[dependabot]

Bumps github.com/wailsapp/wails/v2 from 2.17.0 to 2.17.1.

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.17.1

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.1

Changes

Security

• Linux: child frames (iframes) embedded in the application window can no longer post to the privileged window.webkit.messageHandlers.external IPC bridge. WebKitGTK does not tell the native message handler which frame sent a message, so the bridge could be reached from cross-origin or sandboxed frames and the OriginValidator check ran against the top-level page rather than the calling frame. A guard script is now injected into every frame at document start and neutralises the bridge in non-top frames. Same-origin child frames still share their parent's origin and retain access to its bridge, so applications that embed untrusted same-origin content should not rely on this boundary. Affects Linux builds of v2.17.0 and earlier. Tracked as GHSA-r5j2-ghh9-2jqw

Other changes

• test(v2/linux): verify native frame loading and document origin boundary (0d660b45a)
• fix(v2/linux): prevent child frames entering privileged IPC (99fd52407)
• chore(v2): update labstack/echo to 4.16.1 and goldmark to 1.7.17 (#6343) (1bb8882b3)

Commits

• 38df49d release: v2.17.1
• 7650664 Merge pull request #6535 from taliesin-ai/docs/changelog-v2.17.1
• 55e25b5 docs(v2): changelog entry for Linux child-frame IPC fix
• cf5e148 Merge commit from fork
• 0d660b4 test(v2/linux): verify native frame loading and document origin boundary
• 92b9b87 Merge remote-tracking branch 'origin/master' into security/linux-frame-bridge
• fa142db Merge pull request #6533 from wailsapp/fix/v310-release-readiness
• 99fd524 fix(v2/linux): prevent child frames entering privileged IPC
• 291391f Merge pull request #6534 from wailsapp/fix/v2-nightly-source-gate
• 37cdc3c ci(v2): release daily patches only for v2 source commits
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)