fix(windows/v3): HiddenOnTaskbar blocks keyboard focus; layered window hit-test region frozen after resize

[Copilot]

Two Windows-specific bugs identified in discussion #5001.

Description

Bug 1 — HiddenOnTaskbar: true blocks all keyboard input

WS_EX_NOACTIVATE was used instead of WS_EX_TOOLWINDOW. WS_EX_NOACTIVATE prevents window activation entirely — blocking keyboard focus and input. WS_EX_TOOLWINDOW is the correct style to hide from the taskbar.

Bug 2 — Frameless+transparent window hit-test region frozen at creation size

On WS_EX_LAYERED windows, Windows fixes the hit-testable region at CreateWindowEx time. SetWindowPos alone does not update it — after resize, the expanded area is permanently click-through.

Fix: call SetLayeredWindowAttributes(hwnd, 0, 255, LWA_ALPHA) after each SetWindowPos in setPhysicalBounds() to refresh the layered region.

// Before (broken):
if options.Windows.HiddenOnTaskbar {
    //exStyle |= w32.WS_EX_TOOLWINDOW  // correct but commented out
    exStyle |= w32.WS_EX_NOACTIVATE    // blocks keyboard focus
}

// After:
if options.Windows.HiddenOnTaskbar {
    exStyle |= w32.WS_EX_TOOLWINDOW
}

Changed files:

• v3/pkg/application/webview_window_windows.go — fix HiddenOnTaskbar style; call SetLayeredWindowAttributes after SetWindowPos in setPhysicalBounds()
• v3/pkg/w32/user32.go — add SetLayeredWindowAttributes wrapper
• v3/pkg/w32/constants.go — add LWA_ALPHA and LWA_COLORKEY constants

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Cross-compiled with GOOS=windows GOARCH=amd64 go build ./pkg/w32/... ./pkg/application/... — builds clean. Runtime validation requires Windows with a frameless+transparent window.

• Windows
• macOS
• Linux

Test Configuration

Linux CI only; Windows runtime testing required by reviewer.

Checklist:

• I have updated v3/UNRELEASED_CHANGELOG.md with details of this PR
• My code follows the general coding style of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[cloudflare-workers-and-pages]

Deploying wails with    Cloudflare Pages

Latest commit:	a524c67
Status:	✅  Deploy successful!
Preview URL:	https://c45de5f8.wails.pages.dev
Branch Preview URL:	https://copilot-fix-issues-from-disc.wails.pages.dev

View logs

[semgrep-code-wailsapp]

Semgrep found 1 ssc-cee3e6d5-d7c8-4c35-9815-076aa1ebfd49 finding:

• v3/examples/dev/frontend/package-lock.json
  • L569 - Triage

Risk: Affected versions of rollup are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Manual Review Advice: A vulnerability from this advisory is reachable if you use Rollup to bundle JavaScript with import.meta.url and the output format is set to cjs, umd, or iife formats, while allowing users to inject scriptless HTML elements with unsanitized name attributes

Fix: Upgrade this library to at least version 3.29.5 at wails/v3/examples/dev/frontend/package-lock.json:569.

Reference(s): GHSA-gcx4-mw62-g8wm, CVE-2024-47068