Skip to content

build(deps): bump the npm_and_yarn group across 3 directories with 4 updates #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps): bump the npm_and_yarn group across 3 directories with 4 updates #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion extensions/whatsapp/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"description": "OpenClaw WhatsApp channel plugin",
"type": "module",
"dependencies": {
"@whiskeysockets/baileys": "7.0.0-rc.9",
"@whiskeysockets/baileys": "7.0.0-rc12",
"jimp": "^1.6.0"
},
"devDependencies": {
Expand Down
6 changes: 3 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1192,7 +1192,7 @@
"@sinclair/typebox": "0.34.48",
"@slack/bolt": "^4.6.0",
"@slack/web-api": "^7.14.1",
"@whiskeysockets/baileys": "7.0.0-rc.9",
"@whiskeysockets/baileys": "7.0.0-rc12",
"ajv": "^8.18.0",
Comment on lines 1194 to 1196

@llamapreview llamapreview Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 | Confidence: Medium

Speculative: The upgrade of @whiskeysockets/baileys from 7.0.0-rc.9 to 7.0.0-rc12 addresses a known security vulnerability (GHSA-qvv5-jq5g-4cgg), which is positive. However, the release notes explicitly state that v7.0.0-rc11 and v7.0.0-rc12 add preinstall and prepare scripts that execute during installation, and caution to “Review the package contents before updating.” This introduces a supply-chain risk: arbitrary code execution during install. Since no related code context is available to verify the exact behavior of those scripts, the potential impact cannot be quantified. The version change is visible in the diff, but the risk is contingent on the trustworthiness of the newly added scripts. Therefore this is a P2 (suggestion) to manually inspect the published package’s post-install scripts before merging.

"chalk": "^5.6.2",
"chokidar": "^5.0.0",
Expand All @@ -1204,7 +1204,7 @@
"express": "^5.2.1",
"file-type": "^21.3.1",
"grammy": "^1.41.1",
"hono": "4.12.18",
"hono": "4.12.21",
"https-proxy-agent": "^8.0.0",
"ipaddr.js": "^2.3.0",
"jiti": "^2.6.1",
Expand Down Expand Up @@ -1261,7 +1261,7 @@
"pnpm": {
"minimumReleaseAge": 2880,
"overrides": {
"hono": "4.12.18",
"hono": "4.12.21",
"@hono/node-server": "1.19.10",
"fast-xml-parser": "5.3.8",
"request": "npm:@cypress/request@3.0.10",
Expand Down
Loading
Loading