What changed
On October 26, 2026, the Wails maintainers published v3.0.0 as a stable release. It is a ground-up redesign of the Go-plus-web-frontend desktop framework: multiple independent windows, service objects with lifecycle hooks, typed events, statically generated JS/TS bindings, native menus and tray, desktop signing/packaging, built-in update flow and an MCP service for app testing. Windows, macOS and Linux are in the desktop stability contract; iOS/Android are experimental. The Go minimum is 1.26, GTK4/WebKitGTK 6.0 is the Linux default, and moving from v2 requires a real code port rather than changing the dependency version. The release warns that certain same-origin and HTTP child-frame paths can still reach bound Go methods.
Why it matters
Wails provides a native-WebView alternative to bundling an entire browser for Go-backed desktop applications. Version 3 changes how applications are structured, built, updated and tested, making previously awkward multi-window, tray and service workflows first-class. But it also introduces significant migration work, a newer Go toolchain requirement and security boundaries developers must understand before embedding untrusted content. The experimental mobile support is an opportunity for shared code, not a production stability promise. No independent cross-platform benchmark or reliability study is available to validate all release claims.
The application and binding model is rewritten
Wails v3 applications explicitly register Go services, windows, managers and events. Exported Go methods become callable from web frontends via static-analysis-generated TypeScript or JavaScript bindings, preserving names, comments and enums. A v2 app needs lifecycle and service changes plus regenerated bindings; the old context-bound runtime is not drop-in compatible.
Desktop features and build distribution
Stable targets are Windows amd64/arm64, macOS Intel/Apple Silicon and Linux amd64/arm64. Linux defaults to GTK4/WebKitGTK 6.0, with legacy GTK3 available using -tags gtk3 until v3.1. Features include multiwindow, system tray, native dialogs, keyboard shortcuts, drag-and-drop, notifications, code signing, platform installers and an in-app updater with cryptographic verification and rollback. Taskfile-based builds and wails3 setup/doctor make the toolchain more inspectable.
Mobile, server and AI testing
iOS and Android builds share much application/frontend code but are explicitly experimental and outside the desktop compatibility promise. The same services can also run as a headless HTTP server. An optional MCP service lets AI tooling inspect and drive a running Wails app for testing; this is a testing surface, not a reason to expose an app's privileged methods to untrusted clients.
Security caveats matter at the WebView boundary
The v3.0.0 release fixes several published v3 issues but notes GHSA-2p5f-2gx8-mh8m is only partly addressed. On Linux, same-origin child frames (including srcdoc/about:blank) may reach the native handler through their parent; cross-origin frames are blocked. On experimental Android, the window.wails bridge is exposed to every WebView frame pending a planned fix. Across platforms, bound-method calls from child frames can use /wails/runtime over HTTP; treat any embedded iframe as capable of calling exposed Go methods. Avoid untrusted iframe content and apply least privilege to bindings.
Migration and maintenance
Install with go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0; Go 1.26+ is required, with recent security-patched Go toolchains recommended. The v2 and v3 CLIs/module paths are separate and can coexist; v2 still receives critical updates. v3 will use weekly minor releases, nightly prereleases and patch hotfixes. Pin matching @wailsio/runtime and CLI versions for reproducible production builds.