Added
- The JavaScript SDK now publishes to npm from CI via Trusted Publishing (OIDC) on a
js-sdk-v*tag — no npm token exists anywhere, and every release carries build provenance. First release through it:@rmyndharis/openwa@0.2.0, carrying everything added since 0.1.0 in June. - The Python SDK now publishes to PyPI from CI via Trusted Publishing (OIDC) on a
py-sdk-v*tag — no PyPI token exists anywhere, matching the JavaScript SDK's release path. - The PHP SDK now cuts versioned releases from CI on a
php-sdk-v*tag — it tags the Packagist mirror, which previously only ever trackeddev-mainbecause nothing propagated a version. - The Go SDK documents how it is released — tags must carry the
sdk/go/module prefix, so a barev*app tag never publishes it and callers can finally pin a version instead of a pseudo-version.
Fixed
- The Java SDK release guide described the opposite of what the workflow does — it promised a missing publish secret makes the run a harmless no-op, while the guard has since been a hard failure by design.
- A whatsapp-web.js session failing with
Execution context was destroyedshowed a bare Puppeteer error with no next step — the advisory naming the likely stale browser profile went only to the server log, so the session card now carries a short form of it too. - Infrastructure reported "Pinned by an environment variable" for any unapplied change, without naming the variable — the gateway now reports which settings a higher-precedence layer actually supplies, so a real pin names its variable, a saved-but-not-restarted change says so instead, and the Engine card gained the notice it never had.