@wppconnect/server-cli 1.3.56 → 1.3.57

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [1.3.57](https://github.com/wppconnect-team/server-cli/compare/v1.3.56...v1.3.57) (2026-10-30)
+
+### Bug Fixes
+
+- complete Babel 8 migration and preserve CommonJS CLI ([#844](https://github.com/wppconnect-team/server-cli/issues/844)) ([a91dd3e](https://github.com/wppconnect-team/server-cli/commit/a91dd3e9cfedf1c97ae65ec1e4fa590c0ec8ab59))
+- **deps:** resolve remaining CLI security alerts ([#876](https://github.com/wppconnect-team/server-cli/issues/876)) ([57ee10d](https://github.com/wppconnect-team/server-cli/commit/57ee10dcacb27f74101494a2f04743fcc3b242f5))
+- protect browser option merging in installed CLI packages ([#877](https://github.com/wppconnect-team/server-cli/issues/877)) ([a61a8e2](https://github.com/wppconnect-team/server-cli/commit/a61a8e2f16e70d6daf3f9da9e07d039b074cd42f))
+
 ## [1.3.56](https://github.com/wppconnect-team/server-cli/compare/v1.3.55...v1.3.56) (2026-10-27)
 
 ### Bug Fixes

package/Dockerfile

@@ -22,6 +22,7 @@ COPY .yarnrc.yml ./
 # Copy only package.json to leverage Docker cache
 COPY package.json ./
 COPY yarn.lock ./
+COPY vendor ./vendor
 
 # Enable corepack and prepare yarn 4.12.0
 RUN corepack enable && \

package/SECURITY_BACKPORTS.md

@@ -0,0 +1,17 @@
+# Private deepmerge backport
+
+This repository-maintained artifact is based on deepmerge4.3.1 and the prototype-poisoning fix from upstream PR274, commit c5ad573121574db1c625b0aabcc6114ed7df6c5a. Its local version4.3.2+wppconnect.1 identifies our security patch and preserves4.x dependency compatibility. It is not a published upstream release. The package is private and must not be published to a registry.
+
+Both copy loops reject the **proto** key before assigning properties. Other merging behavior is preserved. The is-mergeable-object1.1.0 helper is included locally because the original Git source declares it only as a development dependency. Original MIT notices are retained.
+
+Source references:
+
+- https://github.com/TehShrike/deepmerge/tree/5b87756a5671635679001cbac72aa42f23472c81
+- https://github.com/TehShrike/deepmerge/pull/274/commits/c5ad573121574db1c625b0aabcc6114ed7df6c5a
+- https://github.com/TehShrike/is-mergeable-object/tree/v1.1.0
+
+The readable files in vendor/deepmerge and the local tarball represent the same runtime implementation. Native installed-package tests compare their contents. No install scripts, registry publication or changes to unrelated installed dependencies are needed.
+
+For the CLI, the repository resolution selects the private artifact. The startup protection also uses Node's synchronous module-resolution hooks for affected deepmerge requests from Puppeteer Extra consumers, before loading the server dependencies. This covers registry installations where repository resolutions are not inherited and npm can install a separate original copy. Unrelated packages and already-fixed versions retain normal resolution. The CLI's required Node range already follows Babel8: ^22.18.0 or >=24.11.0.
+
+Keep the regression tests when removing this backport after a validated upstream release is available.

package/dist/index.js

@@ -1,4 +1,4 @@
-"use strict";var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");Object.defineProperty(exports, "__esModule", { value: true });exports.run = run;
+"use strict";var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault").default;var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;Object.defineProperty(exports, "__esModule", { value: true });exports.run = run;
 
 
 
@@ -13,12 +13,13 @@
 
 
 
+require("./security");
 var _server = require("@wppconnect/server");
 var express = _interopRequireWildcard(require("express"));
 var fs = _interopRequireWildcard(require("fs"));
 var path = _interopRequireWildcard(require("path"));
 var _mergeDeep = _interopRequireDefault(require("merge-deep"));
-var _program = require("./program");function _interopRequireWildcard(e, t) {if ("function" == typeof WeakMap) var r = new WeakMap(),n = new WeakMap();return (_interopRequireWildcard = function (e, t) {if (!t && e && e.__esModule) return e;var o,i,f = { __proto__: null, default: e };if (null === e || "object" != typeof e && "function" != typeof e) return f;if (o = t ? n : r) {if (o.has(e)) return o.get(e);o.set(e, f);}for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]);return f;})(e, t);} /*
+var _program = require("./program"); /*
  * Copyright 2021 WPPConnect Team
  *
  * Licensed under the Apache License, Version 2.0 (the "License");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_server","require","express","_interopRequireWildcard","fs","path","_mergeDeep","_interopRequireDefault","_program","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","DEFAULT_SECRET_KEY","run","serverOptions","program","parse","commandOptions","opts","config","json","readFileSync","encoding","configOptions","JSON","mergeDeep","error","console","log","process","exit","subOptions","key","opt","find","startsWith","name","substr","length","newName","toLowerCase","slice","isUsable","value","trim","secretKey","env","SECRET_KEY","app","initServer","frontend","frontendPath","frontendPackage","resolve","join","dirname","use","req","res","send","static","next","accepts","sendfile"],"sources":["../src/index.js"],"sourcesContent":["/*\n * Copyright 2021 WPPConnect Team\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { initServer } from '@wppconnect/server';\nimport * as express from 'express';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport mergeDeep from 'merge-deep';\nimport { program } from './program';\n\nconst DEFAULT_SECRET_KEY = 'THISISMYSECURETOKEN';\n\nexport function run() {\n  let serverOptions = {};\n\n  program.parse();\n  const commandOptions = program.opts();\n\n  if (commandOptions.config) {\n    try {\n      const json = fs.readFileSync(commandOptions.config, { encoding: 'utf8' });\n      const configOptions = JSON.parse(json);\n\n      serverOptions = mergeDeep({}, serverOptions, configOptions);\n    } catch (error) {\n      console.log(error);\n      process.exit(1);\n    }\n\n    delete commandOptions.config;\n  }\n\n  const subOptions = ['webhook', 'archive', 'log', 'createOptions'];\n\n  for (const key in commandOptions) {\n    const opt = subOptions.find((opt) => key.startsWith(opt));\n\n    if (opt) {\n      commandOptions[opt] = commandOptions[opt] || {};\n\n      const name = key.substr(opt.length);\n      const newName = name[0].toLowerCase() + name.slice(1);\n\n      commandOptions[opt][newName] = commandOptions[key];\n      delete commandOptions[key];\n    }\n  }\n\n  serverOptions = mergeDeep({}, serverOptions, commandOptions);\n\n  // @wppconnect/server signs tokens with `secretKey` and otherwise falls back to\n  // the public default, which would let anyone mint valid tokens. An explicit\n  // empty/null value would also override that fallback (mergeDeep keeps it), so\n  // blank values count as unset and the validated secret is passed explicitly.\n  const isUsable = (value) => typeof value === 'string' && value.trim() !== '';\n  const secretKey = isUsable(serverOptions.secretKey) ? serverOptions.secretKey : process.env.SECRET_KEY;\n\n  if (!isUsable(secretKey) || secretKey === DEFAULT_SECRET_KEY) {\n    console.error(\n      'Erro: nenhuma \"secretKey\" segura foi definida. Configure --secretKey, \"secretKey\" no arquivo de configuração ou a variável SECRET_KEY (o valor padrão público não é aceito).'\n    );\n    process.exit(1);\n  }\n\n  serverOptions.secretKey = secretKey;\n\n  const { app } = initServer(serverOptions);\n\n  if (commandOptions.frontend) {\n    let frontendPath = commandOptions.frontendPath;\n\n    if (!frontendPath) {\n      try {\n        const frontendPackage = require.resolve('@wppconnect/frontend/package.json');\n        frontendPath = path.join(path.dirname(frontendPackage), 'build');\n      } catch (error) {\n        console.error(\n          'Não foi encontrado o caminho para o frontend, por favor defina com --frontend-path ou instale o pacote @wppconnect/frontend'\n        );\n        process.exit(1);\n      }\n    }\n\n    if (frontendPath) {\n      // Requisição de configuração do frontend\n      app.use('/config.js', (req, res) => {\n        res.set({\n          'Content-Type': 'application/javascript; charset=UTF-8',\n        });\n        res.send(`\n// Arquivo gerado automaticamente\nwindow.IP_SERVER = location.protocol + \"//\" + location.host + '/api/';\nwindow.IP_SOCKET_IO = ((location.protocol === 'https:') ? 'wss:' : 'ws:') + \"//\" + location.host;\n`);\n      });\n\n      app.use(express.static(frontendPath));\n\n      app.get('*', function (req, res, next) {\n        // Força a renderização do react para requisições do browser\n        if (req.accepts('html')) {\n          return res.sendfile(path.join(frontendPath, 'index.html'));\n        }\n        next();\n      });\n    }\n  }\n}\n\nif (process.env['RUN_SERVER']) {\n  run();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAC,uBAAA,CAAAF,OAAA;AACA,IAAAG,EAAA,GAAAD,uBAAA,CAAAF,OAAA;AACA,IAAAI,IAAA,GAAAF,uBAAA,CAAAF,OAAA;AACA,IAAAK,UAAA,GAAAC,sBAAA,CAAAN,OAAA;AACA,IAAAO,QAAA,GAAAP,OAAA,cAAoC,SAAAE,wBAAAM,CAAA,EAAAC,CAAA,4BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,GAAAE,CAAA,OAAAF,OAAA,WAAAR,uBAAA,YAAAA,CAAAM,CAAA,EAAAC,CAAA,QAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,KAAAM,CAAA,CAAAC,CAAA,CAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,gBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,KAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,OAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,CAAAM,CAAA,EAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,cAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,UAAAO,CAAA,IAAAR,CAAA,EAAAC,CAAA,IApBpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GAQA,MAAMkB,kBAAkB,GAAG,qBAAqB,CAEzC,SAASC,GAAGA,CAAA,EAAG,CACpB,IAAIC,aAAa,GAAG,CAAC,CAAC,CAEtBC,gBAAO,CAACC,KAAK,CAAC,CAAC,CACf,MAAMC,cAAc,GAAGF,gBAAO,CAACG,IAAI,CAAC,CAAC,CAErC,IAAID,cAAc,CAACE,MAAM,EAAE,CACzB,IAAI,CACF,MAAMC,IAAI,GAAGhC,EAAE,CAACiC,YAAY,CAACJ,cAAc,CAACE,MAAM,EAAE,EAAEG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,MAAMC,aAAa,GAAGC,IAAI,CAACR,KAAK,CAACI,IAAI,CAAC;MAEtCN,aAAa,GAAG,IAAAW,kBAAS,EAAC,CAAC,CAAC,EAAEX,aAAa,EAAES,aAAa,CAAC;IAC7D,CAAC,CAAC,OAAOG,KAAK,EAAE;MACdC,OAAO,CAACC,GAAG,CAACF,KAAK,CAAC;MAClBG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;IACjB;;IAEA,OAAOb,cAAc,CAACE,MAAM;EAC9B;;EAEA,MAAMY,UAAU,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC;;EAEjE,KAAK,MAAMC,GAAG,IAAIf,cAAc,EAAE;IAChC,MAAMgB,GAAG,GAAGF,UAAU,CAACG,IAAI,CAAC,CAACD,GAAG,KAAKD,GAAG,CAACG,UAAU,CAACF,GAAG,CAAC,CAAC;;IAEzD,IAAIA,GAAG,EAAE;MACPhB,cAAc,CAACgB,GAAG,CAAC,GAAGhB,cAAc,CAACgB,GAAG,CAAC,IAAI,CAAC,CAAC;;MAE/C,MAAMG,IAAI,GAAGJ,GAAG,CAACK,MAAM,CAACJ,GAAG,CAACK,MAAM,CAAC;MACnC,MAAMC,OAAO,GAAGH,IAAI,CAAC,CAAC,CAAC,CAACI,WAAW,CAAC,CAAC,GAAGJ,IAAI,CAACK,KAAK,CAAC,CAAC,CAAC;;MAErDxB,cAAc,CAACgB,GAAG,CAAC,CAACM,OAAO,CAAC,GAAGtB,cAAc,CAACe,GAAG,CAAC;MAClD,OAAOf,cAAc,CAACe,GAAG,CAAC;IAC5B;EACF;;EAEAlB,aAAa,GAAG,IAAAW,kBAAS,EAAC,CAAC,CAAC,EAAEX,aAAa,EAAEG,cAAc,CAAC;;EAE5D;EACA;EACA;EACA;EACA,MAAMyB,QAAQ,GAAGA,CAACC,KAAK,KAAK,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,CAACC,IAAI,CAAC,CAAC,KAAK,EAAE;EAC5E,MAAMC,SAAS,GAAGH,QAAQ,CAAC5B,aAAa,CAAC+B,SAAS,CAAC,GAAG/B,aAAa,CAAC+B,SAAS,GAAGhB,OAAO,CAACiB,GAAG,CAACC,UAAU;;EAEtG,IAAI,CAACL,QAAQ,CAACG,SAAS,CAAC,IAAIA,SAAS,KAAKjC,kBAAkB,EAAE;IAC5De,OAAO,CAACD,KAAK;MACX;IACF,CAAC;IACDG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;EACjB;;EAEAhB,aAAa,CAAC+B,SAAS,GAAGA,SAAS;;EAEnC,MAAM,EAAEG,GAAG,CAAC,CAAC,GAAG,IAAAC,kBAAU,EAACnC,aAAa,CAAC;;EAEzC,IAAIG,cAAc,CAACiC,QAAQ,EAAE;IAC3B,IAAIC,YAAY,GAAGlC,cAAc,CAACkC,YAAY;;IAE9C,IAAI,CAACA,YAAY,EAAE;MACjB,IAAI;QACF,MAAMC,eAAe,GAAGnE,OAAO,CAACoE,OAAO,CAAC,mCAAmC,CAAC;QAC5EF,YAAY,GAAG9D,IAAI,CAACiE,IAAI,CAACjE,IAAI,CAACkE,OAAO,CAACH,eAAe,CAAC,EAAE,OAAO,CAAC;MAClE,CAAC,CAAC,OAAO1B,KAAK,EAAE;QACdC,OAAO,CAACD,KAAK;UACX;QACF,CAAC;QACDG,OAAO,CAACC,IAAI,CAAC,CAAC,CAAC;MACjB;IACF;;IAEA,IAAIqB,YAAY,EAAE;MAChB;MACAH,GAAG,CAACQ,GAAG,CAAC,YAAY,EAAE,CAACC,GAAG,EAAEC,GAAG,KAAK;QAClCA,GAAG,CAACpD,GAAG,CAAC;UACN,cAAc,EAAE;QAClB,CAAC,CAAC;QACFoD,GAAG,CAACC,IAAI,CAAC;AACjB;AACA;AACA;AACA,CAAC,CAAC;MACI,CAAC,CAAC;;MAEFX,GAAG,CAACQ,GAAG,CAACtE,OAAO,CAAC0E,MAAM,CAACT,YAAY,CAAC,CAAC;;MAErCH,GAAG,CAAC3C,GAAG,CAAC,GAAG,EAAE,UAAUoD,GAAG,EAAEC,GAAG,EAAEG,IAAI,EAAE;QACrC;QACA,IAAIJ,GAAG,CAACK,OAAO,CAAC,MAAM,CAAC,EAAE;UACvB,OAAOJ,GAAG,CAACK,QAAQ,CAAC1E,IAAI,CAACiE,IAAI,CAACH,YAAY,EAAE,YAAY,CAAC,CAAC;QAC5D;QACAU,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ;EACF;AACF;;AAEA,IAAIhC,OAAO,CAACiB,GAAG,CAAC,YAAY,CAAC,EAAE;EAC7BjC,GAAG,CAAC,CAAC;AACP","ignoreList":[]}
+{"version":3,"file":"index.js","names":["program","mergeDeep","initServer"],"sources":["../src/index.js"],"sourcesContent":["/*\n * Copyright 2021 WPPConnect Team\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport './security';\nimport { initServer } from '@wppconnect/server';\nimport * as express from 'express';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport mergeDeep from 'merge-deep';\nimport { program } from './program';\n\nconst DEFAULT_SECRET_KEY = 'THISISMYSECURETOKEN';\n\nexport function run() {\n  let serverOptions = {};\n\n  program.parse();\n  const commandOptions = program.opts();\n\n  if (commandOptions.config) {\n    try {\n      const json = fs.readFileSync(commandOptions.config, { encoding: 'utf8' });\n      const configOptions = JSON.parse(json);\n\n      serverOptions = mergeDeep({}, serverOptions, configOptions);\n    } catch (error) {\n      console.log(error);\n      process.exit(1);\n    }\n\n    delete commandOptions.config;\n  }\n\n  const subOptions = ['webhook', 'archive', 'log', 'createOptions'];\n\n  for (const key in commandOptions) {\n    const opt = subOptions.find((opt) => key.startsWith(opt));\n\n    if (opt) {\n      commandOptions[opt] = commandOptions[opt] || {};\n\n      const name = key.substr(opt.length);\n      const newName = name[0].toLowerCase() + name.slice(1);\n\n      commandOptions[opt][newName] = commandOptions[key];\n      delete commandOptions[key];\n    }\n  }\n\n  serverOptions = mergeDeep({}, serverOptions, commandOptions);\n\n  // @wppconnect/server signs tokens with `secretKey` and otherwise falls back to\n  // the public default, which would let anyone mint valid tokens. An explicit\n  // empty/null value would also override that fallback (mergeDeep keeps it), so\n  // blank values count as unset and the validated secret is passed explicitly.\n  const isUsable = (value) => typeof value === 'string' && value.trim() !== '';\n  const secretKey = isUsable(serverOptions.secretKey) ? serverOptions.secretKey : process.env.SECRET_KEY;\n\n  if (!isUsable(secretKey) || secretKey === DEFAULT_SECRET_KEY) {\n    console.error(\n      'Erro: nenhuma \"secretKey\" segura foi definida. Configure --secretKey, \"secretKey\" no arquivo de configuração ou a variável SECRET_KEY (o valor padrão público não é aceito).'\n    );\n    process.exit(1);\n  }\n\n  serverOptions.secretKey = secretKey;\n\n  const { app } = initServer(serverOptions);\n\n  if (commandOptions.frontend) {\n    let frontendPath = commandOptions.frontendPath;\n\n    if (!frontendPath) {\n      try {\n        const frontendPackage = require.resolve('@wppconnect/frontend/package.json');\n        frontendPath = path.join(path.dirname(frontendPackage), 'build');\n      } catch (error) {\n        console.error(\n          'Não foi encontrado o caminho para o frontend, por favor defina com --frontend-path ou instale o pacote @wppconnect/frontend'\n        );\n        process.exit(1);\n      }\n    }\n\n    if (frontendPath) {\n      // Requisição de configuração do frontend\n      app.use('/config.js', (req, res) => {\n        res.set({\n          'Content-Type': 'application/javascript; charset=UTF-8',\n        });\n        res.send(`\n// Arquivo gerado automaticamente\nwindow.IP_SERVER = location.protocol + \"//\" + location.host + '/api/';\nwindow.IP_SOCKET_IO = ((location.protocol === 'https:') ? 'wss:' : 'ws:') + \"//\" + location.host;\n`);\n      });\n\n      app.use(express.static(frontendPath));\n\n      app.get('*', function (req, res, next) {\n        // Força a renderização do react para requisições do browser\n        if (req.accepts('html')) {\n          return res.sendfile(path.join(frontendPath, 'index.html'));\n        }\n        next();\n      });\n    }\n  }\n}\n\nif (process.env['RUN_SERVER']) {\n  run();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA;AACA;AACA;AACA;AACA;AACA;AACA,oCAAoC,CArBpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GASA,MAAM,kBAAkB,GAAG,qBAAqB,CAEzC,SAAS,GAAG,GAAG,CACpB,IAAI,aAAa,GAAG,CAAC,CAAC,CAEtBA,SAAA,OAAO,CAAC,KAAK,CAAC,CAAC,CACf,MAAM,cAAc,GAAGA,SAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAErC,IAAI,cAAc,CAAC,MAAM,EAAE,CACzB,IAAI,CACF,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;MAEtC,aAAa,GAAG,IAAAC,kBAAS,EAAC,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC;IAC7D,CAAC,CAAC,OAAO,KAAK,EAAE;MACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;MAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjB;;IAEA,OAAO,cAAc,CAAC,MAAM;EAC9B;;EAEA,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC;;EAEjE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE;IAChC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;;IAEzD,IAAI,GAAG,EAAE;MACP,cAAc,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;MAE/C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;MACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;;MAErD,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC;MAClD,OAAO,cAAc,CAAC,GAAG,CAAC;IAC5B;EACF;;EAEA,aAAa,GAAG,IAAAA,kBAAS,EAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC;;EAE5D;EACA;EACA;EACA;EACA,MAAM,QAAQ,GAAG,CAAC,KAAK,KAAK,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE;EAC5E,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU;;EAEtG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,kBAAkB,EAAE;IAC5D,OAAO,CAAC,KAAK;MACX;IACF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;EACjB;;EAEA,aAAa,CAAC,SAAS,GAAG,SAAS;;EAEnC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,IAAAC,QAAA,UAAU,EAAC,aAAa,CAAC;;EAEzC,IAAI,cAAc,CAAC,QAAQ,EAAE;IAC3B,IAAI,YAAY,GAAG,cAAc,CAAC,YAAY;;IAE9C,IAAI,CAAC,YAAY,EAAE;MACjB,IAAI;QACF,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,mCAAmC,CAAC;QAC5E,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;MAClE,CAAC,CAAC,OAAO,KAAK,EAAE;QACd,OAAO,CAAC,KAAK;UACX;QACF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;MACjB;IACF;;IAEA,IAAI,YAAY,EAAE;MAChB;MACA,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK;QAClC,GAAG,CAAC,GAAG,CAAC;UACN,cAAc,EAAE;QAClB,CAAC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;AACjB;AACA;AACA;AACA,CAAC,CAAC;MACI,CAAC,CAAC;;MAEF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;;MAErC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE;QACrC;QACA,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;UACvB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC5D;QACA,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ;EACF;AACF;;AAEA,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;EAC7B,GAAG,CAAC,CAAC;AACP","ignoreList":[]}

package/dist/program.js

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", { value: true });exports.program = void 0;
+"use strict";var _interopRequireWildcard = require("@babel/runtime/helpers/interopRequireWildcard").default;Object.defineProperty(exports, "__esModule", { value: true });exports.program = void 0;
 
 
 
@@ -14,7 +14,7 @@
 
 
 var packageJSON = _interopRequireWildcard(require("../package.json"));
-var _commander = require("commander");function _interopRequireWildcard(e, t) {if ("function" == typeof WeakMap) var r = new WeakMap(),n = new WeakMap();return (_interopRequireWildcard = function (e, t) {if (!t && e && e.__esModule) return e;var o,i,f = { __proto__: null, default: e };if (null === e || "object" != typeof e && "function" != typeof e) return f;if (o = t ? n : r) {if (o.has(e)) return o.get(e);o.set(e, f);}for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]);return f;})(e, t);} /*
+var _commander = require("commander"); /*
  * Copyright 2021 WPPConnect Team
  *
  * Licensed under the Apache License, Version 2.0 (the "License");

package/dist/program.js.map

@@ -1 +1 @@
-{"version":3,"file":"program.js","names":["packageJSON","_interopRequireWildcard","require","_commander","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","program","exports","Command","version","option"],"sources":["../src/program.js"],"sourcesContent":["/*\n * Copyright 2021 WPPConnect Team\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport * as packageJSON from '../package.json';\nimport { Command } from 'commander';\nexport const program = new Command();\n\nprogram.version(packageJSON.version);\n\n//#region frontend\nprogram.option('--frontend', 'Habilita o frontend');\nprogram.option('--frontend-path <path>', 'Caminho dos arquivos de frontend (pasta dist)');\n//#endregion\n\n//#region comum\nprogram.option('-c, --config <path>', 'Arquivo JSON de configuração para inicialização');\n\n// Host\nprogram.option('-h, --host <host>', 'Host de execução');\nprogram.option('-p, --port <numero>', 'Porta de execução');\nprogram.option('-k, --secretKey <chave>', 'Chave secreta para validação de tokens');\nprogram.option('--startAllSession', 'Habilita a auto inicialização das sessões');\nprogram.option('--no-startAllSession', 'Desabilita a auto inicialização das sessões');\n//#endregion\n\n//#region webhook\nprogram.option('--webhook-url <url>', 'URL para as chamadas de webhook');\nprogram.option('--webhook-autoDownload', 'Habilita o auto download de arquivo');\nprogram.option('--no-webhook-autoDownload', 'Desabilita o auto download de arquivo');\nprogram.option('--webhook-readMessage', 'Habilita a marcação automática de lido');\nprogram.option('--no-webhook-readMessage', 'Desabilita a marcação automática de lido');\nprogram.option('--webhook-allUnreadOnStart', 'Envia no webhook todas as mensagens não lidas na inicialização');\nprogram.option('--no-webhook-listenAcks', 'Desabilita o envio de ACKs no webhook');\nprogram.option('--no-webhook-onPresenceChanged', 'Desabilita o envio do onPresenceChanged no webhook');\nprogram.option('--no-webhook-onParticipantsChanged', 'Desabilita o envio do onParticipantsChanged no webhook');\n//#endregion\n\n//#region archive\nprogram.option('--archive-enable', 'Habilita o auto-arquivamento');\nprogram.option('--no-archive-enable', 'Desabilita o auto-arquivamento');\nprogram.option('--archive-waitTime <milisegundos>', 'Tempo de espera de arquivamento entre chats');\nprogram.option('--archive-daysToArchive <dias>', 'Dias de inatividade para arquivar');\n//#endregion\n\n//#region log\nprogram.option('--log-level <level>', 'Nível de detalhe de log');\nprogram.option('--log-logger <saidas...>', 'Opções de saída de LOG');\n//#endregion\n\n//#region createOptions\nprogram.option('--createOptions-browserArgs <opcoes...>', 'Opções para serem passadas na inicialização do browser');\n//#endregion\n"],"mappings":";;;;;;;;;;;;;;;AAeA,IAAAA,WAAA,GAAAC,uBAAA,CAAAC,OAAA;AACA,IAAAC,UAAA,GAAAD,OAAA,cAAoC,SAAAD,wBAAAG,CAAA,EAAAC,CAAA,4BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,GAAAE,CAAA,OAAAF,OAAA,WAAAL,uBAAA,YAAAA,CAAAG,CAAA,EAAAC,CAAA,QAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,KAAAM,CAAA,CAAAC,CAAA,CAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,gBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,KAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,OAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,CAAAM,CAAA,EAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,cAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,UAAAO,CAAA,IAAAR,CAAA,EAAAC,CAAA,IAhBpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GAGO,MAAMkB,OAAO,GAAAC,OAAA,CAAAD,OAAA,GAAG,IAAIE,kBAAO,CAAC,CAAC,CAEpCF,OAAO,CAACG,OAAO,CAAC1B,WAAW,CAAC0B,OAAO,CAAC,CAAC,CAErC;AACAH,OAAO,CAACI,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,CACnDJ,OAAO,CAACI,MAAM,CAAC,wBAAwB,EAAE,+CAA+C,CAAC,CAAC,CAC1F;AAEA;AACAJ,OAAO,CAACI,MAAM,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,CAAC,CAEzF;AACAJ,OAAO,CAACI,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CACvDJ,OAAO,CAACI,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAC1DJ,OAAO,CAACI,MAAM,CAAC,yBAAyB,EAAE,wCAAwC,CAAC,CACnFJ,OAAO,CAACI,MAAM,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAChFJ,OAAO,CAACI,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,CAAC;AACrF;;AAEA;AACAJ,OAAO,CAACI,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;AACxEJ,OAAO,CAACI,MAAM,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;AAC/EJ,OAAO,CAACI,MAAM,CAAC,2BAA2B,EAAE,uCAAuC,CAAC;AACpFJ,OAAO,CAACI,MAAM,CAAC,uBAAuB,EAAE,wCAAwC,CAAC;AACjFJ,OAAO,CAACI,MAAM,CAAC,0BAA0B,EAAE,0CAA0C,CAAC;AACtFJ,OAAO,CAACI,MAAM,CAAC,4BAA4B,EAAE,gEAAgE,CAAC;AAC9GJ,OAAO,CAACI,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;AAClFJ,OAAO,CAACI,MAAM,CAAC,gCAAgC,EAAE,oDAAoD,CAAC;AACtGJ,OAAO,CAACI,MAAM,CAAC,oCAAoC,EAAE,wDAAwD,CAAC;AAC9G;;AAEA;AACAJ,OAAO,CAACI,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;AAClEJ,OAAO,CAACI,MAAM,CAAC,qBAAqB,EAAE,gCAAgC,CAAC;AACvEJ,OAAO,CAACI,MAAM,CAAC,mCAAmC,EAAE,6CAA6C,CAAC;AAClGJ,OAAO,CAACI,MAAM,CAAC,gCAAgC,EAAE,mCAAmC,CAAC;AACrF;;AAEA;AACAJ,OAAO,CAACI,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;AAChEJ,OAAO,CAACI,MAAM,CAAC,0BAA0B,EAAE,wBAAwB,CAAC;AACpE;;AAEA;AACAJ,OAAO,CAACI,MAAM,CAAC,yCAAyC,EAAE,wDAAwD,CAAC;AACnH","ignoreList":[]}
+{"version":3,"file":"program.js","names":["Command"],"sources":["../src/program.js"],"sourcesContent":["/*\n * Copyright 2021 WPPConnect Team\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport * as packageJSON from '../package.json';\nimport { Command } from 'commander';\nexport const program = new Command();\n\nprogram.version(packageJSON.version);\n\n//#region frontend\nprogram.option('--frontend', 'Habilita o frontend');\nprogram.option('--frontend-path <path>', 'Caminho dos arquivos de frontend (pasta dist)');\n//#endregion\n\n//#region comum\nprogram.option('-c, --config <path>', 'Arquivo JSON de configuração para inicialização');\n\n// Host\nprogram.option('-h, --host <host>', 'Host de execução');\nprogram.option('-p, --port <numero>', 'Porta de execução');\nprogram.option('-k, --secretKey <chave>', 'Chave secreta para validação de tokens');\nprogram.option('--startAllSession', 'Habilita a auto inicialização das sessões');\nprogram.option('--no-startAllSession', 'Desabilita a auto inicialização das sessões');\n//#endregion\n\n//#region webhook\nprogram.option('--webhook-url <url>', 'URL para as chamadas de webhook');\nprogram.option('--webhook-autoDownload', 'Habilita o auto download de arquivo');\nprogram.option('--no-webhook-autoDownload', 'Desabilita o auto download de arquivo');\nprogram.option('--webhook-readMessage', 'Habilita a marcação automática de lido');\nprogram.option('--no-webhook-readMessage', 'Desabilita a marcação automática de lido');\nprogram.option('--webhook-allUnreadOnStart', 'Envia no webhook todas as mensagens não lidas na inicialização');\nprogram.option('--no-webhook-listenAcks', 'Desabilita o envio de ACKs no webhook');\nprogram.option('--no-webhook-onPresenceChanged', 'Desabilita o envio do onPresenceChanged no webhook');\nprogram.option('--no-webhook-onParticipantsChanged', 'Desabilita o envio do onParticipantsChanged no webhook');\n//#endregion\n\n//#region archive\nprogram.option('--archive-enable', 'Habilita o auto-arquivamento');\nprogram.option('--no-archive-enable', 'Desabilita o auto-arquivamento');\nprogram.option('--archive-waitTime <milisegundos>', 'Tempo de espera de arquivamento entre chats');\nprogram.option('--archive-daysToArchive <dias>', 'Dias de inatividade para arquivar');\n//#endregion\n\n//#region log\nprogram.option('--log-level <level>', 'Nível de detalhe de log');\nprogram.option('--log-logger <saidas...>', 'Opções de saída de LOG');\n//#endregion\n\n//#region createOptions\nprogram.option('--createOptions-browserArgs <opcoes...>', 'Opções para serem passadas na inicialização do browser');\n//#endregion\n"],"mappings":";;;;;;;;;;;;;;;AAeA;AACA,sCAAoC,CAhBpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GAGO,MAAM,OAAO,qBAAG,IAAIA,WAAA,OAAO,CAAC,CAAC,CAEpC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAErC;AACA,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,CACnD,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,+CAA+C,CAAC,CAAC,CAC1F;AAEA;AACA,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,CAAC,CAEzF;AACA,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CACvD,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAC1D,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,wCAAwC,CAAC,CACnF,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAChF,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,CAAC;AACrF;;AAEA;AACA,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;AACxE,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;AAC/E,OAAO,CAAC,MAAM,CAAC,2BAA2B,EAAE,uCAAuC,CAAC;AACpF,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,wCAAwC,CAAC;AACjF,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,0CAA0C,CAAC;AACtF,OAAO,CAAC,MAAM,CAAC,4BAA4B,EAAE,gEAAgE,CAAC;AAC9G,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;AAClF,OAAO,CAAC,MAAM,CAAC,gCAAgC,EAAE,oDAAoD,CAAC;AACtG,OAAO,CAAC,MAAM,CAAC,oCAAoC,EAAE,wDAAwD,CAAC;AAC9G;;AAEA;AACA,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;AAClE,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gCAAgC,CAAC;AACvE,OAAO,CAAC,MAAM,CAAC,mCAAmC,EAAE,6CAA6C,CAAC;AAClG,OAAO,CAAC,MAAM,CAAC,gCAAgC,EAAE,mCAAmC,CAAC;AACrF;;AAEA;AACA,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;AAChE,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,wBAAwB,CAAC;AACpE;;AAEA;AACA,OAAO,CAAC,MAAM,CAAC,yCAAyC,EAAE,wDAAwD,CAAC;AACnH","ignoreList":[]}

package/dist/security.js

@@ -0,0 +1,48 @@
+"use strict"; /*
+ * Copyright 2026 WPPConnect Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Keep the browser option merger protected in registry installations too.
+// Package-manager overrides apply to the repository root, not its consumers.
+const fs = require('node:fs');
+const path = require('node:path');
+const { createRequire, registerHooks } = require('node:module');
+const { pathToFileURL } = require('node:url');
+
+if (typeof registerHooks !== 'function') {
+  throw new Error('WPPConnect CLI requires Node 22.18 or a supported newer version.');
+}
+
+const patched = pathToFileURL(path.resolve(__dirname, '../vendor/deepmerge/index.cjs')).href;
+const affected = new Set(['4.2.0', '4.2.1', '4.2.2', '4.3.0', '4.3.1']);
+const versions = new Map();
+const browserConsumer = /\/node_modules\/puppeteer-extra(?:-plugin(?:-[^/]+)?)?\//;
+
+registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (specifier !== 'deepmerge' || !context.parentURL || !browserConsumer.test(context.parentURL)) {
+      return nextResolve(specifier, context);
+    }
+    const metadata = createRequire(context.parentURL).resolve('deepmerge/package.json');
+    if (!versions.has(metadata)) {
+      const manifest = JSON.parse(fs.readFileSync(metadata, 'utf8'));
+      versions.set(metadata, manifest.name === 'deepmerge' && affected.has(manifest.version));
+    }
+    if (versions.get(metadata)) {
+      return { url: patched, shortCircuit: true };
+    }
+    return nextResolve(specifier, context);
+  }
+});
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","names":[],"sources":["../src/security.js"],"sourcesContent":["/*\n * Copyright 2026 WPPConnect Team\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n// Keep the browser option merger protected in registry installations too.\n// Package-manager overrides apply to the repository root, not its consumers.\nconst fs = require('node:fs');\nconst path = require('node:path');\nconst { createRequire, registerHooks } = require('node:module');\nconst { pathToFileURL } = require('node:url');\n\nif (typeof registerHooks !== 'function') {\n  throw new Error('WPPConnect CLI requires Node 22.18 or a supported newer version.');\n}\n\nconst patched = pathToFileURL(path.resolve(__dirname, '../vendor/deepmerge/index.cjs')).href;\nconst affected = new Set(['4.2.0', '4.2.1', '4.2.2', '4.3.0', '4.3.1']);\nconst versions = new Map();\nconst browserConsumer = /\\/node_modules\\/puppeteer-extra(?:-plugin(?:-[^/]+)?)?\\//;\n\nregisterHooks({\n  resolve(specifier, context, nextResolve) {\n    if (specifier !== 'deepmerge' || !context.parentURL || !browserConsumer.test(context.parentURL)) {\n      return nextResolve(specifier, context);\n    }\n    const metadata = createRequire(context.parentURL).resolve('deepmerge/package.json');\n    if (!versions.has(metadata)) {\n      const manifest = JSON.parse(fs.readFileSync(metadata, 'utf8'));\n      versions.set(metadata, manifest.name === 'deepmerge' && affected.has(manifest.version));\n    }\n    if (versions.get(metadata)) {\n      return { url: patched, shortCircuit: true };\n    }\n    return nextResolve(specifier, context);\n  },\n});\n"],"mappings":"cAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;AAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;AACjC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;AAC/D,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;;AAE7C,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE;EACvC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC;AACrF;;AAEA,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC,CAAC,IAAI;AAC5F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC;AAC1B,MAAM,eAAe,GAAG,0DAA0D;;AAElF,aAAa,CAAC;EACZ,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE;IACvC,IAAI,SAAS,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;MAC/F,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC;IACxC;IACA,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACnF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;MAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;MAC9D,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzF;IACA,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;MAC1B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAC7C;IACA,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC;EACxC;AACF,CAAC,CAAC","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wppconnect/server-cli",
-  "version": "1.3.56",
+  "version": "1.3.57",
   "description": "Servidor de WPPConnect com frontend para ser executado a partir de uma linha de comando",
   "repository": {
     "type": "git",
@@ -25,7 +25,8 @@
     "release": "release-it",
     "start": "cross-env RUN_SERVER=1 babel-node src",
     "watch": "nodemon -w src --exec \"babel-node src\"",
-    "test": "node --require @babel/register --test --test-force-exit \"test/**/*.test.js\""
+    "test": "node --require @babel/register --test --test-force-exit \"test/**/*.test.js\"",
+    "test:packed-security": "node test/packed-runtime-security.cjs"
   },
   "config": {
     "commitizen": {
@@ -33,7 +34,7 @@
     }
   },
   "dependencies": {
-    "@babel/runtime": "^7.29.10",
+    "@babel/runtime": "^8.0.8",
     "@wppconnect/server": "2.10.68",
     "commander": "^14.0.3",
     "merge-deep": "^3.0.3",
@@ -41,13 +42,11 @@
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.1156.0",
-    "@babel/cli": "^7.29.7",
-    "@babel/core": "^7.29.7",
-    "@babel/eslint-parser": "^7.29.9",
-    "@babel/eslint-plugin": "^7.29.7",
-    "@babel/node": "^7.29.7",
-    "@babel/plugin-transform-runtime": "^7.29.7",
-    "@babel/preset-env": "^7.29.7",
+    "@babel/cli": "^8.0.6",
+    "@babel/core": "^8.0.9",
+    "@babel/node": "^8.0.6",
+    "@babel/plugin-transform-runtime": "^8.0.6",
+    "@babel/preset-env": "^8.0.7",
     "@commitlint/cli": "^20.5.3",
     "@commitlint/config-conventional": "^20.5.3",
     "@commitlint/cz-commitlint": "^20.5.3",
@@ -83,32 +82,39 @@
     "@commitlint/**/ajv": "8.18.0",
     "commitizen/**/ajv": "8.18.0",
     "eslint/**/ajv": "6.15.0",
-    "basic-ftp": "5.3.1",
+    "basic-ftp": "6.2.1",
     "fast-xml-parser": "5.11.2",
     "flatted": "3.4.4",
     "handlebars": "4.7.10",
     "@wppconnect/server/**/body-parser": "1.20.9",
-    "@wppconnect/server/**/brace-expansion": "1.1.21",
     "@wppconnect/server/**/engine.io": "6.6.11",
     "@wppconnect/server/**/form-data": "4.0.6",
     "@wppconnect/server/**/multer": "2.5.0",
-    "@wppconnect/server/**/path-to-regexp": "0.2.5",
     "@wppconnect/server/**/qs": "6.16.1",
     "@wppconnect/server/**/tmp": "0.2.7",
-    "@wppconnect/server/**/ws": "8.21.3",
+    "@wppconnect/server/**/ws": "8.22.0",
     "**/package-json/got": "11.8.6",
     "**/sharp": "0.35.5",
-    "@wppconnect-team/wppconnect/**/ws": "8.21.3",
+    "@wppconnect-team/wppconnect/**/ws": "8.22.0",
     "@types/minimatch/**/minimatch": "10.2.5",
-    "archiver-utils/**/minimatch": "9.0.7",
-    "nodemon/**/brace-expansion": "5.0.9",
+    "**/archiver-utils/**/minimatch": "9.0.9",
     "nodemon/**/minimatch": "10.2.5",
     "pretty-quick/**/picomatch": "3.0.2",
     "readdir-glob/**/minimatch": "5.1.9",
-    "rimraf/**/minimatch": "9.0.7",
+    "**/rimraf/**/minimatch": "9.0.9",
+    "**/nodemon/**/brace-expansion": "5.0.12",
+    "**/readdir-glob/**/brace-expansion": "2.1.7",
+    "puppeteer": "25.13.0",
+    "http-cache-semantics": "4.3.0",
+    "browserslist": "4.28.9",
+    "baseline-browser-mapping": "2.11.34",
     "**/lodash": "4.18.1",
     "tar": "7.5.22",
-    "tmp": "0.2.7"
+    "tmp": "0.2.7",
+    "deepmerge": "file:vendor/deepmerge-4.3.2+wppconnect.1.tgz"
   },
-  "packageManager": "yarn@1.22.22"
+  "packageManager": "yarn@1.22.22",
+  "engines": {
+    "node": "^22.18.0 || >=24.11.0"
+  }
 }

package/test/auth.test.js

@@ -17,7 +17,11 @@ const bcrypt = require(require.resolve('bcrypt', {
 const DEFAULT_SECRET = 'THISISMYSECURETOKEN';
 const SESSION = 'regression';
 const ROOT = path.resolve(__dirname, '..');
-const BABEL_NODE = path.join(ROOT, 'node_modules', '.bin', 'babel-node');
+const COMPILED = process.env.WPP_CLI_TEST_COMPILED === '1';
+const babelManifest = require.resolve('@babel/node/package.json');
+const CLI_ENTRY = COMPILED
+  ? path.join(ROOT, 'bin', 'wppserver.js')
+  : path.resolve(path.dirname(babelManifest), require(babelManifest).bin['babel-node']);
 
 const children = new Set();
 const tmpDirs = new Set();
@@ -50,15 +54,19 @@ async function startCli(args = [], env = {}, config) {
     fs.writeFileSync(file, JSON.stringify(config));
     args = [...args, '--config', file];
   }
-  const childEnv = { ...process.env, RUN_SERVER: '1', PORT: String(port), ...env };
+  const childEnv = { ...process.env, RUN_SERVER: COMPILED ? '' : '1', PORT: String(port), ...env };
   for (const key of Object.keys(childEnv)) {
     if (childEnv[key] === undefined) delete childEnv[key];
   }
 
-  const child = spawn(BABEL_NODE, ['src', '--port', String(port), '--no-startAllSession', ...args], {
-    cwd: ROOT,
-    env: childEnv,
-  });
+  const child = spawn(
+    process.execPath,
+    [CLI_ENTRY, ...(COMPILED ? [] : ['src']), '--port', String(port), '--no-startAllSession', ...args],
+    {
+      cwd: ROOT,
+      env: childEnv,
+    }
+  );
   children.add(child);
 
   let output = '';

package/test/deepmerge-security.test.js

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2026 WPPConnect Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const assert = require('node:assert/strict');
+const { createRequire } = require('node:module');
+const { test } = require('node:test');
+const owner = createRequire(require.resolve('puppeteer-extra'));
+const merge = owner('deepmerge');
+
+const malicious = () => JSON.parse('{"__proto__":{"isAdmin":true}}');
+function assertSafe(value) {
+  assert.equal(Object.getPrototypeOf(value), Object.prototype);
+  assert.equal(value.isAdmin, undefined);
+  assert.equal(Object.hasOwn(value, '__proto__'), false);
+  assert.equal({}.isAdmin, undefined);
+}
+
+test('browser options cannot inherit attacker values from a null-prototype target', () => {
+  const target = Object.assign(Object.create(null), { debug: false });
+  const result = merge(target, malicious());
+  assertSafe(result);
+  assert.equal(result.debug, false);
+});
+test('browser options cannot inherit attacker values through a null placeholder', () => {
+  const input = { session: malicious() };
+  assertSafe(merge({ session: null }, input).session);
+});
+test('browser options reject a proto key already present in the defaults', () => {
+  const result = merge(malicious(), { debug: false });
+  assertSafe(result);
+  assert.equal(result.debug, false);
+});
+test('browser options cannot inherit attacker values through a primitive placeholder', () => {
+  assertSafe(merge({ session: 1 }, { session: malicious() }).session);
+});
+test('cloned browser option arrays retain safe element prototypes', () => {
+  const result = merge({ list: [] }, { list: [malicious()] });
+  assertSafe(result.list[0]);
+});
+test('browser option merging retains arrays, symbols, custom merging and source objects', () => {
+  const key = Symbol('option');
+  const first = { args: ['--one'], nested: { a: 1 }, [key]: 1 };
+  const second = { args: ['--two'], nested: { b: 2 } };
+  assert.deepEqual(merge.all([first, second]).args, ['--one', '--two']);
+  assert.deepEqual(first.args, ['--one']);
+  assert.equal(merge(first, second)[key], 1);
+  assert.deepEqual(merge(first, second, { arrayMerge: (_a, b) => b }).args, ['--two']);
+  assert.deepEqual(
+    merge(first, second, { customMerge: (name) => (name === 'nested' ? (a, b) => ({ a: a.a + b.b }) : undefined) })
+      .nested,
+    { a: 3 }
+  );
+});
+
+const fs = require('node:fs');
+const path = require('node:path');
+test('installed browser merger matches the reviewed private runtime files', () => {
+  const installed = path.dirname(owner.resolve('deepmerge'));
+  for (const file of ['index.cjs', 'is-mergeable-object.cjs']) {
+    const actual = fs.readFileSync(path.join(installed, file), 'utf8').replace(/\r\n/g, '\n');
+    const expected = fs.readFileSync(path.join(__dirname, '../vendor/deepmerge', file), 'utf8').replace(/\r\n/g, '\n');
+    assert.equal(actual, expected);
+  }
+});

package/test/dependency-globs.test.js

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2026 WPPConnect Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const assert = require('node:assert/strict');
+const { execFileSync } = require('node:child_process');
+const fs = require('node:fs');
+const { createRequire } = require('node:module');
+const os = require('node:os');
+const path = require('node:path');
+const { test } = require('node:test');
+
+test('rimraf ESM executable loads brace expansion and removes its target', () => {
+  const owner = createRequire(require.resolve('rimraf'));
+  const globOwner = createRequire(owner.resolve('glob'));
+  assert.equal(globOwner('minimatch/package.json').version, '9.0.9');
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-rimraf-'));
+  try {
+    const target = path.join(directory, 'output');
+    fs.mkdirSync(target);
+    fs.writeFileSync(path.join(target, 'fixture.txt'), 'fixture');
+    const manifest = require.resolve('rimraf/package.json');
+    const executable = path.resolve(path.dirname(manifest), require(manifest).bin);
+    execFileSync(process.execPath, [executable, target], { encoding: 'utf8' });
+    assert.equal(fs.existsSync(target), false);
+    assert.equal(fs.existsSync(directory), true);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('archiver glob expands braces and exclusions through its own minimatch', () => {
+  const owner = createRequire(require.resolve('archiver-utils'));
+  const globOwner = createRequire(owner.resolve('glob'));
+  assert.equal(globOwner('minimatch/package.json').version, '9.0.9');
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-glob-'));
+  try {
+    for (const name of ['first.txt', 'second.txt', 'ignored.txt']) {
+      fs.writeFileSync(path.join(directory, name), 'fixture');
+    }
+    const glob = require('archiver-utils/file').expand;
+    assert.deepEqual(glob({ cwd: directory }, ['{first,second,ignored}.txt', '!ignored.txt']).sort(), [
+      'first.txt',
+      'second.txt',
+    ]);
+  } finally {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+test('legacy glob retains its callable minimatch and brace expansion APIs', () => {
+  const owner = createRequire(require.resolve('glob'));
+  const minimatch = owner('minimatch');
+  assert.equal(minimatch('first.txt', '{first,second}.txt'), true);
+  assert.equal(minimatch('third.txt', '{first,second}.txt'), false);
+});
+
+test('nodemon retains its named minimatch API for watched file patterns', () => {
+  const owner = createRequire(require.resolve('nodemon'));
+  const { minimatch } = owner('minimatch');
+  assert.equal(minimatch('src/index.js', 'src/{index,config}.js'), true);
+  assert.equal(minimatch('src/ignored.js', 'src/{index,config}.js'), false);
+});

package/test/helpers/assert-packed-merger.cjs

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2026 WPPConnect Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { createRequire } = require('node:module');
+
+delete process.env.RUN_SERVER;
+const root = path.resolve(process.argv[2]);
+const project = createRequire(path.join(root, 'package.json'));
+project(root);
+const server = createRequire(project.resolve('@wppconnect/server'));
+const core = createRequire(server.resolve('@wppconnect-team/wppconnect'));
+const extra = createRequire(core.resolve('puppeteer-extra'));
+const merge = extra('deepmerge');
+const privateRuntime = path.join(root, 'vendor', 'deepmerge', 'index.cjs');
+assert.equal(merge, project(privateRuntime));
+const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');
+for (const result of [
+  merge(Object.create(null), payload),
+  merge({ session: null }, { session: payload }).session,
+  merge(payload, {}),
+]) {
+  assert.equal(Object.getPrototypeOf(result), Object.prototype);
+  assert.equal(result.isAdmin, undefined);
+}
+assert.deepEqual(merge.all([{ args: ['a'] }, { args: ['b'] }]), { args: ['a', 'b'] });
+assert.equal({}.isAdmin, undefined);
+console.log(
+  JSON.stringify({
+    publicEntryLoaded: true,
+    privateRuntime,
+    dependencyMetadataVersion: extra('deepmerge/package.json').version,
+    prototypeCasesPassed: 3,
+  })
+);

package/test/packed-runtime-security.cjs

@@ -0,0 +1,75 @@
+/*
+ * Copyright 2026 WPPConnect Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Run with npm run test:packed-security so npm_execpath is the native npm CLI.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const root = path.resolve(__dirname, '..');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'wpp-cli-package-security-'));
+const npm = process.env.npm_execpath;
+assert(npm && /npm-cli\.js$/.test(npm), 'Run this check using npm run test:packed-security');
+const env = { ...process.env, PUPPETEER_SKIP_DOWNLOAD: 'true', RUN_SERVER: '' };
+function run(args, cwd) {
+  const result = spawnSync(process.execPath, args, {
+    cwd,
+    env,
+    encoding: 'utf8',
+    timeout: 300000,
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  assert.equal(result.status, 0, result.stdout + result.stderr + (result.error?.message || ''));
+  return result.stdout;
+}
+try {
+  const packed = JSON.parse(run([npm, 'pack', '--ignore-scripts', '--json', '--pack-destination', scratch], root))[0];
+  const files = new Set(packed.files.map((file) => file.path));
+  for (const file of [
+    'dist/security.js',
+    'vendor/deepmerge/index.cjs',
+    'vendor/deepmerge/is-mergeable-object.cjs',
+    'vendor/deepmerge/LICENSE',
+  ]) {
+    assert(files.has(file), `Runtime security file missing from packed CLI: ${file}`);
+  }
+  const artifact = path.join(scratch, packed.filename);
+  const helper = path.join(__dirname, 'helpers', 'assert-packed-merger.cjs');
+  for (const mode of ['local', 'global']) {
+    const prefix = path.join(scratch, mode);
+    fs.mkdirSync(prefix);
+    fs.writeFileSync(
+      path.join(prefix, 'package.json'),
+      JSON.stringify({ name: 'wpp-cli-security-consumer', version: '0.0.0', private: true })
+    );
+    const install = [npm, 'install', '--ignore-scripts', '--no-audit', '--no-fund'];
+    if (mode === 'global') install.push('--global', '--prefix', prefix);
+    install.push(artifact);
+    run(install, prefix);
+    const installed = path.join(
+      prefix,
+      process.platform === 'win32' || mode === 'local' ? 'node_modules' : 'lib/node_modules',
+      '@wppconnect/server-cli'
+    );
+    process.stdout.write(run([helper, installed], prefix));
+    const help = run([path.join(installed, 'bin', 'wppserver.js'), '--help'], prefix);
+    assert.match(help, /Usage:/);
+  }
+} finally {
+  assert.equal(path.dirname(path.resolve(scratch)), path.resolve(os.tmpdir()));
+  fs.rmSync(scratch, { recursive: true, force: true });
+}

package/vendor/deepmerge/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2012 James Halliday, Josh Duff, and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/vendor/deepmerge/README.md

@@ -0,0 +1,3 @@
+# Private local security backport
+
+This package contains deepmerge4.3.1 plus the prototype-poisoning fix from upstream PR274, commit c5ad573121574db1c625b0aabcc6114ed7df6c5a. Version4.3.2+wppconnect.1 identifies this private local patch and its4.x compatibility; it is not an upstream release and is never published to a registry. The original package name is preserved for transitive dependency matching. The is-mergeable-object1.1.0 helper is included locally. Both libraries are MIT-licensed; original notices are preserved.

package/vendor/deepmerge/index.cjs

@@ -0,0 +1,113 @@
+var defaultIsMergeableObject = require('./is-mergeable-object.cjs')
+
+function emptyTarget(val) {
+	return Array.isArray(val) ? [] : {}
+}
+
+function cloneUnlessOtherwiseSpecified(value, options) {
+	return (options.clone !== false && options.isMergeableObject(value))
+		? deepmerge(emptyTarget(value), value, options)
+		: value
+}
+
+function defaultArrayMerge(target, source, options) {
+	return target.concat(source).map(function(element) {
+		return cloneUnlessOtherwiseSpecified(element, options)
+	})
+}
+
+function getMergeFunction(key, options) {
+	if (!options.customMerge) {
+		return deepmerge
+	}
+	var customMerge = options.customMerge(key)
+	return typeof customMerge === 'function' ? customMerge : deepmerge
+}
+
+function getEnumerableOwnPropertySymbols(target) {
+	return Object.getOwnPropertySymbols
+		? Object.getOwnPropertySymbols(target).filter(function(symbol) {
+			return Object.propertyIsEnumerable.call(target, symbol)
+		})
+		: []
+}
+
+function getKeys(target) {
+	return Object.keys(target).concat(getEnumerableOwnPropertySymbols(target))
+}
+
+function propertyIsOnObject(object, property) {
+	try {
+		return property in object
+	} catch(_) {
+		return false
+	}
+}
+
+function propertyIsForbidden(key) {
+	return key === '__proto__'
+}
+
+// Protects from prototype poisoning and unexpected merging up the prototype chain.
+function propertyIsUnsafe(target, key) {
+	return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
+		&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
+			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
+}
+
+function mergeObject(target, source, options) {
+	var destination = {}
+	if (options.isMergeableObject(target)) {
+		getKeys(target).forEach(function(key) {
+			if (propertyIsForbidden(key)) {
+				return
+			}
+			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options)
+		})
+	}
+	getKeys(source).forEach(function(key) {
+		if (propertyIsForbidden(key) || propertyIsUnsafe(target, key)) {
+			return
+		}
+
+		if (propertyIsOnObject(target, key) && options.isMergeableObject(source[key])) {
+			destination[key] = getMergeFunction(key, options)(target[key], source[key], options)
+		} else {
+			destination[key] = cloneUnlessOtherwiseSpecified(source[key], options)
+		}
+	})
+	return destination
+}
+
+function deepmerge(target, source, options) {
+	options = options || {}
+	options.arrayMerge = options.arrayMerge || defaultArrayMerge
+	options.isMergeableObject = options.isMergeableObject || defaultIsMergeableObject
+	// cloneUnlessOtherwiseSpecified is added to `options` so that custom arrayMerge()
+	// implementations can use it. The caller may not replace it.
+	options.cloneUnlessOtherwiseSpecified = cloneUnlessOtherwiseSpecified
+
+	var sourceIsArray = Array.isArray(source)
+	var targetIsArray = Array.isArray(target)
+	var sourceAndTargetTypesMatch = sourceIsArray === targetIsArray
+
+	if (!sourceAndTargetTypesMatch) {
+		return cloneUnlessOtherwiseSpecified(source, options)
+	} else if (sourceIsArray) {
+		return options.arrayMerge(target, source, options)
+	} else {
+		return mergeObject(target, source, options)
+	}
+}
+
+deepmerge.all = function deepmergeAll(array, options) {
+	if (!Array.isArray(array)) {
+		throw new Error('first argument should be an array')
+	}
+
+	return array.reduce(function(prev, next) {
+		return deepmerge(prev, next, options)
+	}, {})
+}
+
+module.exports = deepmerge

package/vendor/deepmerge/index.d.ts

@@ -0,0 +1,20 @@
+declare function deepmerge<T>(x: Partial<T>, y: Partial<T>, options?: deepmerge.Options): T;
+declare function deepmerge<T1, T2>(x: Partial<T1>, y: Partial<T2>, options?: deepmerge.Options): T1 & T2;
+
+declare namespace deepmerge {
+	export interface Options {
+		arrayMerge?(target: any[], source: any[], options?: ArrayMergeOptions): any[];
+		clone?: boolean;
+		customMerge?: (key: string, options?: Options) => ((x: any, y: any) => any) | undefined;
+		isMergeableObject?(value: object): boolean;
+	}
+	export interface ArrayMergeOptions {
+		isMergeableObject(value: object): boolean;
+		cloneUnlessOtherwiseSpecified(value: object, options?: Options): object;
+	}
+
+	export function all (objects: object[], options?: Options): object;
+	export function all<T> (objects: Partial<T>[], options?: Options): T;
+}
+
+export = deepmerge;

package/vendor/deepmerge/is-mergeable-object.cjs

@@ -0,0 +1,24 @@
+module.exports = function isMergeableObject(value) {
+	return isNonNullObject(value)
+		&& !isSpecial(value)
+}
+
+function isNonNullObject(value) {
+	return !!value && typeof value === 'object'
+}
+
+function isSpecial(value) {
+	var stringValue = Object.prototype.toString.call(value)
+
+	return stringValue === '[object RegExp]'
+		|| stringValue === '[object Date]'
+		|| isReactElement(value)
+}
+
+// see https://github.com/facebook/react/blob/b5ac963fb791d1298e7f396236383bc955f916c1/src/isomorphic/classic/element/ReactElement.js#L21-L25
+var canUseSymbol = typeof Symbol === 'function' && Symbol.for
+var REACT_ELEMENT_TYPE = canUseSymbol ? Symbol.for('react.element') : 0xeac7
+
+function isReactElement(value) {
+	return value.$$typeof === REACT_ELEMENT_TYPE
+}

package/vendor/deepmerge/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "deepmerge",
+  "version": "4.3.2+wppconnect.1",
+  "private": true,
+  "description": "Private unpublished WPPConnect patch of deepmerge4.3.1. This version is local, not an upstream registry release.",
+  "main": "index.cjs",
+  "types": "index.d.ts",
+  "license": "MIT",
+  "files": [
+    "index.cjs",
+    "is-mergeable-object.cjs",
+    "index.d.ts",
+    "LICENSE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=0.10.0"
+  }
+}