Repository navigation
chore(deps): Go 1.27, anthropic/openai SDKs, go-keyring - #90
Merged
Merged
Conversation
0xMMA
force-pushed
the
chore/go-deps
branch
from
September 24, 2026 22:13
8adcbd3 to
c0cebfe
Compare
The test fails if the godebug line leaves go.mod (checked by removing it). README: wails3 was installed @latest, which today is a beta CLI against an alpha module; pin it to go.mod's version, and say that wails3/wire must be built with Go >= 1.27.
22 tasks
0xMMA
added a commit
that referenced
this pull request
Oct 4, 2026
#90 (the base of this branch) was squash-merged into main together with #89, #91 and #92. Conflicts resolved with main's content, then only the Wails parts re-applied: - go.mod/go.sum: main's, then go get wails/v3@v3.0.0-beta.25 + tidy (Go 1.27 directive and the x509 godebug line kept) - package.json/lock: main's cooldown-resolved lock, only @wailsio/runtime moved to 3.0.0-beta.25 (exact) - CLAUDE.md, README.md, docs/roadmap.md: main's text plus the beta.25 / -tags gtk3 / GTK3 decision lines Bindings regenerated with wails3 v3.0.0-beta.25: no drift.
0xMMA
added a commit
that referenced
this pull request
Oct 10, 2026
…#95) * chore(deps): move the Go toolchain to 1.27 * chore(deps): bump anthropic, openai SDKs and go-keyring * chore(deps): keep system cert store on Windows under Go 1.27 * docs(roadmap): record the bumped SDK versions * test(llm): pin the x509 GODEBUG; README tool install notes The test fails if the godebug line leaves go.mod (checked by removing it). README: wails3 was installed @latest, which today is a beta CLI against an alpha module; pin it to go.mod's version, and say that wails3/wire must be built with Go >= 1.27. * chore(deps): move Wails to v3.0.0-beta.25 (Go and runtime) The Go module and @wailsio/runtime move together to the same release, and the runtime is now pinned exactly: it had drifted to alpha.79 on a caret while the Go side sat on alpha.72. No Go API change touches KeyLint and the regenerated bindings are byte-identical. The bump also drops go-git/go-billy out of the build graph, which clears the 8 govulncheck findings #90 left behind. * fix(ci): wails3 beta.25 CLI and GTK4 + WebKitGTK 6.0 deps Wails made GTK4 + WebKitGTK 6.0 the Linux default in alpha.93; the GTK3 stack is now opt-in via -tags gtk3 and upstream removes it in v3.1. Every job that compiles the Go code (tests, bindings drift, Linux and Windows builds, release) now installs the GTK4 headers instead of GTK3, and installs the wails3 CLI matching go.mod. * fix(build): Linux packages depend on GTK4 and WebKitGTK 6.0 The binary now links libgtk-4 and libwebkitgtk-6.0, so the deb/rpm/arch dependencies follow; values match the beta.25 nfpm template. * docs: Wails beta.25, GTK4 build deps, E4 step 1 status * chore(build): regenerate icons and .desktop with wails3 beta.25 The build task regenerates these on every run; with the beta.25 CLI the output differs from the committed alpha.72 output (same ICO sizes, new encoder; .desktop Name now keeps the product's casing), so the first wails3 dev or task build left the tree dirty. * fix(build): bind the dev server to 127.0.0.1 for wails3 dev Since alpha.79 the Wails dev proxy dials a localhost dev server over tcp4 only. ng serve on "localhost" can bind ::1 under Node 24, and wails3 dev then showed a blank window with 'connection refused' in the log. Reproduced on Linux before the change, gone after. * docs(roadmap): link E4 step 1 to #95 * fix(ci): refresh apt lists before installing the GTK4 stack cache-apt-pkgs only runs apt update under nektos/act. On a runner whose lists are stale, the first GTK4 install 404'd on superseded glib and gstreamer debs, the action carried on and cached an empty result, and every later run restored that empty cache and failed at pkg-config. The GTK3 set never hit this only because its cache predates the drift. * fix(ci): fail at the apt step when GTK4 headers are missing * docs: WebKitGTK 6.0 sandbox on Ubuntu 23.10+, review nits * fix(build): keep Linux on GTK3 via the gtk3 build tag Wails' default Linux stack is GTK4 + WebKitGTK 6.0, whose forced bwrap sandbox aborts at start on stock Ubuntu 23.10+. Switching stacks breaks the released Linux binary and its self-update, which is a product decision this upgrade should not make implicitly. Every Linux build, test, vet, bindings run and wails3 CLI install now passes -tags gtk3 (the CLI's own cgo package is gtk3-tagged too, so no GTK4 headers are needed anywhere). CI, release, the Linux Taskfile and the nfpm dependencies are back on GTK3 / WebKit2GTK 4.1. The apt refresh and the pkg-config presence check stay, now for the GTK3 packages. * docs: gtk3 tag for Linux builds, GTK4 decision in roadmap * fix(build): always prepend gtk3 to Linux build tags A caller's EXTRA_TAGS replaced the gtk3 default and silently moved the build to GTK4. gtk3 is now prepended in build:native and build:docker. * fix(ci): catch untracked bindings and assert the GTK3 link The drift check used git diff, which ignores untracked files, so a newly registered service's bindings passed. It now fails on any git status output under frontend/bindings. The Linux builds in CI and release now fail unless the binary links libgtk-3 and libwebkit2gtk-4.1, so a dropped gtk3 tag cannot ship. * docs: gtk3 tag in eval-human.sh, ship command and roadmap * docs(roadmap): Wails beta.28 is out, bump is a follow-up --------- Co-authored-by: Michael <0xMMA@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Go toolchain and direct Go module bumps. Wails is deliberately untouched (separate PR, stacked on this one).
Versions
go.mod, CIgo-version, CLAUDE.md, README)anthropic-sdk-goopenai-go/v3zalando/go-keyringgo mod tidyalso moved x/crypto, x/net and x/text, pulled incoder/websocket(openai-go links it now, so the binary grows slightly), and droppedshellescape.Behaviour pinned: certificate store
Go 1.27 changes a default:
SSL_CERT_FILE/SSL_CERT_DIRnow replace the Windows/macOS certificate store. A stale variable would break every provider call and the updater, and a corporate root CA that lives only in the store would stop being trusted.godebug x509sslcertoverrideplatform=0ingo.modkeeps the pre-1.27 behaviour.TestCertStoreOverrideStaysOfffails if the line goes; that was checked by removing it.Open for Michael: should "the Windows store wins over
SSL_CERT_FILE" be a permanent product rule? Today it simply keeps status quo.Other Go 1.27 GODEBUG changes: only
tracebacklabels(runtime tracebacks, harmless). The removed settings were already on their new defaults atgo 1.26.SDK audit — nothing new leaks
client.go,option/,requestconfig,apierrorare byte-identical across the range.foundry/,lib/environmentsand tests.Windows paths (stdlib diff 1.26.1 → 1.27)
syscall/exec_windows.go,os/exec_windows.goandlp_windows.goare byte-identical, soHideWindowspawning of the Claude Code CLI is unaffected.LazyProc.Callsemantics are unchanged for clipboard, shortcut and updater.keyring_windows.gois byte-identical and wincred is unchanged, so stored API keys cannot be orphaned.govulncheck
application_debug.go(//go:build !production). With-tags production, which every CI and release build uses, Linux and Windows report 0 affected.Developer machines (README updated)
go installbuilds a tool with the Go version the tool declares. Awireorwails3built on Go 1.26 therefore refuses this module ("package requires newer Go version go1.27");wire genhard-fails. Reinstall both with Go ≥ 1.27, or runGOTOOLCHAIN=go1.27.1 go install ….wails3@latest, which is a beta CLI today against an alpha module. It is now pinned to go.mod's version.wails3install runs aftersetup-go 1.27, and no job installswire.Verification
go vet ./...andgo vet -tags eval ./internal/...clean.go test -race ./internal/...passes.go buildpasses, includingGOOS=windows, pure Go.wails3alpha.72 rebuilt with 1.27:generate bindingsshows no diff.wire diff: no drift.npm test198/198.Review
Implementer's review-pr round (found the x509 default), then an independent Opus review with review-pr fork. The independent review found no defects in shipped behaviour. Its findings were this body (previously pasted from the wrong PR), the tool-install trap, and the missing guard test. All three are addressed.
Conflict check vs #31:
git merge-treeclean.