build(deps): dependency refresh, Wails v3, leak and body-drain fixes

.github/workflows/ci.yml

@@ -189,7 +189,7 @@ jobs:
       - name: Install Linux webview dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev
+          sudo apt-get install -y libgtk-4-dev libwebkitgtk-6.0-dev
 
       - name: Verify build with all tag combinations
         run: task build-check
@@ -199,7 +199,7 @@ jobs:
         run: |
           mkdir -p ../dashboard/static/spa
           touch ../dashboard/static/spa/.keep
-          CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=false -tags "production,webkit2_41" -o /dev/null .
+          CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=false -tags "production" -o /dev/null .
           CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -buildvcs=false -tags "production" -ldflags "-H windowsgui" -o /dev/null .
           CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -trimpath -buildvcs=false -tags "production" -ldflags "-H windowsgui" -o /dev/null .
 
@@ -380,7 +380,7 @@ jobs:
 
       - name: Upload govulncheck SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           sarif_file: govulncheck.sarif
           category: govulncheck
@@ -452,7 +452,7 @@ jobs:
           free -h
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: 'manual'
@@ -464,7 +464,7 @@ jobs:
         run: go build -p 2 ./...
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           category: "/language:${{ matrix.language }}"
 

.github/workflows/release.yml

@@ -251,7 +251,7 @@ jobs:
         if: runner.os == 'Linux'
         run: |
           sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev
+          sudo apt-get install -y libgtk-4-dev libwebkitgtk-6.0-dev
 
       - name: Build SPA
         shell: bash
@@ -271,7 +271,6 @@ jobs:
           version="${TAG#v}"
           tags=production
           ldflags="-s -w -X ${VERSION_PKG}.Build=${version}"
-          [ "$RUNNER_OS" = "Linux" ] && tags="$tags,webkit2_41"
           [ "$RUNNER_OS" = "Windows" ] && ldflags="$ldflags -H windowsgui"
           [ "$RUNNER_OS" = "macOS" ] && ldflags="$ldflags -extldflags '-framework UniformTypeIdentifiers'"
           mkdir -p ../out/pkg

.github/workflows/scorecard.yml

@@ -38,6 +38,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           sarif_file: results.sarif

README.md

@@ -98,7 +98,7 @@ server and dashboard (system webview, no browser needed). Download
 
 - macOS: unzip and open `Gopherstack.app`. It is ad-hoc signed, not notarized, so the first launch needs approval: System Settings → Privacy & Security → Open Anyway, or `xattr -dr com.apple.quarantine Gopherstack.app`
 - Windows: unzip and run `gopherstack-desktop.exe` (needs the WebView2 runtime, preinstalled on Windows 11)
-- Linux: extract and run `gopherstack-desktop` (needs `libgtk-3` and `libwebkit2gtk-4.1`)
+- Linux: extract and run `gopherstack-desktop` (needs GTK 4 and WebKitGTK 6.0: `libgtk-4-1` and `libwebkitgtk-6.0-4`)
 
 It serves on port 8000 if free, otherwise a random loopback port, and accepts
 the same flags and environment variables as the headless binary (e.g. `--port`).
@@ -222,7 +222,7 @@ A built-in UI at `http://localhost:8000/dashboard` for inspecting and managing l
 ### Desktop App
 
 `gopherstack-desktop` runs the full emulator and its dashboard as a native app on
-macOS, Windows and Linux, with no browser or terminal needed. It's built with Wails
+macOS, Windows and Linux, with no browser or terminal needed. It's built with Wails v3
 on the system webview, so it adds only a few MB over the headless binary, and it
 ships with every release next to the headless `gopherstack`. See
 [Desktop app](#desktop-app) for install steps.
@@ -771,7 +771,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [EMR](services/emr/README.md) | A | 65 | 7 structural gaps |
 | [EMR Serverless](services/emrserverless/README.md) | A | 22 | 1 structural gap |
 | [Elasticsearch](services/elasticsearch/README.md) | A | 51 | 1 structural gap |
-| [Glue](services/glue/README.md) | A | 59 | 3 gaps; 5 structural gaps; 2 deferred |
+| [Glue](services/glue/README.md) | A | 59 | 4 gaps; 5 structural gaps; 2 deferred |
 | [Glue DataBrew](services/databrew/README.md) | A | 44 | 1 structural gap |
 | [Kinesis](services/kinesis/README.md) | A | 39 | 1 gap; 5 structural gaps |
 | [Kinesis Analytics](services/kinesisanalytics/README.md) | A | 20 | clean |

Taskfile.yml

@@ -37,7 +37,7 @@ tasks:
         go build \
           -trimpath \
           -buildvcs=false \
-          -tags "production{{if eq OS "linux"}},webkit2_41{{end}}" \
+          -tags "production" \
           -ldflags "-w -s -X {{.VERSION_PKG}}.Build={{.BUILD_VERSION}}{{if eq OS "windows"}} -H windowsgui{{end}}{{if eq OS "darwin"}} -extldflags '-framework UniformTypeIdentifiers'{{end}}" \
           -o ../bin/{{.BINARY_NAME}}-desktop{{exeExt}} .
 
@@ -68,24 +68,24 @@ tasks:
         if [ "$(uname -s)" = "Linux" ]; then
           echo "Building desktop linux/$(go env GOARCH)..."
           CGO_ENABLED=1 GOOS=linux go -C desktop build \
-            -trimpath -buildvcs=false -tags "production,webkit2_41" \
+            -trimpath -buildvcs=false -tags "production" \
             -ldflags "-w -s -X {{.VERSION_PKG}}.Build={{.BUILD_VERSION}}" \
             -o "../bin/desktop/{{.BINARY_NAME}}-desktop-linux-$(go env GOARCH)" .
         elif command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
           for arch in amd64 arm64; do
-            echo "Building desktop linux/${arch} via Docker (webkit2gtk-4.1)..."
+            echo "Building desktop linux/${arch} via Docker (WebKitGTK 6.0)..."
             docker run --rm --platform "linux/${arch}" \
               -v "$PWD:/src" -w /src/desktop \
               -e CGO_ENABLED=1 -e GOTOOLCHAIN=auto \
-              golang:1.27-bookworm bash -c "
-                apt-get update -qq && apt-get install -y -qq libgtk-3-dev libwebkit2gtk-4.1-dev >/dev/null &&
-                go build -trimpath -buildvcs=false -tags 'production,webkit2_41' \
+              golang:1.27-trixie bash -c "
+                apt-get update -qq && apt-get install -y -qq libgtk-4-dev libwebkitgtk-6.0-dev >/dev/null &&
+                go build -trimpath -buildvcs=false -tags 'production' \
                   -ldflags '-w -s -X {{.VERSION_PKG}}.Build={{.BUILD_VERSION}}' \
                   -o '../bin/desktop/{{.BINARY_NAME}}-desktop-linux-${arch}' .
               "
           done
         else
-          echo "Skipping linux desktop builds (requires Linux host or running Docker daemon for webkit2gtk-4.1 CGO headers)"
+          echo "Skipping linux desktop builds (requires Linux host or running Docker daemon for WebKitGTK 6.0 CGO headers)"
         fi
       - ls -lh bin/desktop/