mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-05-06 02:37:05 +08:00
55647a5813
The whatsapp-bridge pulls @whiskeysockets/baileys at a pinned git commit whose transitive dep tree ships protobufjs <7.5.5, triggering GHSA-xq3m-2v4x-88gg (critical, arbitrary code execution). npm audit reported 3 cascading criticals: protobufjs, @whiskeysockets/libsignal-node (pulls protobufjs), and baileys itself (effect rollup). Fix: add npm overrides block pinning protobufjs to ^7.5.5. Deduplicates to a single 7.5.6 copy at node_modules/protobufjs that both libsignal-node and any other consumers resolve through normal module resolution. Why not bump baileys: npm-published baileys@6.17.16 is deprecated by the maintainers (wrong version), 7.0.0-rc.* still pulls the same vulnerable libsignal-node, and upstream Baileys HEAD adds a 4th vuln (music-metadata). The override is the minimal, behavior-preserving fix. Validation: - npm audit: 3 critical -> 0 vulnerabilities - node -e "import('@whiskeysockets/baileys')" -> all 5 named exports (makeWASocket, useMultiFileAuthState, DisconnectReason, fetchLatestBaileysVersion, downloadMediaMessage) resolve - node bridge.js loads all modules and reaches Express bind (exits only on EADDRINUSE because the live gateway owns :3000) - Single deduped protobufjs@7.5.6 in the tree
20 lines
470 B
JSON
20 lines
470 B
JSON
{
|
|
"name": "hermes-whatsapp-bridge",
|
|
"version": "1.0.0",
|
|
"description": "WhatsApp bridge for Hermes Agent using Baileys",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"start": "node bridge.js"
|
|
},
|
|
"dependencies": {
|
|
"@whiskeysockets/baileys": "WhiskeySockets/Baileys#01047debd81beb20da7b7779b08edcb06aa03770",
|
|
"express": "^4.21.0",
|
|
"qrcode-terminal": "^0.12.0",
|
|
"pino": "^9.0.0"
|
|
},
|
|
"overrides": {
|
|
"protobufjs": "^7.5.5"
|
|
}
|
|
}
|