2026.7.1
CVHub520/X-AnyLabeling2026.7.1Jul 15, 2026by devlikepro
AI Summary
This release introduces security features like scoped session keys and Passkey support, while simultaneously fixing critical bugs in the WEBJS, GOWS, and NOWEB drivers.
Key Highlights
- Implemented scoped session keys to prevent API key leakage
- Added Passkey (WebAuthn) session pairing support
- Fixed WEBJS issues with group and chats API endpoints
- Fixed GOWS stream error handling and media acks
New Features
- Scoped session keys for media and control
- Passkey (WebAuthn) session pairing
- Exposed account LID in session 'me' info
Full Release Notes
🆕 **New**
- `2026.7.1` - **API** - scoped session keys — narrow media / control keys so you never share the real API key - [**🔒 Keys API**](https://waha.devlike.pro/docs/how-to/security/#scoped-session-keys-media--control) - [#2146](https://github.com/devlikeapro/waha/issues/2146)
- `2026.7.1` - **GOWS** - Passkey (WebAuthn) session pairing — pair sessions from your own UI - [**How to Handle Passkey**](https://waha.devlike.pro/blog/waha-passkey/)
- `2026.7.1` - **WEBJS** - expose the current account LID in session “me” info (`me.lid`)
🛠️ **Fixes**
- `2026.7.1` - **WEBJS** - `waha is not receiving message events` after the `_serialized` id rename - [#2157](https://github.com/devlikeapro/waha/issues/2157), #2162
- `2026.7.1` - **WEBJS** - `Unhandled TypeError: Cannot read properties of undefined (reading 'includes')` - [#2158](https://github.com/devlikeapro/waha/issues/2158)
- `2026.7.1` - **WEBJS** - `GET /api/{session}/groups` returns HTTP 500 - [#2159](https://github.com/devlikeapro/waha/issues/2159)
- `2026.7.1` - **WEBJS** - `Cannot GET /api/{session}/chats` - [#2160](https://github.com/devlikeapro/waha/issues/2160)
- `2026.7.1` - **WEBJS** - sending an image fails with `msg.avParams is not a function` - [#2149](https://github.com/devlikeapro/waha/issues/2149)
- `2026.7.1` - **GOWS** - session silently stops sending webhook events after `<stream:error>` (media ack); status stayed `WORKING` until a manual restart - [#2151](https://github.com/devlikeapro/waha/issues/2151)
- `2026.7.1` - **NOWEB** - timestamp bug that breaks message sorting when fetching chat history - [#2139](https://github.com/devlikeapro/waha/issues/2139)
- `2026.7.1` - **MCP** - do not share the real API key in media and auth (QR / screenshot) tool output - [#2146](https://github.com/devlikeapro/waha/issues/2146)
📊 **Dashboard**
- `2026.7.1` - Passkey UI — extension-assisted pairing with a manual DevTools fallback, driven by `session.status`
- `2026.7.1` - fix image emoji
⚙️ **Updates**
- `2026.7.1` - **WEBJS** - up engine
- `2026.7.1` - **GOWS** - up engine
- `2026.7.1` - **NOWEB** - up engine
- `2026.7.1` - **WPP** - up engine
**Full Changelog**: https://github.com/devlikeapro/waha/compare/2026.6.1...2026.7.1