2026.7.1
AIPentest/CyberStrikeAI2026.7.1Jul 15, 2026by devlikepro
AI Summary
Adds scoped session keys for security and Passkey session pairing, while fixing critical bugs in WEBJS API endpoints and message sending.
Key Highlights
- Introduced scoped session keys to prevent sharing real API keys.
- Added Passkey (WebAuthn) support for secure session pairing.
- Fixed numerous WEBJS bugs including group/chats API endpoints and image sending.
- Updated all major engines (WEBJS, GOWS, NOWEB, WPP) to the latest versions.
New Features
- Scoped session keys
- Passkey pairing
- Exposure of current account LID in session info (me.lid)
- Passkey UI improvements
Full Release Notes
🆕 **New**
- `2026.7.1` - **API** - scoped session keys — narrow media / control keys so you never share the real API key - [**🔒 Keys API**](https://waha.devlike.pro/docs/how-to/security/#scoped-session-keys-media--control) - [#2146](https://github.com/devlikeapro/waha/issues/2146)
- `2026.7.1` - **GOWS** - Passkey (WebAuthn) session pairing — pair sessions from your own UI - [**How to Handle Passkey**](https://waha.devlike.pro/blog/waha-passkey/)
- `2026.7.1` - **WEBJS** - expose the current account LID in session “me” info (`me.lid`)
🛠️ **Fixes**
- `2026.7.1` - **WEBJS** - `waha is not receiving message events` after the `_serialized` id rename - [#2157](https://github.com/devlikeapro/waha/issues/2157), #2162
- `2026.7.1` - **WEBJS** - `Unhandled TypeError: Cannot read properties of undefined (reading 'includes')` - [#2158](https://github.com/devlikeapro/waha/issues/2158)
- `2026.7.1` - **WEBJS** - `GET /api/{session}/groups` returns HTTP 500 - [#2159](https://github.com/devlikeapro/waha/issues/2159)
- `2026.7.1` - **WEBJS** - `Cannot GET /api/{session}/chats` - [#2160](https://github.com/devlikeapro/waha/issues/2160)
- `2026.7.1` - **WEBJS** - sending an image fails with `msg.avParams is not a function` - [#2149](https://github.com/devlikeapro/waha/issues/2149)
- `2026.7.1` - **GOWS** - session silently stops sending webhook events after `<stream:error>` (media ack); status stayed `WORKING` until a manual restart - [#2151](https://github.com/devlikeapro/waha/issues/2151)
- `2026.7.1` - **NOWEB** - timestamp bug that breaks message sorting when fetching chat history - [#2139](https://github.com/devlikeapro/waha/issues/2139)
- `2026.7.1` - **MCP** - do not share the real API key in media and auth (QR / screenshot) tool output - [#2146](https://github.com/devlikeapro/waha/issues/2146)
đź“Š **Dashboard**
- `2026.7.1` - Passkey UI — extension-assisted pairing with a manual DevTools fallback, driven by `session.status`
- `2026.7.1` - fix image emoji
⚙️ **Updates**
- `2026.7.1` - **WEBJS** - up engine
- `2026.7.1` - **GOWS** - up engine
- `2026.7.1` - **NOWEB** - up engine
- `2026.7.1` - **WPP** - up engine
**Full Changelog**: https://github.com/devlikeapro/waha/compare/2026.6.1...2026.7.1