aldinokemal/go-whatsapp-web-multidevice v9.2.0

on GitHub

What's New in v9.2.0

🔐 Embedded MCP OAuth 2.1, HD Media & More Reliable Releases

Version 9.2.0 adds an opt-in OAuth 2.1 authorization server directly to the existing MCP endpoint, allowing remote MCP clients such as Claude custom connectors to authenticate without custom Basic Auth headers. It also adds explicit HD quality for photos and videos, fixes per-device Chatwoot webhook URLs that contain query parameters, and aligns the release and Docker toolchains with Go 1.26.

✨ New Features

Embedded OAuth 2.1 for MCP (#802)

• Adds an opt-in authorization-code flow with mandatory PKCE S256 for the streamable-HTTP MCP endpoint
• Supports OAuth Bearer tokens alongside the existing Basic Auth credentials while leaving normal REST and UI authentication unchanged
• Implements protected-resource and authorization-server metadata, dynamic client registration, resource binding, refresh-token rotation, and token-family revocation on reuse
• Stores only hashes of opaque authorization codes and tokens in a dedicated SQLite database
• Adds configuration and deployment guidance for Claude custom connectors, reverse proxies, APP_BASE_PATH, and Cloudflare
• Remains disabled by default with MCP_OAUTH_ENABLED=false

HD Photo and Video Sending (#809)

• Adds an explicit hd option to REST and MCP image/video send requests
• Sends photos at up to a 2560px maximum edge with JPEG quality 92, without upscaling smaller images
• Sends videos with an aspect-preserving H.264 CRF 23 profile capped inside 1280x1280
• Populates image and video dimensions plus video duration in outgoing WhatsApp metadata
• Keeps existing compression defaults unchanged; hd=true takes precedence over compress

🐛 Bug Fixes

Chatwoot Webhook URLs Preserve Query Parameters (#801)

• Appends the device ID to the webhook path without corrupting existing query parameters
• Fixes URLs such as ...?secret=value/device-id by producing the correct .../device-id?secret=value form
• Keeps the existing relative APP_BASE_PATH fallback unchanged

🔧 Technical Improvements

Go 1.26 and Release Reliability

• Raises the minimum Go version to 1.26.0 for current dependency requirements
• Aligns Docker and GoReleaser builds with Go 1.26
• Prevents multi-architecture Docker publishing from failing during go mod download because of a stale builder toolchain
• Strengthens the guarded release workflow so versioning, tests, commit, main push, tagging, and release verification follow one confirmed sequence

Dependencies

• Refreshes go.mau.fi/whatsmeow and go.mau.fi/util to their latest snapshots included in this release

What's Changed

• fix(chatwoot): preserve query params in per-device webhook URL (#801) by @aldinokemal
• feat(mcp): add embedded OAuth 2.1 authorization (#802) by @aldinokemal
• feat(send): add HD photo and video quality (#809) by @aldinokemal
• chore: update go.mau.fi/whatsmeow to latest snapshots by @aldinokemal
• refactor(new-release): automate guarded version, commit, push, and tag flow by @aldinokemal
• chore(release): update AppVersion to v9.2.0 by @aldinokemal
• fix(ci): align Docker and release builds with Go 1.26 by @aldinokemal

Contributors

• @aldinokemal

Full Changelog: v9.1.0...v9.2.0