fix(whatsapp-gateway): resolve link-preview-js peer conflict and commit lockfile#6192
Merged
Conversation
…it lockfile npm install in packages/whatsapp-gateway failed with ERESOLVE without --legacy-peer-deps: the gateway declared link-preview-js@^4.0.1 as a direct dependency while @whiskeysockets/[email protected] lists it as peerOptional ^3.0.0. The direct declaration defeated the optional flag, so resolution hard-failed and no lockfile could be generated. link-preview-js is never require()d in the gateway, so the direct dependency is dropped. An overrides pin to ^4.0.1 keeps the #5934 SSRF fix (GHSA-4gp8-rjrq-ch6q) in force if baileys ever pulls it in transitively. A package-lock.json is now committed so installs are reproducible and CI can run npm audit against a locked graph. Closes #6180
github-actions
Bot
added
size/XL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #6180.
npm installinpackages/whatsapp-gateway/failed withERESOLVEunless--legacy-peer-depswas passed, and the package shipped no lockfile.Root cause: the gateway declared
link-preview-js@^4.0.1as a direct dependency, while@whiskeysockets/[email protected]listslink-preview-js@^3.0.0aspeerOptional. A direct declaration at a conflicting range defeats theoptionalflag, so npm hard-fails resolution and writes no lockfile.link-preview-jsis never imported anywhere in the gateway code (verified: zerorequire/importacrossindex.js,lib/,test/).Changes
packages/whatsapp-gateway/package.jsonlink-preview-jsdirect dependency.overridesblock pinninglink-preview-jsto^4.0.1so that if Baileys ever pulls it in transitively, the patched line is forced — preserving the fix(deps): patch rand (0.8.6/0.9.3) and link-preview-js (4.0.1) security advisories #5934 SSRF fix (GHSA-4gp8-rjrq-ch6q,link-preview-js <= 4.0.0).packages/whatsapp-gateway/package-lock.json— committed for the first time, so installs are reproducible and CI can runnpm auditagainst a locked graph.CHANGELOG.md— entry under[Unreleased] → Fixed.Verification
Clean resolution with no
--legacy-peer-deps, lockfile written (156 packages, 0 vulnerabilities).Out of scope
Wiring an actual
npm audit/ install CI job forpackages/whatsapp-gateway(no workflow installs this package today;supply-chain-audit.ymlscans only Python skills/hands/extensions). That is a separate.github/workflows/change and should be its own issue/PR.