newest weekly or hotfix release, never a nightly. The @wailsio/runtime npm package always has the same version as the Wails release. Pin an exact version in production builds.

To propose a new feature or a change to public behaviour, open a draft WEP (Wails Enhancement Proposal) pull request rather than a feature-request issue.

Thank you

Wails v3 exists because of the people who tested incomplete builds, reported hard bugs, translated documentation, answered questions and contributed code: see the credits page. Special thanks to Stffabi, Travis McLane, Atterpac, Lyimmi and fbbdev; to Valerio Tesei for his years of support; to our sponsors; and to JetBrains, ZSA and CodeRabbit.

If Wails is useful to you or your company, please consider sponsoring the project. 💙

Full changelog: changelog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: app/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/godbus/dbus/v5	v5.1.0 -> v5.2.2

[hanthor]

Not approving: Wails v3 is a different Go module path (github.com/wailsapp/wails/v3), not an upgrade of wails/v2. This diff keeps wails/v2 v2.17.0 (still the one the app imports) and adds an unused wails/v3 v3.0.0 requirement, so CI passing says nothing about a migration. v2→v3 is an API rewrite (see the wails v2-to-v3 guide) and should be a deliberate migration PR; suggest closing this and adding a Renovate rule to ignore the v2→v3 path switch.

[hanthor]

This is not a Wails v3 migration. app/go.mod keeps github.com/wailsapp/wails/v2 v2.17.1 and merely adds an unused github.com/wailsapp/wails/v3 v3.1.0 requirement; existing imports remain on v2, so the app is not upgraded and gains a stale direct requirement. Close this as a version bump, or perform the actual v2→v3 API/import migration with full app qualification.

[hanthor]

Closing per the maintainer's request: it adds an unused v3 module while keeping v2. Reopen if this is still needed.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.