@wppconnect/server-cli 1.3.61 → 1.3.63

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [1.3.63](https://github.com/wppconnect-team/server-cli/compare/v1.3.62...v1.3.63) (2026-11-05)
+
+### Bug Fixes
+
+- **deps:** bump @wppconnect/server to 2.10.75 for CVE-2026-121557 ([#887](https://github.com/wppconnect-team/server-cli/issues/887)) ([d021d0c](https://github.com/wppconnect-team/server-cli/commit/d021d0c258b7fc6d92b9bc1c2e5ba35c998c9afc))
+- **deps:** keep nested legacy rimraf glob compatibility ([e3a5d55](https://github.com/wppconnect-team/server-cli/commit/e3a5d55103c7d9ccb3b74281bfa4f24ed2a460c1))
+
+## [1.3.62](https://github.com/wppconnect-team/server-cli/compare/v1.3.61...v1.3.62) (2026-11-02)
+
 ## [1.3.61](https://github.com/wppconnect-team/server-cli/compare/v1.3.60...v1.3.61) (2026-11-02)
 
 ## [1.3.60](https://github.com/wppconnect-team/server-cli/compare/v1.3.59...v1.3.60) (2026-11-01)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wppconnect/server-cli",
-  "version": "1.3.61",
+  "version": "1.3.63",
   "description": "Servidor de WPPConnect com frontend para ser executado a partir de uma linha de comando",
   "repository": {
     "type": "git",
@@ -35,13 +35,13 @@
   },
   "dependencies": {
     "@babel/runtime": "^8.0.10",
-    "@wppconnect/server": "2.10.68",
+    "@wppconnect/server": "2.10.75",
     "commander": "^14.0.3",
     "merge-deep": "^3.0.3",
     "prom-client": "^15.1.3"
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "^3.1156.0",
+    "@aws-sdk/client-s3": "^3.1161.0",
     "@babel/cli": "^8.0.6",
     "@babel/core": "^8.0.10",
     "@babel/node": "^8.0.6",
@@ -96,18 +96,20 @@
     "**/package-json/got": "11.8.6",
     "**/sharp": "0.35.5",
     "@wppconnect-team/wppconnect/**/ws": "8.22.0",
-    "@types/minimatch/**/minimatch": "10.2.5",
-    "**/archiver-utils/**/minimatch": "9.0.9",
-    "nodemon/**/minimatch": "10.2.5",
+    "@types/minimatch/**/minimatch": "11.0.4",
+    "**/archiver-utils/**/minimatch": "11.0.4",
+    "**/archiver-utils/**/glob": "14.0.2",
+    "nodemon/**/minimatch": "11.0.4",
     "pretty-quick/**/picomatch": "3.0.2",
-    "readdir-glob/**/minimatch": "5.1.9",
-    "**/rimraf/**/minimatch": "9.0.9",
+    "**/readdir-glob/**/minimatch": "11.0.4",
+    "rimraf/**/minimatch": "11.0.4",
+    "rimraf/glob": "14.0.2",
     "**/nodemon/**/brace-expansion": "5.0.12",
     "**/readdir-glob/**/brace-expansion": "2.1.7",
     "puppeteer": "25.13.0",
     "http-cache-semantics": "4.3.0",
     "browserslist": "4.28.9",
-    "baseline-browser-mapping": "2.11.34",
+    "baseline-browser-mapping": "2.11.35",
     "**/lodash": "4.18.1",
     "tar": "7.5.22",
     "tmp": "0.2.7",

package/test/dependency-globs.test.js

@@ -21,10 +21,12 @@ const os = require('node:os');
 const path = require('node:path');
 const { test } = require('node:test');
 
+const normalizePaths = (values) => values.map((value) => value.split(path.sep).join('/')).sort();
+
 test('rimraf ESM executable loads brace expansion and removes its target', () => {
   const owner = createRequire(require.resolve('rimraf'));
   const globOwner = createRequire(owner.resolve('glob'));
-  assert.equal(globOwner('minimatch/package.json').version, '9.0.9');
+  assert.equal(globOwner('minimatch/package.json').version, '11.0.4');
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-rimraf-'));
   try {
     const target = path.join(directory, 'output');
@@ -43,7 +45,7 @@ test('rimraf ESM executable loads brace expansion and removes its target', () =>
 test('archiver glob expands braces and exclusions through its own minimatch', () => {
   const owner = createRequire(require.resolve('archiver-utils'));
   const globOwner = createRequire(owner.resolve('glob'));
-  assert.equal(globOwner('minimatch/package.json').version, '9.0.9');
+  assert.equal(globOwner('minimatch/package.json').version, '11.0.4');
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-glob-'));
   try {
     for (const name of ['first.txt', 'second.txt', 'ignored.txt']) {
@@ -60,10 +62,24 @@ test('archiver glob expands braces and exclusions through its own minimatch', ()
 });
 
 test('legacy glob retains its callable minimatch and brace expansion APIs', () => {
-  const owner = createRequire(require.resolve('glob'));
+  const licenseOwner = createRequire(require.resolve('license-check-and-add/package.json'));
+  const globbyOwner = createRequire(licenseOwner.resolve('globby'));
+  const owner = createRequire(globbyOwner.resolve('glob'));
   const minimatch = owner('minimatch');
   assert.equal(minimatch('first.txt', '{first,second}.txt'), true);
   assert.equal(minimatch('third.txt', '{first,second}.txt'), false);
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-legacy-glob-'));
+  try {
+    fs.mkdirSync(path.join(directory, 'nested'));
+    fs.writeFileSync(path.join(directory, 'nested', 'fixture.txt'), 'fixture');
+    const globby = licenseOwner('globby');
+    assert.deepEqual(normalizePaths(globby.sync(['**/*.txt'], { cwd: directory })), ['nested/fixture.txt']);
+  } finally {
+    const resolved = fs.realpathSync(directory);
+    assert.equal(path.dirname(resolved), fs.realpathSync(os.tmpdir()));
+    assert.ok(path.basename(resolved).startsWith('wppcli-legacy-glob-'));
+    fs.rmSync(resolved, { recursive: true, force: true, maxRetries: 3 });
+  }
 });
 
 test('nodemon retains its named minimatch API for watched file patterns', () => {
@@ -72,3 +88,123 @@ test('nodemon retains its named minimatch API for watched file patterns', () =>
   assert.equal(minimatch('src/index.js', 'src/{index,config}.js'), true);
   assert.equal(minimatch('src/ignored.js', 'src/{index,config}.js'), false);
 });
+
+test('actual Archiver ZIP traversal keeps brace, dotfile and exclusion semantics', async () => {
+  const archiver = require('archiver');
+  const unzipper = require('unzipper');
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-archive-'));
+  try {
+    fs.mkdirSync(path.join(directory, 'nested'));
+    for (const name of ['a.txt', 'b.bin', 'ignore.txt', '.hidden.txt'])
+      fs.writeFileSync(path.join(directory, 'nested', name), 'fixture');
+    const archiveOwner = createRequire(require.resolve('archiver'));
+    const traversalOwner = createRequire(archiveOwner.resolve('readdir-glob'));
+    assert.equal(traversalOwner('minimatch/package.json').version, '11.0.4');
+    const zip = archiver('zip');
+    const chunks = [];
+    const ended = new Promise((resolve, reject) => {
+      zip.on('data', (chunk) => chunks.push(chunk));
+      zip.once('end', resolve);
+      zip.once('error', reject);
+    });
+    zip.glob('**/*.{txt,bin}', { cwd: directory, dot: true, ignore: '**/ignore.txt' });
+    await zip.finalize();
+    await ended;
+    const result = await unzipper.Open.buffer(Buffer.concat(chunks));
+    assert.deepEqual(result.files.map((file) => file.path).sort(), [
+      'nested/.hidden.txt',
+      'nested/a.txt',
+      'nested/b.bin',
+    ]);
+  } finally {
+    const resolved = fs.realpathSync(directory);
+    assert.equal(path.dirname(resolved), fs.realpathSync(os.tmpdir()));
+    assert.ok(path.basename(resolved).startsWith('wppcli-archive-'));
+    fs.rmSync(resolved, { recursive: true, force: true, maxRetries: 3 });
+  }
+});
+
+test('the actual modern matching engine bounds first-phase pattern amplification', () => {
+  const owner = createRequire(require.resolve('archiver-utils'));
+  const globOwner = createRequire(owner.resolve('glob'));
+  const modulePath = globOwner.resolve('minimatch');
+  const code = `
+    const assert = require('node:assert/strict');
+    const { Minimatch } = require(${JSON.stringify(modulePath)});
+    let peak = 0;
+    class Probe extends Minimatch {
+      firstPhasePreProcess(parts) {
+        const result = super.firstPhasePreProcess(parts);
+        peak = result.length;
+        return result;
+      }
+    }
+    new Probe(Array.from({length:12}, (_, i) => 'p'+i+'/**/../q'+i).join('/'),
+      { optimizationLevel: 2, braceExpandMax: 64 });
+    assert(peak > 1 && peak <= 64, 'pattern budget exceeded: '+peak);
+  `;
+  execFileSync(process.execPath, ['--max-old-space-size=192', '-e', code], {
+    encoding: 'utf8',
+    timeout: 3000,
+  });
+});
+
+test('modern glob owners traverse recursive wildcards with their installed matcher', () => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-owner-globs-'));
+  try {
+    fs.mkdirSync(path.join(directory, 'nested'));
+    for (const name of ['a.txt', 'b.bin', 'ignore.txt', '.hidden.txt']) {
+      fs.writeFileSync(path.join(directory, 'nested', name), 'fixture');
+    }
+    for (const name of ['archiver-utils', 'rimraf']) {
+      const owner = createRequire(require.resolve(name));
+      const glob = owner('glob');
+      assert.deepEqual(
+        normalizePaths(glob.sync('**/*.txt', { cwd: directory })),
+        ['nested/a.txt', 'nested/ignore.txt'],
+        name
+      );
+      assert.deepEqual(
+        normalizePaths(glob.sync('**/*.{txt,bin}', { cwd: directory, dot: true, ignore: '**/ignore.txt' })),
+        ['nested/.hidden.txt', 'nested/a.txt', 'nested/b.bin'],
+        name
+      );
+    }
+    assert.deepEqual(normalizePaths(require('archiver-utils/file').expand({ cwd: directory }, ['**/*.txt'])), [
+      'nested/a.txt',
+      'nested/ignore.txt',
+    ]);
+    const manifest = require.resolve('rimraf/package.json');
+    const executable = path.resolve(path.dirname(manifest), require(manifest).bin);
+    execFileSync(process.execPath, [executable, '--glob', 'nested/*.bin'], { cwd: directory, encoding: 'utf8' });
+    assert.equal(fs.existsSync(path.join(directory, 'nested', 'b.bin')), false);
+    assert.equal(fs.existsSync(path.join(directory, 'nested', 'a.txt')), true);
+  } finally {
+    const resolved = fs.realpathSync(directory);
+    assert.equal(path.dirname(resolved), fs.realpathSync(os.tmpdir()));
+    assert.ok(path.basename(resolved).startsWith('wppcli-owner-globs-'));
+    fs.rmSync(resolved, { recursive: true, force: true, maxRetries: 3 });
+  }
+});
+
+test('nested legacy rimraf preserves callback and wildcard deletion contracts', async () => {
+  const plugin = createRequire(require.resolve('puppeteer-extra-plugin-user-data-dir'));
+  const owner = createRequire(plugin.resolve('rimraf'));
+  const rimraf = plugin('rimraf');
+  assert.equal(typeof rimraf, 'function');
+  assert.equal(typeof owner('glob'), 'function');
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'wppcli-legacy-rimraf-'));
+  try {
+    fs.writeFileSync(path.join(directory, 'remove.txt'), 'fixture');
+    fs.writeFileSync(path.join(directory, 'keep.bin'), 'fixture');
+    const pattern = directory.split(path.sep).join('/') + '/*.txt';
+    await new Promise((resolve, reject) => rimraf(pattern, (error) => (error ? reject(error) : resolve())));
+    assert.equal(fs.existsSync(path.join(directory, 'remove.txt')), false);
+    assert.equal(fs.existsSync(path.join(directory, 'keep.bin')), true);
+  } finally {
+    const resolved = fs.realpathSync(directory);
+    assert.equal(path.dirname(resolved), fs.realpathSync(os.tmpdir()));
+    assert.ok(path.basename(resolved).startsWith('wppcli-legacy-rimraf-'));
+    fs.rmSync(resolved, { recursive: true, force: true, maxRetries: 3 });
+  }
+});

package/test/helpers/assert-packed-merger.cjs

@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 const assert = require('node:assert/strict');
+const fs = require('node:fs');
 const path = require('node:path');
 const { createRequire } = require('node:module');
 
@@ -25,8 +26,19 @@ const server = createRequire(project.resolve('@wppconnect/server'));
 const core = createRequire(server.resolve('@wppconnect-team/wppconnect'));
 const extra = createRequire(core.resolve('puppeteer-extra'));
 const merge = extra('deepmerge');
-const privateRuntime = path.join(root, 'vendor', 'deepmerge', 'index.cjs');
-assert.equal(merge, project(privateRuntime));
+const cliRuntime = path.join(root, 'vendor', 'deepmerge', 'index.cjs');
+let privateRuntime = cliRuntime;
+if (merge !== project(cliRuntime)) {
+  // The server also protects registry installs. Its later hook can supply its
+  // own copy, but accept it only when both reviewed runtime files are identical.
+  const serverRoot = path.dirname(project.resolve('@wppconnect/server/package.json'));
+  privateRuntime = path.join(serverRoot, 'vendor', 'deepmerge', 'index.cjs');
+  for (const file of ['index.cjs', 'is-mergeable-object.cjs']) {
+    const source = (runtime) => fs.readFileSync(path.join(path.dirname(runtime), file), 'utf8').replace(/\r\n/g, '\n');
+    assert.equal(source(privateRuntime), source(cliRuntime), `Unreviewed server merger runtime: ${file}`);
+  }
+  assert.equal(merge, server(privateRuntime));
+}
 const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');
 for (const result of [
   merge(Object.create(null), payload),
@@ -38,11 +50,14 @@ for (const result of [
 }
 assert.deepEqual(merge.all([{ args: ['a'] }, { args: ['b'] }]), { args: ['a', 'b'] });
 assert.equal({}.isAdmin, undefined);
-console.log(
+// The imported server owns background timers; finish after these synchronous
+// assertions and flush the result before terminating this fixture process.
+process.stdout.write(
   JSON.stringify({
     publicEntryLoaded: true,
     privateRuntime,
     dependencyMetadataVersion: extra('deepmerge/package.json').version,
     prototypeCasesPassed: 3,
-  })
+  }) + '\n',
+  () => process.exit(0)
 );

package/test/packed-runtime-security.cjs

@@ -18,6 +18,7 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { createRequire } = require('node:module');
 const { spawnSync } = require('node:child_process');
 
 const root = path.resolve(__dirname, '..');
@@ -66,6 +67,27 @@ try {
       '@wppconnect/server-cli'
     );
     process.stdout.write(run([helper, installed], prefix));
+    // A separate server-owned copy is accepted only while its source matches
+    // the reviewed CLI backport. Do not let this exception trust arbitrary code.
+    const consumer = createRequire(path.join(installed, 'package.json'));
+    const serverRoot = path.dirname(consumer.resolve('@wppconnect/server/package.json'));
+    for (const file of ['index.cjs', 'is-mergeable-object.cjs']) {
+      const runtime = path.join(serverRoot, 'vendor', 'deepmerge', file);
+      const original = fs.readFileSync(runtime);
+      try {
+        fs.appendFileSync(runtime, '\n// Unreviewed fixture change.\n');
+        const rejected = spawnSync(process.execPath, [helper, installed], {
+          cwd: prefix,
+          env,
+          encoding: 'utf8',
+          timeout: 30000,
+        });
+        assert.notEqual(rejected.status, 0);
+        assert.match(rejected.stderr, /Unreviewed server merger runtime:/);
+      } finally {
+        fs.writeFileSync(runtime, original);
+      }
+    }
     const help = run([path.join(installed, 'bin', 'wppserver.js'), '--help'], prefix);
     assert.match(help, /Usage:/);
   }