v8.1.2

aldinokemal/go-whatsapp-web-multidevicev8.1.2Jan 18, 2026by aldinokemal

AI Summary

A critical security patch release addressing data leaks between devices and fixing issues with message reactions and webhook event filtering.

Key Highlights

  • Security fix: Prevent cross-device data leak in chat message queries
  • Bug fix: React to other users' messages by looking up IsFromMe from database
  • Bug fix: Webhook event whitelist filtering for groups and proper event names
  • Breaking Change: message.deleted payload structure changed from flat to nested format

Breaking Changes

  • The message.deleted payload structure changed from flat to nested format

New Features

  • Enhanced security isolation between devices
  • Improved message reaction functionality
  • Corrected webhook event routing and naming

Full Release Notes

## What's New in v8.1.2

šŸ”§ **Patch Release: Security Fix & Bug Fixes**

This patch release includes an important security fix and several bug fixes.

---

## šŸ”’ Security Fixes

### Prevent Cross-Device Data Leak in Chat Message Queries (#525)
- **Issue**: Device A could potentially read chat history belonging to Device B when they share the same target JID
- **Fix**: Add device_id filtering to message queries with fail-fast validation
- **Impact**: Ensures complete data isolation between devices at multiple layers (usecase, wrapper, and repository)
- **Changes**:
  - Add DeviceID field to MessageFilter struct
  - Require device_id in GetMessages/SearchMessages
  - Add early deviceID validation in GetChatMessages usecase
  - Remove race-prone state mutations in wrapper repositories

---

## šŸ› Bug Fixes

### React to Other Users' Messages (#535)
- **Issue**: ReactMessage was hardcoded with `FromMe=true`, which only worked for reacting to your own messages
- **Fix**: Look up the message in the database to get the correct `IsFromMe` value
- **Impact**: Users can now properly react to messages sent by others

### Webhook Event Whitelist Filtering (#539)
- **Issue**: After setting whitelist env to just `message`, webhook was still receiving `message.ack` events from groups
- **Fix**: Properly route group events through whitelist filter and fix event name mismatches
- **Impact**: Webhook event filtering now works correctly for all event types
- **Changes**:
  - Fixed event names to match documented names (`message.ack`, `message.deleted`, etc.)
  - Group events now properly go through whitelist filtering
  - Added comprehensive test coverage for whitelist filtering
- **Breaking Change āš ļø**: The `message.deleted` payload structure changed from flat to nested format to align with other webhook events

---

## šŸ”§ Technical Improvements

### Dependency Updates
- **go.mau.fi/whatsmeow**: Updated to latest version
- **golang.org/x/crypto**: Updated to v0.47.0
- **golang.org/x/net**: Updated to v0.49.0
- **golang.org/x/image**: Updated to v0.35.0
- **github.com/sirupsen/logrus**: Updated to v1.9.4
- **github.com/klauspost/compress**: Updated to v1.18.3
- **Other Dependencies**: Various Go module updates for stability

---

## What's Changed
* fix(security): prevent cross-device data leak in chat message queries by @aldinokemal in https://github.com/aldinokemal/go-whatsapp-web-multidevice/pull/525
* fix: react to other users' messages by looking up IsFromMe from database by @aldinokemal in https://github.com/aldinokemal/go-whatsapp-web-multidevice/pull/535
* fix: webhook event whitelist filtering for groups and proper event names by @aldinokemal in https://github.com/aldinokemal/go-whatsapp-web-multidevice/pull/539

**Full Changelog**: https://github.com/aldinokemal/go-whatsapp-web-multidevice/compare/v8.1.1...v8.1.2