Starstruk Logo MarkStarstruk

v0.9.2

FireRedTeam/FireRedVADv0.9.2May 17, 2026by github-actions[bot]

AI Summary

A significant release focusing on security hardening and stability. It adds status broadcast capabilities and introduces strict security measures for webhooks and media handling. Numerous fixes address data integrity, CLI usability, and synchronization issues.

Key Highlights

  • Added support for sending WhatsApp status broadcasts (text and media).
  • Security hardening including webhook validation and blocking of private link previews.
  • Fixed history sync to display edited message bodies correctly.
  • Fixed delivery timeouts and data serialization issues.

New Features

  • Send status command
  • Separate status message storage
  • Webhook validation
  • Block private link previews
  • Fix edited message history
  • Fix poll creation

Full Release Notes

## Changelog

### Added

- Send: add `wacli send status` for WhatsApp status broadcasts, including text statuses with optional background/font and media statuses with captions. (#247 - thanks @dovocoder)
- Store: persist synced and locally sent status broadcasts separately in `status_messages` instead of mixing them into normal chat messages.

### Security

- CI: pin GitHub Actions and Docker base images to immutable refs and pin GoReleaser to an exact version.
- Send: block automatic link previews from fetching localhost, private, link-local, multicast, and other non-public addresses.
- Sync: validate webhook URLs, redact webhook errors, disable private-network webhook targets by default, and add `--webhook-allow-private` for trusted local endpoints.

### Fixed

- Accounts: serialize account config mutations with a config lock and save through unique temporary files.
- CLI: strip terminal control characters from human/table/error output.
- CLI: open the local store through SQLite read-only mode for `--read-only` commands instead of initializing writer state.
- Media: enforce regular-file and size limits for sends, stickers, voice notes, profile pictures, contacts imports, thumbnails, and unknown-length downloads.
- Messages: make `--delete-media --for-me` remove the stored local media file when present.
- Store: count all chats and groups in `store stats` instead of the first 50 entries.
- Sync: warn when bootstrap contact/group/channel refresh fails instead of silently ignoring it.
- Sync: bound each webhook delivery request so shutdown is not stuck behind a slow endpoint.
- History: unwrap edited WhatsApp messages during history sync and backfill so stored/searchable text shows the edited body instead of `(message)`. (#246 - thanks @hiasinho)
- Polls: use WhatsApp's single-select poll creation field for outbound single-select polls and preserve unmatched poll vote hashes in `poll show --json`. (#248 - thanks @dovocoder)
- Sync: canonicalize `@lid` chat JIDs before enqueuing media downloads so `sync --follow --download-media` finds the correct DB row for live one-to-one messages. (#244 - thanks @Daniel1of1)