[dependabot]

Bumps github.com/wailsapp/wails/v2 from 2.17.0 to 2.17.1.

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.17.1

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.1

Changes

Security

• Linux: child frames (iframes) embedded in the application window can no longer post to the privileged window.webkit.messageHandlers.external IPC bridge. WebKitGTK does not tell the native message handler which frame sent a message, so the bridge could be reached from cross-origin or sandboxed frames and the OriginValidator check ran against the top-level page rather than the calling frame. A guard script is now injected into every frame at document start and neutralises the bridge in non-top frames. Same-origin child frames still share their parent's origin and retain access to its bridge, so applications that embed untrusted same-origin content should not rely on this boundary. Affects Linux builds of v2.17.0 and earlier. Tracked as GHSA-r5j2-ghh9-2jqw

Other changes

• test(v2/linux): verify native frame loading and document origin boundary (0d660b45a)
• fix(v2/linux): prevent child frames entering privileged IPC (99fd52407)
• chore(v2): update labstack/echo to 4.16.1 and goldmark to 1.7.17 (#6343) (1bb8882b3)

Commits

• 38df49d release: v2.17.1
• 7650664 Merge pull request #6535 from taliesin-ai/docs/changelog-v2.17.1
• 55e25b5 docs(v2): changelog entry for Linux child-frame IPC fix
• cf5e148 Merge commit from fork
• 0d660b4 test(v2/linux): verify native frame loading and document origin boundary
• 92b9b87 Merge remote-tracking branch 'origin/master' into security/linux-frame-bridge
• fa142db Merge pull request #6533 from wailsapp/fix/v310-release-readiness
• 99fd524 fix(v2/linux): prevent child frames entering privileged IPC
• 291391f Merge pull request #6534 from wailsapp/fix/v2-nightly-source-gate
• 37cdc3c ci(v2): release daily patches only for v2 source commits
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: GeiserX/CashPilot-Desktop
• Branch: main
• File: .coderabbit.yaml
• Commit: 1dfe1e4
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 05b311af-2384-486b-a624-cac4a02132b8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn