Starstruk Logo MarkStarstruk

2026.7.1

parruda/swarm2026.7.1Jul 15, 2026by devlikepro

AI Summary

This release adds scoped session keys for enhanced security, introduces WebAuthn passkey support, and fixes several WebSocket and API issues.

Key Highlights

  • Scoped session keys (media/control) to prevent sharing real API keys.
  • Passkey (WebAuthn) session pairing support.
  • Exposing account LID in session 'me' info.
  • Fixes for message event handling, group/chats API, and image sending failures.
  • Fix for timestamp bug affecting message sorting.

New Features

  • Scoped session keys
  • Passkey support
  • WebAuthn session pairing
  • Session info updates
  • Bug fixes for WEBJS/GOWS/MCP

Full Release Notes

🆕 **New**

-   `2026.7.1` - **API** - scoped session keys — narrow media / control keys so you never share the real API key - [**🔒 Keys API**](https://waha.devlike.pro/docs/how-to/security/#scoped-session-keys-media--control) - [#2146](https://github.com/devlikeapro/waha/issues/2146)
-   `2026.7.1` - **GOWS** - Passkey (WebAuthn) session pairing — pair sessions from your own UI - [**How to Handle Passkey**](https://waha.devlike.pro/blog/waha-passkey/)
-   `2026.7.1` - **WEBJS** - expose the current account LID in session “me” info (`me.lid`)

🛠️ **Fixes**

-   `2026.7.1` - **WEBJS** - `waha is not receiving message events` after the `_serialized` id rename - [#2157](https://github.com/devlikeapro/waha/issues/2157), #2162
-   `2026.7.1` - **WEBJS** - `Unhandled TypeError: Cannot read properties of undefined (reading 'includes')` - [#2158](https://github.com/devlikeapro/waha/issues/2158)
-   `2026.7.1` - **WEBJS** - `GET /api/{session}/groups` returns HTTP 500 - [#2159](https://github.com/devlikeapro/waha/issues/2159)
-   `2026.7.1` - **WEBJS** - `Cannot GET /api/{session}/chats` - [#2160](https://github.com/devlikeapro/waha/issues/2160)
-   `2026.7.1` - **WEBJS** - sending an image fails with `msg.avParams is not a function` - [#2149](https://github.com/devlikeapro/waha/issues/2149)
-   `2026.7.1` - **GOWS** - session silently stops sending webhook events after `<stream:error>` (media ack); status stayed `WORKING` until a manual restart - [#2151](https://github.com/devlikeapro/waha/issues/2151)
-   `2026.7.1` - **NOWEB** - timestamp bug that breaks message sorting when fetching chat history - [#2139](https://github.com/devlikeapro/waha/issues/2139)
-   `2026.7.1` - **MCP** - do not share the real API key in media and auth (QR / screenshot) tool output - [#2146](https://github.com/devlikeapro/waha/issues/2146)

📊 **Dashboard**

-   `2026.7.1` - Passkey UI — extension-assisted pairing with a manual DevTools fallback, driven by `session.status`
-   `2026.7.1` - fix image emoji

⚙️ **Updates**

-   `2026.7.1` - **WEBJS** - up engine
-   `2026.7.1` - **GOWS** - up engine
-   `2026.7.1` - **NOWEB** - up engine
-   `2026.7.1` - **WPP** - up engine

**Full Changelog**: https://github.com/devlikeapro/waha/compare/2026.6.1...2026.7.1