[dependabot]

Bumps github.com/wailsapp/wails/v2 from 2.16.0 to 2.17.1.

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.17.1

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.1

Changes

Security

• Linux: child frames (iframes) embedded in the application window can no longer post to the privileged window.webkit.messageHandlers.external IPC bridge. WebKitGTK does not tell the native message handler which frame sent a message, so the bridge could be reached from cross-origin or sandboxed frames and the OriginValidator check ran against the top-level page rather than the calling frame. A guard script is now injected into every frame at document start and neutralises the bridge in non-top frames. Same-origin child frames still share their parent's origin and retain access to its bridge, so applications that embed untrusted same-origin content should not rely on this boundary. Affects Linux builds of v2.17.0 and earlier. Tracked as GHSA-r5j2-ghh9-2jqw

Other changes

• test(v2/linux): verify native frame loading and document origin boundary (0d660b45a)
• fix(v2/linux): prevent child frames entering privileged IPC (99fd52407)
• chore(v2): update labstack/echo to 4.16.1 and goldmark to 1.7.17 (#6343) (1bb8882b3)

Wails v2.17.0

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.0

Changes

Security

• Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead
• wails init now warns that remote templates are code: the frontend:* commands in wails.json and the scripts they call run during wails build and wails dev. The warning lists the commands found in the generated wails.json and is also shown with -q. The template docs now describe this trust boundary.
• Hardened the wails dev server against cross-origin and DNS-rebinding attacks on the IPC WebSocket. It previously accepted any origin and forwarded straight to the bound-method dispatcher, so a malicious page in the developer's browser could connect to ws://localhost:34115/wails/ipc and invoke the entire bound Go API. Every request's Host header is now checked against an allowlist (localhost, IP literals, the configured bind address, plus any hosts named in WAILS_DEV_ALLOWED_HOSTS), the IPC upgrade requires a same-origin Origin header, and a per-launch capability cookie (HttpOnly, SameSite=Strict) is required on the upgrade as defense in depth; the cookie is named per dev server port and refreshed before each reconnect, so open browser tabs reconnect after wails dev restarts the app. This protects against browser-based attacks; other processes running as the developer's own user are outside the dev server's threat model by @​nft

Changed

• Replaced the github.com/wailsapp/mimetype fork with upstream github.com/gabriel-vasile/mimetype v1.4.16 for asset MIME type detection

The wails dev hardening comes from #6036 by @​nft, merged as part of #6288.

Also includes v2.15.0 and v2.16.0

v2.15.0 and v2.16.0 were tagged without GitHub releases. Their changes are part of this release:

v2.16.0

• Fixed a memory leak in the macOS and Linux frontends where Calloc never freed the C strings it allocated for dialogs, menus and window setup by @​4RH1T3CT0R7

v2.15.0

... (truncated)

Commits

• 38df49d release: v2.17.1
• 7650664 Merge pull request #6535 from taliesin-ai/docs/changelog-v2.17.1
• 55e25b5 docs(v2): changelog entry for Linux child-frame IPC fix
• cf5e148 Merge commit from fork
• 0d660b4 test(v2/linux): verify native frame loading and document origin boundary
• 92b9b87 Merge remote-tracking branch 'origin/master' into security/linux-frame-bridge
• fa142db Merge pull request #6533 from wailsapp/fix/v310-release-readiness
• 99fd524 fix(v2/linux): prevent child frames entering privileged IPC
• 291391f Merge pull request #6534 from wailsapp/fix/v2-nightly-source-gate
• 37cdc3c ci(v2): release daily patches only for v2 source commits
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)