Repository navigation
Conversation
…iring Backports evolution-foundation#2727 onto the 2.3.7 tag (avoids the licensing gate present on develop/2.4.0).
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis backport upgrades Baileys to rc14 and uses patch-package to vendor the companion_reg_refresh pairing fix plus a guard for malformed link-code notifications, with Docker build changes ensuring the patch is present before installation; reviewers should focus on patch correctness against rc14, lockfile integrity, install/build behavior, and pairing and messaging regression coverage. Sequence diagram for repaired device pairingsequenceDiagram
actor User
participant EvolutionAPI
participant Baileys
participant WhatsApp
User->>EvolutionAPI: Start device pairing
EvolutionAPI->>Baileys: Register companion device
WhatsApp-->>Baileys: companion_reg_refresh
Baileys->>Baileys: Handle companion_reg_refresh
Baileys-->>EvolutionAPI: pair-success
EvolutionAPI-->>User: Pairing succeeds
Flow diagram for applying the Baileys compatibility patchflowchart LR
Source["Docker build context"] --> Package["package.json and package-lock.json"]
Source --> Patches["patches/baileys+7.0.0-rc14.patch"]
Package --> Install["npm install"]
Patches --> Install
Install --> Postinstall["postinstall: patch-package"]
Postinstall --> Runtime["Baileys rc14 with pairing fixes"]
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
There was a problem hiding this comment.
Hey - I've found 1 security issue, and 1 other issue
Security issues:
- GPL-3.0-only: Open-source license can require releasing the entire application source (link)
Fixed security issues:
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="package.json" line_range="81" />
<code_context>
"audio-decode": "^2.2.3",
"axios": "^1.7.9",
- "baileys": "7.0.0-rc.9",
+ "baileys": "7.0.0-rc14",
"class-validator": "^0.14.1",
"compression": "^1.7.5",
</code_context>
<issue_to_address>
**QR refreshes exhaust pairing limit**
When enough `companion_reg_refresh` notifications arrive during QR pairing to reach the configured limit, `handleCompanionRegRefresh` re-emits the current QR, and `BaileysStartupService.connectionUpdate` counts each refresh as a new attempt. `qrcode.count` reaches `QRCODE_LIMIT`, so the next refreshed QR is rejected and pairing ends even though the server-issued QR ref is still valid.
Distinguish refreshed QR codes from new attempts so re-emitting the current QR does not increment the attempt count.
</issue_to_address>
### Comment 2
<location path="package-lock.json" line_range="10669-10678" />
<code_context>
</code_context>
<issue_to_address>
**security (license/libsignal):** GPL-3.0-only: Open-source license can require releasing the entire application source
This `GPL-3.0-only` open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
*Source: trivy*
</issue_to_address>Sourcery assessment
Needs a human reviewer. 2 findings to address first, and a server refresh now replaces and persists the adv secret used in the pairing QR, so a faulty refresh handler could disrupt device linking or affect the authentication material used during pairing. Reverting removes the handler but does not restore secrets already saved, though pairing can generally be retried.
Blocking findings: package.json:81, package-lock.json:10678
| "audio-decode": "^2.2.3", | ||
| "axios": "^1.7.9", | ||
| "baileys": "7.0.0-rc.9", | ||
| "baileys": "7.0.0-rc14", |
Contributor
There was a problem hiding this comment.
🟡 Medium · QR refreshes exhaust pairing limit
When enough companion_reg_refresh notifications arrive during QR pairing to reach the configured limit, handleCompanionRegRefresh re-emits the current QR, and BaileysStartupService.connectionUpdate counts each refresh as a new attempt. qrcode.count reaches QRCODE_LIMIT, so the next refreshed QR is rejected and pairing ends even though the server-issued QR ref is still valid.
Distinguish refreshed QR codes from new attempts so re-emitting the current QR does not increment the attempt count.
Prompt for AI agents
In `package.json` at line 81:
**QR refreshes exhaust pairing limit**
When enough `companion_reg_refresh` notifications arrive during QR pairing to reach the configured limit, `handleCompanionRegRefresh` re-emits the current QR, and `BaileysStartupService.connectionUpdate` counts each refresh as a new attempt. `qrcode.count` reaches `QRCODE_LIMIT`, so the next refreshed QR is rejected and pairing ends even though the server-issued QR ref is still valid.
Distinguish refreshed QR codes from new attempts so re-emitting the current QR does not increment the attempt count.
Comment on lines
10669
to
10678
| "node_modules/libsignal": { | ||
| "name": "@whiskeysockets/libsignal-node", | ||
| "version": "2.0.1", | ||
| "resolved": "git+ssh://git@github.com/whiskeysockets/libsignal-node.git#1c30d7d7e76a3b0aa120b04dc6a26f5a12dccf67", | ||
| "version": "6.0.0", | ||
| "resolved": "https://registry.npmjs.org/libsignal/-/libsignal-6.0.0.tgz", | ||
| "integrity": "sha512-d/5V3YFtDljbFMufz4ncyUYGYhJl+vzAe+c2EFFBQ6bz1h8Q3IOMEGXYMzlibU60I+e8GagMMpji18iez3P1hA==", | ||
| "license": "GPL-3.0", | ||
| "dependencies": { | ||
| "curve25519-js": "^0.0.4", | ||
| "protobufjs": "6.8.8" | ||
| } | ||
| }, | ||
| "node_modules/libsignal/node_modules/@types/node": { | ||
| "version": "10.17.60", | ||
| "resolved": "https://registry.npmjs.org/@types/node/-/node-10.17.60.tgz", | ||
| "integrity": "sha512-F0KIgDJfy2nA3zMLmWGKxcH2ZVEtCZXHHdOQs2gSaQ27+lNeEfGxzkIw90aXswATX7AZ33tahPbzy6KAfUreVw==", | ||
| "license": "MIT" | ||
| }, | ||
| "node_modules/libsignal/node_modules/long": { | ||
| "version": "4.0.0", | ||
| "resolved": "https://registry.npmjs.org/long/-/long-4.0.0.tgz", | ||
| "integrity": "sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA==", | ||
| "license": "Apache-2.0" | ||
| }, | ||
| "node_modules/libsignal/node_modules/protobufjs": { | ||
| "version": "6.8.8", | ||
| "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-6.8.8.tgz", | ||
| "integrity": "sha512-AAmHtD5pXgZfi7GMpllpO3q1Xw1OYldr+dMUlAnffGTAhqkg72WdmSY71uKBF/JuyiKs8psYbtKrhi0ASCD8qw==", | ||
| "hasInstallScript": true, | ||
| "license": "BSD-3-Clause", | ||
| "dependencies": { | ||
| "@protobufjs/aspromise": "^1.1.2", | ||
| "@protobufjs/base64": "^1.1.2", | ||
| "@protobufjs/codegen": "^2.0.4", | ||
| "@protobufjs/eventemitter": "^1.1.0", | ||
| "@protobufjs/fetch": "^1.1.0", | ||
| "@protobufjs/float": "^1.0.2", | ||
| "@protobufjs/inquire": "^1.1.0", | ||
| "@protobufjs/path": "^1.1.2", | ||
| "@protobufjs/pool": "^1.1.0", | ||
| "@protobufjs/utf8": "^1.1.0", | ||
| "@types/long": "^4.0.0", | ||
| "@types/node": "^10.1.0", | ||
| "long": "^4.0.0" | ||
| }, | ||
| "bin": { | ||
| "pbjs": "bin/pbjs", | ||
| "pbts": "bin/pbts" | ||
| "protobufjs": "^7.5.5" | ||
| } | ||
| }, |
Contributor
There was a problem hiding this comment.
security (license/libsignal): GPL-3.0-only: Open-source license can require releasing the entire application source
This GPL-3.0-only open-source license can impose strong copyleft or non-commercial obligations that may require releasing your full application source code or restrict commercial use, depending on how the code is used or distributed
Source: trivy
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description
Backport of #2727 to the 2.3.x line (
main), for users who run 2.3.7 and can't pair new devices.Since ~2026-07-28 WhatsApp sends a
companion_reg_refreshstage during device registration. Baileys acks and discards it, sopair-successis never emitted and linking a new device fails silently. No published Baileys release handles it yet (WhiskeySockets/Baileys#2737).This PR applies the same fix as #2727 on top of
main:baileys7.0.0-rc.9→7.0.0-rc14patch-package(+postinstall) andpatches/baileys+7.0.0-rc14.patch, vendoring:companion_reg_refresh(restores pairing)link_code_companion_regagainst notifications missing the crypto fieldsDockerfile: copiespatches/beforenpm installso the patch is applied in the imageAll credit for the patch goes to @cloviscoli (#2727); this only adapts it to
main, which doesn't have thepatches/setup thatdevelophas.🔗 Related Issue
Related: #2727, WhiskeySockets/Baileys#2737
🧪 Type of Change
🧪 Testing
Built the Docker image from this branch and ran it in a real deployment: QR pairing works again and inbound/outbound messages flow end-to-end (n8n webhook integration).
✅ Checklist
📝 Additional Notes
Once Baileys ships a release with these fixes, the patch and
patch-packagecan be dropped in favor of a plain version bump.Summary by Sourcery
Restore new-device pairing compatibility by updating Baileys and applying the required registration fixes.
Bug Fixes:
Enhancements:
Build: