Eliminates command injection vulnerability (CWE-78) by switching from
shell-based exec() to execFile() which passes arguments as an array
without spawning a shell. Behavior is identical — same ffmpeg args,
same output — but injection via crafted paths is now impossible.
https://claude.ai/code/session_01E2cfX1N3sJgCJBTvzGazSG
Surgically applies the changes from WhiskeySockets/Baileys commit b5c1741
("feat: replace async crypto with sync Rust WASM" by jlucaso1) while
preserving all custom modifications (interactive messages, carousels,
albums, sticker packs, native flow buttons, Prometheus metrics, etc).
Changes:
- Replace async hkdf/md5 (Web Crypto API) with sync re-exports from whatsapp-rust-bridge@0.5.2
- Replace LTHash class with LTHashAntiTampering from WASM
- Replace mutationKeys() with expandAppStateKeys() from WASM
- Remove ~25 unnecessary await keywords across crypto call chain
- Update Buffer→Uint8Array types for MediaDecryptionKeyInfo and internal crypto functions
- Make noise handshake, media retry encrypt/decrypt, and reporting token generation synchronous
Performance impact:
- Eliminates Promise overhead on every HKDF/LTHash operation
- Significant improvement during app state sync (hundreds of mutations per reconnection)
- Sync crypto reduces event loop pressure under high session load
Custom code preserved (zero conflicts):
- messages-send.ts: All interactive message, carousel, album, sticker pack logic intact
- Types/Message.ts: All custom types (NativeFlowButton, Carousel, Album, etc.) intact
- All Prometheus metrics, circuit breakers, session TTL logic intact
https://claude.ai/code/session_01Ffc5YrPuqv8N9SwEuSM8mr
Fixes the error “No image processing library is available.” even when Jimp is installed.
In recent versions of Jimp, Jimp is now defined as a class instead of an object, which breaks the existing type check.
*Idk if this is useless/useful
* refactor: reorganize browser utility functions and improve buffer handling
* fix: harden protobuf deserialization and clean up code
* refactor: simplify data handling in GroupCipher and SenderKey classes
* fix: Ensure consistent Buffer hydration and remove redundant code
* refactor: update decodeAndHydrate calls to use proto types for improved type safety
* feat: implement basic newsletter functionality with socket integration and event handling
* feat: enhance media handling for newsletters with raw media upload support
* feat: working updatePicture, removePicure, adminCount, mute, Unmute
* fix: fetchMessages
* chore: cleanup
* fix: update newsletter metadata path and query ID for consistency. newsletterMetadata works now
* chore: enhance newsletter metadata parsing and error handling
* fix: correct DELETE QueryId value in Newsletter.ts
* chore: split mex stuffs to own file
* chore: remove as any
* Add support for custom profile picture dimensions
The updateProfilePicture and generateProfilePicture functions now accept an optional dimensions parameter, allowing custom width and height for profile pictures. This provides more flexibility for image resizing beyond the default 640x640 size.
* minor corrections
Replaces 'w' and 'h' with 'width' and 'height' in profile picture related functions for improved clarity and consistency.
* fix lint
When extracting duration from an audio file provided as a file path,
use music-metadata's parseFile method instead of manually creating a
read stream and using parseStream.
parseFile utilizes random access, which can significantly improve
performance over streaming in many cases. However, actual speed gains
depend on the file format and the structure of tag headers.
Co-authored-by: Borewit <Borewit@users.noreply.github.com>
* feat: interface "ILogger" created
feat: interface "ILogger" used instead of pino logger
feat: "PinoLoggerAdapter" created to implement "ILogger" interface
* feat: PinoLoggerAdapter removed
feat: ILogger mapping the features we're using from pino
* fix: sort imports
---------
Co-authored-by: Mateus Franchini de Freitas <contato.mateusfr@outlook.com>
Co-authored-by: Mateus Franchini de Freitas <mfranchini@domtec.com.br>
Co-authored-by: Rajeh Taher <rajeh@reforward.dev>
Claude