[dependabot]

Bumps github.com/wailsapp/wails/v2 from 2.16.0 to 2.17.0.

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.17.0

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.0

Changes

Security

• Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead
• wails init now warns that remote templates are code: the frontend:* commands in wails.json and the scripts they call run during wails build and wails dev. The warning lists the commands found in the generated wails.json and is also shown with -q. The template docs now describe this trust boundary.
• Hardened the wails dev server against cross-origin and DNS-rebinding attacks on the IPC WebSocket. It previously accepted any origin and forwarded straight to the bound-method dispatcher, so a malicious page in the developer's browser could connect to ws://localhost:34115/wails/ipc and invoke the entire bound Go API. Every request's Host header is now checked against an allowlist (localhost, IP literals, the configured bind address, plus any hosts named in WAILS_DEV_ALLOWED_HOSTS), the IPC upgrade requires a same-origin Origin header, and a per-launch capability cookie (HttpOnly, SameSite=Strict) is required on the upgrade as defense in depth; the cookie is named per dev server port and refreshed before each reconnect, so open browser tabs reconnect after wails dev restarts the app. This protects against browser-based attacks; other processes running as the developer's own user are outside the dev server's threat model by @​nft

Changed

• Replaced the github.com/wailsapp/mimetype fork with upstream github.com/gabriel-vasile/mimetype v1.4.16 for asset MIME type detection

The wails dev hardening comes from #6036 by @​nft, merged as part of #6288.

Also includes v2.15.0 and v2.16.0

v2.15.0 and v2.16.0 were tagged without GitHub releases. Their changes are part of this release:

v2.16.0

• Fixed a memory leak in the macOS and Linux frontends where Calloc never freed the C strings it allocated for dialogs, menus and window setup by @​4RH1T3CT0R7

v2.15.0

• Added EnableAutoplayWithoutUserAction macOS webview preference to allow HTML5 media to autoplay without a user gesture #5512 by @​Eyalm321

What's Changed

• fix: security hardening for v2 and v3 by @​taliesin-ai in wailsapp/wails#6288
• fix(v2/release): pin pnpm 10 for the versioned docs step by @​taliesin-ai in wailsapp/wails#6293 Full Changelog: wailsapp/wails@v2.14.0...v2.17.0

Commits

• 60b1ff7 release: v2.17.0
• e0a16fe chore(changelog): auto-add entry for PR #6293 — fix(v2/release): pin pnpm 10 ...
• 3372105 fix(v2/release): pin pnpm 10 for the versioned docs step (#6293)
• 6ff186e chore(v3): bump to v3.0.0-beta.31 and update changelog
• a8e0605 Merge pull request #6292 from wailsapp/ci/go-1.26-1.27
• 5caf16d fix(v3/generator): keep bindings stable when encoding/json aliases json/v2
• 011af5b ci: run required PR checks for pull requests into releases/**
• a3f4211 ci: test on Go 1.26 and 1.27 and stop silent toolchain downloads
• b6f7849 chore(v3): build with Go 1.26 and refresh golang.org/x modules
• 1375299 ci(v3): always run Build + Test v3 so its results job can be required (#6291)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)