The 249-file checkout gives you a library, not a server
The 249-file whatsmeow checkout gives Go applications a client for WhatsApp's web multi-device system. It covers encrypted sessions, event delivery, uploads, downloads, receipts, and account state. There is no bundled dashboard or general REST service in the repository. The main example is application code, so adopting whatsmeow means designing the login flow, API surface, persistence, monitoring, and user controls yourself.
The supported messaging surface is wide. Applications can send text and media to private chats or groups, receive messages, manage groups, use invite links, report typing state, and handle delivery or read receipts. App-state methods cover contacts plus chat pin and mute status. Retry receipts help after message decryption failures. Status sending exists, although the README labels it experimental and warns that it may fail with large contact lists.
At 129,794 lines of source, this is substantial protocol machinery rather than a thin HTTP wrapper. That can save months for a team building a bridge or custom inbox. It also puts your product on behavior controlled by WhatsApp. Recent issue reports cover failures in specific message, media, community, and calling paths, so a successful compile cannot stand in for account-level testing.
Go 1.26 code still needs QR login and SQL state
The module at commit 33cfac5 declares Go 1.26 and selects a Go 1.27 toolchain. Its example creates a SQL store, gets or creates a device identity, adds an event handler, and connects. A new device produces QR events that the application must render or present for scanning. Returning sessions reconnect from stored identity data, and the process stays alive until shutdown.
SQLite and Postgres are the 2 fully supported store backends. The example warns that developers must import a matching database driver themselves, and SQLite must have foreign keys enabled. The database contains device identities, Signal session material, prekeys, sender keys, app state, contacts, message secrets, and device mappings. Treating it like a disposable cache will cause operational trouble and may force another account link.
Multiple sessions can share one container, while the convenience example simply selects the first device. A multi-customer product needs its own mapping between users and stored devices. It also needs access controls around QR events, database backups, logout handling, reconnection limits, and a policy for valuable phone numbers. whatsmeow supplies store interfaces and migrations; those product decisions remain with the integrator.
What happened when we ran it
Our sandbox installed 39 packages in 26 seconds from commit 33cfac5. We used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, and no secrets. The checkout occupied 5.4 MB and held 249 files with about 129,794 lines of source. The build then succeeded in 34 seconds without an error in the supplied log.
The Go test step finished in 11 seconds. We measured 2 passed and 0 failed out of 2. That is a clean result with a narrow test count. The run did not pair a WhatsApp account, send a message, download media, or observe reconnect behavior because the sandbox had no secrets. It therefore checks repository setup and compilation, not service reliability against the live network.
The repository includes 2 CI workflow files, no Dockerfile, and no tests directory. Go still found the 2 tests that our run reported, so the missing directory does not mean there are no tests anywhere. Container packaging and deployment belong to the adopter. Check the declared Go toolchain against internal build images before pinning a revision.
Calls and broadcast lists are outside the supported surface
The README explicitly leaves out 2 capabilities that may end an evaluation early: calls and broadcast-list sending. It says WhatsApp Web does not support broadcast-list messages either. A product specification that requires either feature should use another route instead of assuming an undocumented flag or future update will fill the gap.
Open issue 1229 documents channel voice notes failing to download with invalid media hmac. The reporter tested 5 voice notes, said all 5 failed through the regular path, and supplied hashes plus a workaround. Issue 1227 reports text-only messages reaching a linked device but not the primary phone until a media message is sent. These are user reports, not findings from our sandbox, and both were open when checked.
Issue 1231 is the harder operational warning. It describes 2 account-specific cases where a passive linked whatsmeow companion left primary-phone calls stuck connecting; unlinking restored calls immediately. The same report says thousands of calls completed normally on unaffected accounts, so the problem is not universal. A call-dependent organization should test with a disposable number before linking a business-critical account.
The August 21 push is active, but there are no releases
GitHub showed 26 open issues and 31 open pull requests, a combined queue of 57, alongside a last push on August 21, 2026. Several items had August updates, including precise protocol reports and proposed fixes. The combined count cannot be read as 57 confirmed bugs, but the dates show that maintainers and users are still working in the repository.
GitHub returned no tags and no latest release. Go consumers can pin a commit-derived module revision, but there is no current release page that gathers an artifact and change notes under one version. Review diffs before upgrading, especially when they touch generated protocol definitions, device storage, or app-state migrations. A staged account can catch network behavior that 2 local tests cannot.
The MPL 2.0 license is stated clearly. Exported methods and events are documented through Go Reference, while the README points users to a Matrix room and GitHub discussions for protocol questions. whatsmeow is a serious base for Go developers willing to run an integration as a maintained service. It is a poor fit for unattended business messaging that needs an official support contract or a set-and-forget upgrade path.