Repository navigation
Conversation
…e gate The inbox release gate (validate-inbound-inbox-source) runs npm audit --omit=dev --audit-level=low with no allowlist, and 4 advisories published after the live commit a6253e7 now fail it: - proxy-addr 2.0.7 -> 2.0.8 (CRITICAL, GHSA-jqcg-44mw-7w3h) - compression 1.8.1 -> 1.8.2 (HIGH, GHSA-vc2v-76pw-4v95) - sharp 0.35.4 -> 0.35.5 (HIGH, GHSA-wq5f-xc86-pv6w) - music-metadata 11.14.0 -> 11.16.1 (MODERATE, 3 GHSAs) music-metadata stays on the 11.x line (baileys range ^11.12.3) instead of the 12.x major: 11.16.1 is already outside the vulnerable <=11.15.0 range. The compat suite asserts the audited runtime versions; align the assertions.
Member
Author
|
Substituído pela composição reconciliada #4, integrada na main em O head reconciliado Rollback administrativo: reabrir este PR; rollback da integração: revert do merge |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
O que muda
Endurece o guard de mídia recebida (
isMedia/isVideo) para admitir os envelopesviewOnceMessage/viewOnceMessageV2/viewOnceMessageV2Extension/ephemeralMessage,que o Baileys entrega embrulhados e hoje ficam fora do bloco de upload S3 (e do base64
para webhook). Sem isso, um vídeo "ver uma vez" de lead não gera
mediaUrlnem linhaMedia.inboundMediaUpload.ts: novo helperunwrapInboundMediaContent(desembrulha recursivamenteos wrappers, sem mutar a mensagem persistida).
whatsapp.baileys.service.ts: os dois guards (entrada ~1742 e envio ~2990) passam a calcularisMedia/isVideosobre o conteúdo desembrulhado.wa.types.ts:viewOnceMessageV2Extensionincluído emMessageSubtype(o desembrulho deownKeyMediaMessage/download cobre a variante estendida).test/xmacna-inbound-media-guard.test.ts: regressão com protobufviewOnceMessageV2+videoMessage(e demais envelopes).Por quê
Avaliação MAR-398: o guard só olhava tipos no topo; o envelope view-once/ephemeral pulava o
bloco S3 inteiro. Impacto observado hoje nulo (0
viewOnceMessage*em ~430k mensagens),mas risco latente.
Validação
npm run test:xmacna-inbox→ 69/69.npx tsc --noEmit→ OK.npx eslintnos arquivos tocados → OK.Rollback
Reverter o merge deste PR (a imagem viva
sha256:75bb77f8cbde…/a6253e79permanece intacta;nenhum cutover foi feito).
MAR: MAR-414 · Contexto: MAR-398 · Registro: xmacna/elysium#671