fix(whatsapp): bump baileys to >=7.0.0-rc13 to clear GHSA-qvv5-jq5g-4cgg

[cihuyyama]

What does this PR do?

Clears critical advisory GHSA-qvv5-jq5g-4cgg in the WhatsApp bridge by switching @whiskeysockets/baileys from a SHA pin (resolving to 7.0.0-rc.9) to the npm registry alias npm:baileys@^7.0.0-rc13.

The advisory is "message upsert / hist sync spoofing and app state corruption via crafted protocolMessage payload". Affected range: >=7.0.0-rc.1 <7.0.0-rc12 -- i.e. rc.1 through rc11 are vulnerable, rc12 and later are clean. The current pin (01047debd...) resolves to rc.9, squarely inside the affected range. npm audit fix cannot help because git-SHA pins are immutable to npm's resolver, so every fresh install via the official Windows installer leaves npm audit reporting 1 critical severity vulnerability.

Does this regress the cc4b1f000 workaround? No. That commit pinned to fix/abprops-abt-fetch "until the next Baileys release includes it". That branch was merged to Baileys master as PR WhiskeySockets/Baileys#2473 on 2026-04-24, well before rc10. The abprops fix is present in every release from rc10 onward, including rc13. This PR simply graduates that workaround onto the official release line.

The npm alias keeps the @whiskeysockets/baileys import path, so bridge.js needs no code changes. Future patch releases inside ^7.0.0-rc13 will pull in automatically and npm audit will start working again for this bridge.

Related Issue

No tracking issue exists. Filing the PR as-is per CONTRIBUTING.md (advisory is already public via GitHub Security; no private disclosure path needed).

Type of Change

• Security fix

Changes Made

scripts/whatsapp-bridge/package.json:

-    "@whiskeysockets/baileys": "WhiskeySockets/Baileys#01047debd81beb20da7b7779b08edcb06aa03770",
+    "@whiskeysockets/baileys": "npm:baileys@^7.0.0-rc13",

scripts/whatsapp-bridge/package-lock.json: regenerated. The overrides.protobufjs field from PR #19204 is preserved and still applies (the lockfile shows protobufjs@7.6.4 resolving through it). The diff is large (~530 lines) because rc.9 -> rc13 brings new transitive versions (libsignal renamed from @whiskeysockets/libsignal-node, protobufjs 7.5.6 -> 7.6.4, ws 8.20.0 -> 8.21.0, pino 9.2.0 -> 9.3.0, @img/sharp-* 0.34.5 -> 0.35.1, whatsapp-rust-bridge 0.5.2 -> 0.5.4). All pulled directly from baileys@7.0.0-rc13's own resolution; no manually-added dependencies.

No Python files touched, so the Python test suite is unaffected. bridge.js is untouched.

How to test

cd scripts/whatsapp-bridge
Remove-Item -Recurse -Force node_modules, package-lock.json -ErrorAction SilentlyContinue
npm install
npm audit

Before this PR:

baileys  7.0.0-rc.1 - 7.0.0-rc11
Severity: critical
Baileys has message upsert / hist sync spoofing and app state corruption ...
1 critical severity vulnerability

After this PR:

found 0 vulnerabilities

API surface preserved -- verified locally

bridge.js consumes Baileys via 5 named imports plus several methods on the constructed socket. All are present and correctly typed in rc13:

Named imports (top of bridge.js):
[OK] makeWASocket              function
[OK] useMultiFileAuthState     function
[OK] DisconnectReason          object
[OK] fetchLatestBaileysVersion function
[OK] downloadMediaMessage      function

Methods used on the constructed socket:
[OK] sock.updateMediaMessage   function   (reuploadRequest callback)
[OK] sock.sendMessage          function   (text + edit + media flows)
[OK] sock.ev                   object     (event emitter)
[OK] sock.logout               function

Enum values used in the reconnect logic:
DisconnectReason.loggedOut        = 401
DisconnectReason.restartRequired  = 515
DisconnectReason.connectionClosed = 428

Reproduce locally:

cd scripts/whatsapp-bridge
node --input-type=module -e "
  import { makeWASocket, DisconnectReason } from '@whiskeysockets/baileys';
  const sock = makeWASocket({
    auth: { creds: {}, keys: { get: () => ({}), set: async () => {} } },
    printQRInTerminal: false, syncFullHistory: false, markOnlineOnConnect: false,
  });
  for (const k of ['updateMediaMessage','sendMessage','ev','logout']) {
    console.log(k in sock ? '[OK]' : '[MISSING]', 'sock.'+k, typeof sock[k]);
  }
  console.log('[ENUM] DisconnectReason.loggedOut =', DisconnectReason.loggedOut);
"

Platforms Tested

• Windows 11, Node v22.22.3 (Hermes-managed Node), Python 3.11.15.
• Verified path: fresh installer -> npm install (142 packages, 0 vulns) -> npm audit clean -> import smoke test pass -> socket-method smoke test pass -> existing paired session in whatsapp/session/ preserved (separate concern from the dep change).

I don't have macOS or Linux setups to test on -- happy to defer to CI or a maintainer's local check. Risk surface for platform sensitivity is limited to Baileys' own native modules (@img/sharp-*, whatsapp-rust-bridge); both already publish prebuilt binaries for the same matrix as rc.9.

Notes

• The original SHA pin (cc4b1f000) was a temporary workaround for WhiskeySockets/Baileys#2477 (the abprops bad-request issue). PR fix: defer streaming iteration linebreak to prevent blank line stacking #2473 fixed it and merged to Baileys master on 2026-04-24; that fix is in every tagged release from rc10 onward.
• I'm available to rework the diff if you'd prefer a different shape -- e.g. a fresher SHA pin in the cc4b1f000 style, or splitting the lockfile churn into a separate chore(deps) follow-up. Just let me know.

[alt-glitch]

Duplicate of #43840 — both bump the WhatsApp bridge @whiskeysockets/baileys pin to 7.0.0-rc13 to clear critical GHSA-qvv5-jq5g-4cgg. #43840 is the earlier open PR with the same one-file fix. Tracking issue: #43814.

[liuhao1024]

Closing as duplicate of #43840 by @poisdahl, which was opened earlier (June 10) with the same one-file fix bumping Baileys to >=7.0.0-rc13 to clear GHSA-qvv5-jq5g-4cgg.

#43840 has passing CI and covers the identical change. Keeping the upstream surface focused on the earlier PR.

[cihuyyama]

Thanks @alt-glitch for the heads-up and the cross-link to #43840 / #43814 — closing this as a duplicate.

Apologies for the noise; I missed #43840 in my pre-submit search since its title leads with the LID-addressed group send fix rather than the GHSA-qvv5-jq5g-4cgg advisory. #43840 is the correct PR to land — it's already approved by @austinpickett, bumps to the same rc13, and additionally cleans up the transitive deps (libsignal -> npm, whatsapp-rust-bridge, protobufjs) which my one-liner did not.

Closing in favor of #43840. Looking forward to seeing it merged.