fix(whatsapp): bump baileys to 7.0.0-rc.13 to patch CVE-2026-48063

[dovginsburg]

Summary

Fix CVE-2026-48063 (critical) in the WhatsApp bridge by bumping @whiskeysockets/baileys from a pre-CVE git SHA to the patched npm version ^7.0.0-rc.13. This clears all 5 outstanding npm audit findings (1 critical, 2 high, 2 moderate) that currently show up in hermes doctor.

Root cause

scripts/whatsapp-bridge/package.json pins baileys to WhiskeySockets/Baileys#01047debd81beb20da7b7779b08edcb06aa03770, which resolves to 7.0.0-rc.9. CVE-2026-48063 / GHSA-qvv5-jq5g-4cgg was patched in 7.0.0-rc.12 (and rc.13 adds a regression fix), but because the dep is referenced via git SHA, npm audit reports "no fix available" — even though the patched versions exist on the registry.

Why we can't use the override pattern from #19204

PR #19204 (Teknium, May 2026) deliberately avoided bumping baileys because at the time all npm-published 7.0.0-rc.* versions pulled the same vulnerable libsignal-node tree. Since then Baileys shipped 7.0.0-rc.10, rc.11 (rc.11 release notes: "pinned the libsignal pipeline to the NPM registry"), rc.12 (CVE fix), and rc.13 (regression fix). The CVE-patched libsignal pipeline is now on the registry.

Changes

• @whiskeysockets/baileys: WhiskeySockets/Baileys#01047debd81beb20da7b7779b08edcb06aa03770 → ^7.0.0-rc.13
• express: ^4.21.0 → ^4.21.2 (pulls in the latest transitive qs fix)
• protobufjs override (^7.5.5) preserved from fix(whatsapp): pin protobufjs >=7.5.5 to clear 3 critical npm vulns in baileys bridge #19204

Validation

• npm audit: 5 vulns (1 critical, 2 high, 2 moderate) → 0 vulnerabilities
• Installed versions after fix: baileys 7.0.0-rc13, protobufjs 7.6.4, qs 6.15.3, ws 8.21.0, express 4.22.2
• node --check bridge.js: parses cleanly
• node -e "import('@whiskeysockets/baileys')": 263 exports resolve, including all 5 the bridge imports (makeWASocket, useMultiFileAuthState, DisconnectReason, fetchLatestBaileysVersion, downloadMediaMessage)
• Live bridge after launchctl bootout → npm install → launchctl bootstrap: {"status":"connected","queueLength":0,"uptime":N}

Out of scope

The following are working-tree-only changes on Dov's local checkout, intentionally NOT included in this PR:

• markOnlineOnConnect: true + presence keepalive (60s) + sendReceipts for blue checks — Dov's 2026-05-31 local patches for presence/read-receipt behavior
• ensure-local-patches.py invariant checker that enforces the above patches stay applied
• .bak files and scratch files in the bridge dir

If maintainers want those upstream too, happy to send a separate PR — they are behaviorally orthogonal to the CVE fix.

Refs

• GHSA-qvv5-jq5g-4cgg
• CVE-2026-48063
• Baileys rc.11 release notes (libsignal move to NPM)
• Baileys rc.12 release notes (CVE fix)
• Baileys rc.13 release notes (regression fix on rc.12)
• PR fix(whatsapp): pin protobufjs >=7.5.5 to clear 3 critical npm vulns in baileys bridge #19204 (precedent for security-driven override PR)

[alt-glitch]

This was generated by AI during triage.

Competing/overlapping with the open CVE cluster for GHSA-qvv5-jq5g-4cgg: #47805 (rc.9->rc.13 security bump), #44980 (npm audit fix, 5/5 vulns), and CVE issue #43814. This PR does the same rc.13 bump plus the express/npm-audit cleanup. Flagging for a maintainer to pick the canonical one — not marking duplicate since the scope differs.

[egilewski]

superseded

Review setup note: I reviewed a run-owned patch replay of this PR's two-file dependency diff against current GitHub main (b9b463f3bd6517b76687d9b3c9dea1e62f01f9e1) because the submitted branch has an unrelated-history/current-main conflict; this does not mean the submitted branch itself merges cleanly.

Current main already resolves Baileys 7.0.0-rc13, express 4.22.2, qs 6.15.3, ws 8.21.0, and protobufjs 7.6.5, and npm audit --package-lock-only --audit-level=moderate --json reports zero vulnerabilities there. The replayed PR diff also audits clean, but it no longer supplies the claimed CVE fix; it changes the root Baileys range to ^7.0.0-rc.13 and express to ^4.21.2 while moving protobufjs from 7.6.5 to 7.6.4 and sharp optional packages from 0.35.3 to 0.35.2.

I also checked npm install --package-lock-only --ignore-scripts --dry-run, node --check bridge.js, and git diff --check on the replay, plus the same lockfile dry-run and syntax check on current main.

Signed: GPT-5.5-xhigh in Codex

[teknium1]

Thanks for the focused security update. This is an automated hermes-sweeper review; the requested Baileys migration is already implemented on current main.

• scripts/whatsapp-bridge/package.json:11 now pins the published 7.0.0-rc13 package.
• scripts/whatsapp-bridge/package-lock.json:756-766 resolves that release from npm and records the registry-backed libsignal dependency.
• Commit c30c9753b6efc08e154d66b6501a444739df3859 (fix(whatsapp): unpin Baileys from git commit, use published 7.0.0-rc13 (#60643)) supplies this behavioral fix and is included in v2026.7.7.2.
• This also confirms the contributor follow-up identifying the PR as superseded.