v2.17.0

## Installation

```bash
go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.0
```

## Changes

### Security

- Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead
- `wails init` now warns that remote templates are code: the `frontend:*` commands in `wails.json` and the scripts they call run during `wails build` and `wails dev`. The warning lists the commands found in the generated `wails.json` and is also shown with `-q`. The template docs now describe this trust boundary.
- Hardened the `wails dev` server against cross-origin and DNS-rebinding attacks on the IPC WebSocket. It previously accepted any origin and forwarded straight to the bound-method dispatcher, so a malicious page in the developer's browser could connect to `ws://localhost:34115/wails/ipc` and invoke the entire bound Go API. Every request's `Host` header is now checked against an allowlist (localhost, IP literals, the configured bind address, plus any hosts named in `WAILS_DEV_ALLOWED_HOSTS`), the IPC upgrade requires a same-origin `Origin` header, and a per-launch capability cookie (HttpOnly, SameSite=Strict) is required on the upgrade as defense in depth; the cookie is named per dev server port and refreshed before each reconnect, so open browser tabs reconnect after `wails dev` restarts the app. This protects against browser-based attacks; other processes running as the developer's own user are outside the dev server's threat model by @nft

### Changed

- Replaced the `github.com/wailsapp/mimetype` fork with upstream `github.com/gabriel-vasile/mimetype` v1.4.16 for asset MIME type detection

The `wails dev` hardening comes from #6036 by @nft, merged as part of #6288.

## Also includes v2.15.0 and v2.16.0

v2.15.0 and v2.16.0 were tagged without GitHub releases. Their changes are part of this release:

### v2.16.0

- Fixed a memory leak in the macOS and Linux frontends where `Calloc` never freed the C strings it allocated for dialogs, menus and window setup by @4RH1T3CT0R7

### v2.15.0

- Added `EnableAutoplayWithoutUserAction` macOS webview preference to allow HTML5 media to autoplay without a user gesture [#5512](https://github.com/wailsapp/wails/pull/5512) by @Eyalm321

## What's Changed
* fix: security hardening for v2 and v3 by @taliesin-ai in https://github.com/wailsapp/wails/pull/6288
* fix(v2/release): pin pnpm 10 for the versioned docs step by @taliesin-ai in https://github.com/wailsapp/wails/pull/6293
**Full Changelog**: https://github.com/wailsapp/wails/compare/v2.14.0...v2.17.0