fix(whatsapp-bridge): bump @whiskeysockets/baileys and resolve transitive protobufjs vulns - #24677
Closed
kairoxxai wants to merge 1 commit into
Closed
fix(whatsapp-bridge): bump @whiskeysockets/baileys and resolve transitive protobufjs vulns#24677kairoxxai wants to merge 1 commit into
kairoxxai wants to merge 1 commit into
Conversation
… vulns Closes 4 of 7 npm audit findings (3 high, 1 moderate). Remaining 3 (2 moderate, 1 critical protobufjs DoS) blocked by libsignal hard pinning protobufjs 6.8.8 inside @whiskeysockets/libsignal-node; upstream baileys has not refreshed it. Revisit when baileys ships 7.0.0 final or apply npm overrides if exposure changes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
alt-glitch
added
type/security
austinpickett
requested changes
May 19, 2026
austinpickett
left a comment
austinpickett
left a comment
Collaborator
There was a problem hiding this comment.
Please use .github/PULL_REQUEST_TEMPLATE.md and fix merge conflicts.
Contributor
There was a problem hiding this comment.
Pull request overview
Bumps @whiskeysockets/baileys from 7.0.0-rc.9 to ^7.0.0-rc10 in the WhatsApp bridge scripts and refreshes the lockfile to pull in patched transitive dependencies (protobufjs, path-to-regexp, music-metadata, etc.), resolving 4 of 7 npm audit findings. Remaining 3 vulnerabilities are blocked by libsignal's pin to protobufjs@6.8.8.
Changes:
- Bump
@whiskeysockets/baileysdependency range to^7.0.0-rc10. - Regenerate
package-lock.jsonto pick up patched transitive deps and drop optional@img/sharp-*/@emnapi/runtimeentries no longer required. - Pull in new transitive dep
whatsapp-rust-bridge@0.5.3.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| scripts/whatsapp-bridge/package.json | Updates baileys version range and reorders deps alphabetically. |
| scripts/whatsapp-bridge/package-lock.json | Regenerated lockfile reflecting the baileys bump and patched transitive deps. |
Files not reviewed (1)
- scripts/whatsapp-bridge/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Jun 10, 2026
Closed
23 tasks
Contributor
|
Thanks for the dependency-audit work. This is now superseded by a stronger implementation already on
Automated hermes-sweeper review. |
teknium1
added
the
sweeper:implemented-on-main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes 4 of 7
npm auditfindings (3 high, 1 moderate) inscripts/whatsapp-bridge/:@whiskeysockets/baileys7.0.0-rc.9 → 7.0.0-rc10npm audit fixresolves transitive protobufjs / libsignal advisories where possibleRemaining vulnerabilities (not addressed here)
3 vulns remain (2 moderate, 1 critical), all in the same chain:
The critical (
GHSA-685m-2w69-288q— protobufjs DoS via unbounded recursion) is blocked bylibsignal's hard pin toprotobufjs@6.8.8. Resolving it requires either upstreambaileysto ship a libsignal refresh, ornpm overridesto force a newer protobufjs (which carries runtime risk — protobufjs 6.x → 7.x has minor API breaks libsignal may not tolerate).Test plan
node --check bridge.js— syntax OKbaileys,express,pino,qrcode-terminal,allowlist.js)node allowlist.test.mjs— 4/4 tests pass