fix(whatsapp): mirror qrcode from root runtime deps

CHANGELOG.md

@@ -21,7 +21,7 @@ Docs: https://docs.openclaw.ai
 - Discord/voice: lengthen the default voice join Ready wait, add configurable `voice.connectTimeoutMs`/`voice.reconnectGraceMs`, and warn before destroying unrecovered disconnected sessions so slow Discord voice handshakes and reconnects no longer fail silently. Fixes #63098; refs #39825 and #65039. Thanks @darealgege, @kzicherman, and @ayochim.
 - Gateway/health: refresh cached health RPC snapshots when channel runtime state diverges, so Discord and other channel status reads no longer report stale running or connected values until the cache TTL expires. (#75423) Thanks @clawsweeper.
 - Discord/voice: merge configured media-understanding providers such as Deepgram into partial active provider registries, so follow-up voice turns keep transcribing after another media plugin is already active. Fixes #65687. Thanks @OneMintJulep.
-- WhatsApp: stage `qrcode` with the WhatsApp plugin runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.
+- WhatsApp: stage `qrcode` through root mirrored runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.
 - Discord/voice: apply per-channel Discord `systemPrompt` overrides to voice transcript turns by forwarding the trusted channel prompt through the voice agent run. Fixes #47095. Thanks @qearlyao.
 - Discord/voice: run voice-channel turns under a voice-output policy that hides the agent `tts` tool and asks for spoken reply text, so `/vc join` sessions synthesize and play agent replies instead of ending with `NO_REPLY`. Fixes #61536. Thanks @aounakram.
 - Plugins/runtime-deps: include packaged OpenClaw identity in bundled plugin loader cache keys, so same-path package upgrades stop reusing stale versioned runtime-deps mirrors. Fixes #75045. Thanks @sahilsatralkar.

extensions/whatsapp/package.json

@@ -7,7 +7,6 @@
     "@whiskeysockets/baileys": "7.0.0-rc.9",
     "https-proxy-agent": "^9.0.0",
     "jimp": "^1.6.1",
-    "qrcode": "1.5.4",
     "typebox": "1.1.34",
     "undici": "8.1.0"
   },

package.json

@@ -1766,6 +1766,7 @@
         "jszip",
         "markdown-it",
         "openai",
+        "qrcode",
         "semver",
         "sqlite-vec",
         "tar",

pnpm-lock.yaml

@@ -1458,9 +1458,6 @@ importers:
       jimp:
         specifier: ^1.6.1
         version: 1.6.1
-      qrcode:
-        specifier: 1.5.4
-        version: 1.5.4
       typebox:
         specifier: 1.1.34
         version: 1.1.34

src/plugins/bundled-runtime-deps-drift.test.ts

@@ -13,7 +13,6 @@ describe("mirrored root runtime dependency drift guard", () => {
     "file-type", // available transitively via mirrored deps
     "ipaddr.js", // available transitively via mirrored deps
     "proxy-agent", // available transitively via mirrored deps
-    "qrcode", // QR setup flows stage this through the owning channel plugin, not the root mirror
     "typescript", // CLI/dev only (api-baseline, jiti-runtime-api)
   ]);