What’s new in WBSender

Highlights

• Pending operating system updates applied, no restart needed
• The browser behind WhatsApp sessions kept on its tested version on purpose
• No linked number was disconnected and nothing had to be rescanned

Highlights

• The API is now reachable only over HTTPS, not through its internal ports
• Entry points that nothing was using have been closed
• The database now only accepts connections from our team's network
• Checked first that the dashboard and connected services only use the secure address, so nothing broke

Highlights

• The database log is rotated every day instead of growing in one file
• Older days are compressed and anything past 14 days is removed
• The 31 GB log that had built up was compressed to 786 MB, about 2.5 percent of its size
• About 30 GB freed: disk use went from 55 GB (29 percent) to 25 GB (13 percent)
• Done with no restart and no interruption to sending or the dashboard

Highlights

• An email alert goes to our team when a nightly backup fails after every retry
• A skipped backup raises the same alert, so a setting removed by mistake cannot go unnoticed
• A temporary problem that the hourly retry fixes does not cause a false alarm
• The alert says what went wrong and how to take a snapshot by hand

Highlights

• A full snapshot of the database is taken every night at 03:00 Bangladesh time
• Snapshots are encrypted and stored off the server, in private cloud storage
• 30 days of history are kept, and the 7 most recent are never removed
• Every snapshot is checked after upload, so a broken copy is never counted as a good backup
• The first snapshot was taken on 5 October and checked against the original

Highlights

• The content check no longer calls an AI model that has been retired
• Browser cache for each linked number is capped at 100 MB

Highlights

• Operating system, OpenSSL, Linux kernel and MongoDB security updates installed
• A full database backup was taken and checked against the live data before the update
• The service now starts by itself after a server restart
• 2.2 GB of old browser cache cleared without logging any number out
• Server login is key only, and repeated failed login attempts are blocked automatically
• Application logs now rotate by themselves instead of growing forever

Highlights

• A date range picker on the delivery report, with presets and a two month calendar
• Presets for the last 7 days, 14 days, last month, 3 months, 12 months, month to date and all time
• Pick any custom start and end date, with a live preview of the range as you move across the calendar
• The delivered and failed totals now count only the range you picked
• Short ranges plot day by day, longer ranges plot month by month, in your own timezone

Highlights

• The two switched-off reply routes now carry the same fix as everything else
• Every place the product attaches a file was audited — twelve in all, none left exposed
• Campaign, single-send and group attachments confirmed working after this morning's fix
• No action needed and no re-scan required; this changes nothing you can see today

Highlights

• Images, albums, voice notes, videos and documents send again
• An auto-reply with a picture no longer arrives as bare text
• Campaign, single-send and group attachments are covered by the same fix
• Already-linked numbers picked the fix up without re-scanning a QR code
• Delivery and seen ticks update again for media that WhatsApp acknowledged late

Highlights

• A reply rule can send an ordered sequence of steps instead of one fixed message, mixing text, images, an album, a video, a voice note and a document
• Existing single-response rules are unaffected — the new fields are additive, nothing about how they send has changed
• The response builder and the rule detail page were redesigned around a shared, color-coded timeline layout, fully responsive
• Fixed a typing freeze in the rich-text editor used across auto-reply, templates and message composition, triggered by having more than one editor on a page at once
• Switching a rule between single and multi-step mode now clears the mode you're leaving instead of leaving its old data behind unseen

Highlights

• Isolated-vm reverted to 6.1.2: its 7.x line requires Node 24, the server runs Node 22, and the deploy refused to install until this was caught
• The fix shipped and was redeployed the same hour, verified against a live health check and a clean process log
• The Mongoose new:true deprecation warning is gone from the logs for good, across all 48 places it was showing up

Highlights

• Next.js upgraded from 16.2.10 to 16.3.4, with eslint-config-next and @next/third-parties bumped to match
• Verified against a pre-upgrade typecheck and a full production build before shipping, so this carries no new type errors
• A Changelog link now sits in the sign-in page footer and in the profile dropdown in the header
• Both open the changelog in a new tab, so you don't lose your place signing in or in the dashboard

Highlights

• Bullmq 5 to 6: the two scheduled background jobs were moved to the new Job Scheduler API before the old repeat option disappeared under them
• Mongoose 8 to 9: about 85 call sites updated for stricter ObjectId typing across campaigns, automation, messaging and subscriptions
• The pinned Stripe API version was bumped to match the v22 SDK; billing flows are being verified by hand in test mode
• Ioredis, redis, nodemailer, bull-board, isolated-vm and roughly 30 other packages updated with no code changes needed
• TypeScript held back at 5.9 for now; 7.x removes the path-alias setup this project depends on and is being migrated separately

Highlights

• A public changelog timeline at /changelog, no sign in required
• Each release opens into the individual changes that shipped with it
• Search and filter by release channel across stable, beta and hotfix
• A live status page covering the database, Redis and the send queues
• A health indicator in the header that links straight to the status page

Highlights

• Add heavy stress test tool with safety guards and ramp-up
• Format stress test script
• Support 10k concurrency stress runs (fd limit, raised load guard)

Highlights

• Resolve local ts-node, detect nvm node, work from project dir
• Format load test scripts and docs
• Add visible load test & resource monitor with optional hourly cron setup

Highlights

• Media in group chats with LID participants downloads again
• Contact and chat lookup works for accounts that only expose a LID
• Replies keep their quoted message on LID builds
• Chat sync no longer returns an empty list on WhatsApp Web 2.3000 builds
• Reactions, unread marking, block and unblock no longer take a worker down

Highlights

• Session hosting and campaign workers now run on tiers that scale independently
• One account flooding the queue can no longer starve another account
• A large image campaign to 700 recipients went from 41 minutes to 9
• A session stuck below the ready state is detected and recycled without a manual restart
• Media processing moved off the request path

Highlights

• Sustained CPU on the sending nodes came down from 98 percent to about 31 percent
• The RemoteAuth session cache no longer holds the whole session archive in memory
• Numbers that were logging out every 30 to 60 minutes now stay linked
• Campaigns paused for the window resumed from the exact message they stopped on
• Delivery reports no longer mark a failed send as delivered