Skip to content

v0.2.1

Choose a tag to compare

View all tags
@jack-arturo jack-arturo released this 15 May 01:26
v0.2.1
6bb5359
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.2.1 (2026-05-14)

Security

  • require bearer-token authentication and loopback Host validation for all bridge /api/* routes, confine outbound media files to configured media roots, and add MCP client token propagation. This fixes unauthenticated local bridge access and arbitrary-file exfiltration via media_path. Existing installs must restart both components and configure WHATSAPP_BRIDGE_TOKEN or let the MCP server read whatsapp-bridge/store/.bridge-token; outbound media must live under WHATSAPP_MEDIA_ROOTS or the default outbox. (9ee4481)

Bug Fixes

  • bridge: log send caller identity (#96) (c81947c)
  • bridge: pass message store when sending messages (#91) (423ada9)
  • bridge: set FileName and detect MIME for document sends (#95) (af18908)
  • ci: make dependabot auto-approve non-fatal (#65) (ea0dfb1)
  • send and track disappearing-message settings correctly (#82) (b250409)
  • server: list_chats/get_chat error when include_last_message=False (#79) (31e03e6)

Documentation

  • add contributors section and updating instructions to README (#67) (71b0c03)
  • Update SECURITY.md with enhanced security policy (#78) (214780f)
Assets 7
Loading