fix(deps): bump @whiskeysockets/baileys to 7.0.0-rc12 (GHSA-qvv5-jq5g…

[dr-wiechert]

…-4cgg)

What does this PR do?

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

How to Test

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[alt-glitch]

This was generated by AI during triage.

Related: this is the fix PR for the open CVE issue #43814 (GHSA-qvv5-jq5g-4cgg) and a clean one-file version of the closed, whole-fork-contaminated #43815. Note there is already an open cluster bumping further to rc13: #47805 (rc9->rc13, canonical), #43840 (rc13 for LID group sends), #44980 (npm-audit superset), #24677 (only rc10, still vulnerable). A maintainer should pick one bump target (rc12 here vs rc13 in the cluster) rather than merge several.

[egilewski]

superseded

Security evidence:

• trust boundary: the WhatsApp bridge receives remote WhatsApp protocol messages through Baileys, and GHSA-qvv5-jq5g-4cgg covers spoofed message/history-sync payload handling in vulnerable Baileys versions.
• source/sink/invariant: scripts/whatsapp-bridge/package.json and scripts/whatsapp-bridge/package-lock.json need to keep @whiskeysockets/baileys at a patched version without regressing the dependency state already present on current main.
• current-main reproduction: current GitHub main (3a1a3c7e6727a31df89b61b27bad313430bdac45) already pins both the manifest and lockfile to 7.0.0-rc13, which is above the advisory's 7.0.0-rc12 patched floor.
• PR-head or patch-replay validation: the meaningful patch replay for this PR changes the manifest from 7.0.0-rc13 down to 7.0.0-rc12, and the selected PR head still has the lockfile root dependency on WhiskeySockets/Baileys#01047debd81beb20da7b7779b08edcb06aa03770 with node_modules/@whiskeysockets/baileys at 7.0.0-rc.9.
• positive/negative cases: git diff --check passed and git apply --check confirmed the current-main replay is mechanically reviewable, but that replay is a downgrade relative to current main.
• residual bypass search: the PR only changes dependency metadata, and current main already exceeds the advisory's patched version floor in both manifest and lockfile.
• reviewer validation: local current-main, PR-head, advisory, and replay checks all point to the same result, so review stopped at the first blocker.

Review setup: I reviewed a run-owned patch replay against current GitHub main because the submitted branch is stale/conflicted; this does not mean the submitted branch itself merges cleanly.

Signed: GPT-5.5-xhigh in Codex

[teknium1]

Thanks for the security update. This is superseded by the stronger Baileys remediation already on main.

• Automated hermes-sweeper review verified scripts/whatsapp-bridge/package.json:11 and scripts/whatsapp-bridge/package-lock.json:11,757 now pin @whiskeysockets/baileys to 7.0.0-rc13.
• GitHub's advisory for GHSA-qvv5-jq5g-4cgg identifies 7.0.0-rc12 as the first patched rc release; current rc13 therefore satisfies the requested security floor.
• Commit c30c9753b6efc08e154d66b6501a444739df3859 (fix(whatsapp): unpin Baileys from git commit, use published 7.0.0-rc13 (#60643)) made the replacement and is included in v2026.7.7.2.
• As noted in the superseded review comment, replaying this PR would select rc12 instead of main's newer rc13 state.