fix(whatsapp): bump Baileys pin to v7.0.0-rc13 to fix LID-addressed group sends

[liuhao1024]

What does this PR do?

Bumps the WhatsApp bridge's Baileys dependency pin from v7.0.0-rc.9 (commit 01047de) to v7.0.0-rc13 (commit 8053b086) to fix silent message drops in LID-addressed WhatsApp groups.

Related Issue

Fixes #43830

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• scripts/whatsapp-bridge/package.json: Updated @whiskeysockets/baileys pin from 01047debd81beb20da7b7779b08edcb06aa03770 (rc.9) to 8053b086ecc97ec3f78299561de11959bab05d39 (rc.13)
• scripts/whatsapp-bridge/package-lock.json: Regenerated to match the new Baileys version and its updated dependency tree

How to Test

1. Configure a WhatsApp bridge with a group where all participants use @lid addressing (no @s.whatsapp.net JIDs)
2. Send a message from the bot to the group
3. Before this fix: sendMessage returns a messageId but the message never appears in the group
4. After this fix: messages are delivered normally to LID-addressed groups
5. Existing Baileys sessions/creds survive the upgrade — no re-pairing needed

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Code Intelligence

• Analyzed: scripts/whatsapp-bridge/package.json (Baileys dependency pin)
• Blast radius: LOW — dependency-only change, no control flow modifications
• Related patterns: Baileys LID addressing is a known upstream issue (WhiskeySockets/Baileys#8053b086). The bridge's sendMessage API surface is unchanged — only the underlying library version changes.

[austinpickett]

Approving the Baileys rc13 bump. ✅

What this does:

• Pins @whiskeysockets/baileys from commit 01047deb (rc9) → 8053b086 (rc13)
• Also pulls in updated transitive deps: libsignal → npm ^6.0.0 (no longer a git dep!), whatsapp-rust-bridge 0.5.2 → 0.5.4, protobufjs 7.5.6 → 7.6.3

Re: #43815 (rc12 CVE fix):
This PR targets rc13 which is a superset of rc12 — it contains whatever CVE-2026-48063 fix landed in rc12, plus further fixes for LID-addressed group sends. Merging this PR renders #43815 obsolete. Recommend adding a comment on #43815 pointing here.

Conflict check with proxy cluster:

• The canonical proxy PR (#43822) intentionally omits package-lock.json, so there is no lock-file conflict between these two PRs. They can merge independently.
• If any proxy PR with a package-lock.json (#43607, #43659) were used instead, they would conflict since they pin the old Baileys commit hash in the lock. The choice of #43822 as canonical cleanly avoids this.

Suggested merge order: #43840 first (Baileys bump), then #43822 (proxy), then run npm install to regenerate the lock file with both changes applied.

[myth05]

This one is still the right first merge in the WhatsApp bridge sequence. #44358 is approved and waiting behind it; once this lands, I will regenerate #44358 on top of updated main so the lockfile conflict is trivial and the bridge audit clears fully.

[ilteoood]

@kshitijk4poor @teknium1
Hey guys, considering that this PR has been approved, would it be possible to merge it?
It would be great to have this update in the next Hermes release

[teknium1]

This dependency update is already implemented on current main; closing as superseded by automated hermes-sweeper review.

• scripts/whatsapp-bridge/package.json:11 now declares @whiskeysockets/baileys as published 7.0.0-rc13.
• scripts/whatsapp-bridge/package-lock.json:756-759 resolves the same rc13 package.
• Commit c30c9753b6efc08e154d66b6501a444739df3859 made the rc13 update and is included in release v2026.7.7.2.
• This retains the requested rc13 behavior while replacing the older git-source pin with the published package.