[Snyk] Upgrade telegraf from 4.5.2 to 4.16.3

[peterleiva]

Snyk has created this PR to upgrade telegraf from 4.5.2 to 4.16.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 58 versions ahead of your current version.

• The recommended version was released 2 years ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Prototype Pollution SNYK-JS-MINIMIST-2429795	292	Proof of Concept

Release notes

Package name: telegraf

• 4.16.3 - 2024-02-29
  
  • Fix: bug with link_preview_options.url caused client to try sending it as media
  • Fix: add CommandContextExtn type to Composer::{start|help|settings} (adds ctx.command, payload, args)
• 4.16.2 - 2024-02-26
  

  Fixed Context::text: was undefined if entities was undefined. Thanks to @ AnotiaWang.

• 4.16.1 - 2024-02-25
  

  Fixed Context::from: now uses callbackQuery.from instead of msg.from

• 4.16.0 - 2024-02-25
  

  Phew, what a feature-packed release! 🎉

  *tsk tsk* There's a big announcement at the end of this release!

  🆙 Bot API Updates

  • Support for API 7.0. Highlights are Reactions, Replies 2.0, Link Previews, Blockquotes, and Chat Boosts.
  • Support for API 7.1.
  • All methods and update types from these API versions are now fully supported.
  👍 Working with Reactions

  • To listen on reaction addition and removal, use Composer.reaction:

    bot.reaction("👍", (ctx) => {
    // user added a 👍 reaction
    });

    // prefix with - to listen to reaction removal
    bot.reaction("-👍", (ctx) => {
    // user removed a 👍 reaction
    });

    This also just works with custom emoji IDs.

    bot.reaction("5368742036629364794", (ctx) => {
    // user added a reaction with the given custom emoji ID
    });

    bot.reaction("-5368742036629364794", (ctx) => {
    // user removed a reaction with the given custom emoji ID
    });

  • You can probe and inspect the reaction list with the ctx.reactions smart object:

    bot.on("message_reaction", async (ctx) => {
    // remember that ctx.reactions is a smart object, but not an array

    // message has a 👍 reaction
    ctx.reactions.has("👍");

    // message has a reaction with the given custom emoji ID
    ctx.reactions.has("5368742036629364794");

    // number of reactions from this user on the message
    ctx.reaction.count;

    // indexed access is allowed:
    const first = ctx.reactions[0];

    // the 👍 emoji was added in this update
    if (ctx.reactions.added.has("👍")) {
    // user added a 👍 reaction
    await User.updateOne({ id: ctx.from.id }, { $inc: { likes: 1 } });
    }

    // the 👍 emoji was removed in this update
    if (ctx.reactions.removed.has("👍")) {
    // user removed a 👍 reaction
    await User.updateOne({ id: ctx.from.id }, { $inc: { likes: -1 } });
    };

    // to copy any of these smart objects into an array, call the toArray method
    const reactions = ctx.reactions.toArray();
    const added = ctx.reactions.added.toArray();
    const removed = ctx.reactions.removed.toArray();
    });

  • To react to a message, use ctx.react:

    bot.on("text", async (ctx) => {
      await ctx.react("👍");
    });

    You can also react to a message with a custom emoji ID:

    bot.on("text", async (ctx) => {
      await ctx.react("5368742036629364794");
    });

    The bot.telegram.setMessageReaction method is also available.

  💅 Context::text and Context::entities() helpers

  • Added the ctx.entities() method to fetch entities in any message.

    bot.on("text", (ctx) => {
      // fetch all entities
      const entities = ctx.entities();
      // fetch all command entities
      const commandEntities = ctx.entities("bot_command");
      // fetch all mentions and text mentions
      const mentions = ctx.entities("mention", "text_mention");
    });

    Not only does this method fetch entities from any message, but also works with captions, game text, and poll explanations. In short, if an update has any text and entities, this method will find them.

  • ctx.text is the companion to ctx.entities(). It fetches the text from the update, and works with any message type. This includes message text, media captions, game text, and poll explanations.

    bot.on(message("text"), (ctx) => {
    // fetch the text from the update
    const text = ctx.text;
    });

    bot.on(message("photo"), (ctx) => {
    // fetch the caption from the photo
    const caption = ctx.text;
    });

  • 🎁 Bonus! Every entity in the ctx.entities() array will have a fragment of the text they represent!

    bot.on("text", (ctx) => {
      const entities = ctx.entities("bold");
      for (const entity of entities) {
        // the text that is bold
        const boldText = entity.fragment;
      }
    });

  📬 Context::msg and Context::msgId shorthands

  • Context::msg shorthand to get any message in the update.

    bot.use((ctx) => {
      // finds one of:
      // ctx.message ?? ctx.editedMessage ?? ctx.callbackQuery?.message ?? ctx.channelPost ?? ctx.editedChannelPost
      const msg = ctx.msg;
    });

    ctx.msg is decorated with the isAccessible and has methods. The has method works similarly to the message() filter in bot.on. It checks if the message has a certain property.

    if (ctx.msg.isAccessible()) {
    // msg is accessible, not deleted or otherwise unavailable
    // this is a type-guard based on the runtime check for msg.date === 0
    }

    if (ctx.msg.has("text")) {
    // ctx.msg.text exists
    }

  • Context::msgId shorthand to get any available message ID in the update. This also includes message_id present in updates that do not contain a message, such as message_reaction, and message_reaction_count.

    bot.use((ctx) => {
      // finds one of:
      // ctx.msg.message_id ?? ctx.messageReaction.message_id ?? ctx.messageReactionCount.message_id
      const msgId = ctx.msgId;
    });

  🚀 bot.launch takes an onLaunch callback

  • bot.launch now takes an optional callback that is called when the bot is launched.

    bot.launch(() => console.log("Bot is starting!"));

    If you pass LaunchOptions, the callback goes after the options.

    bot.launch({ dropPendingUpdates: true }, () => console.log("Bot is starting!"));

    This is useful for running some code when the bot is launched, such as logging to the console, or sending a message to a channel. Remember that errors thrown in this callback will not be caught by the bot's error handler. You must handle them yourself.

    It's worth noting that the callback is called once the first getMe call is successful. This means network is working, and bot token is valid. Due to how networks work, there isn't a way to define when the bot is "fully" launched. The bot may still crash after the callback is called, for example if another instance of the bot is running elsewhere and polling getUpdates fails. For these reasons, onLaunch callback exists under @ experimental, and may receive improvements based on feedback.

  🖍 Format helpers

  • Added quote format helper for Blockquotes.
  • Stricter types for format helpers. For example, it will now be a type-error to try to nest pre within another entity.
  🔧 Other fixes and improvements

  • Added ctx.match for Composer.command (#1938).
  • Fixed thumbnail uploads in media groups (#1947).
  • The shorthand ctx.chat now includes chat from this.messageReaction ?? this.messageReactionCount ?? this.removedChatBoost.
  • The shorthand ctx.from now includes the field user from ctx.messageReaction ?? ctx.pollAnswer ?? ctx.chatBoost?.boost.source, in addition to fetching from in other updates.
  • useNewReplies uses ctx.msgId instead of ctx.message.message_id to reply to messages, which works for more update types than before.
  • The following modules are now directly importable: types, scenes, filters, format, future, utils, markup, session. For example, via import { WizardScene } from "telegraf/scenes". This was previously available in v3, and was removed in v4.
  💔 Minor breaking changes

  • (Breaking) Markup.button.userRequest will take extra instead of user_is_premium as the third parameter.
  • (Breaking) Markup.button.botRequest will take extra before hide as the third parameter.
  • (Types breaking) reply_to_message_id and allow_sending_without_reply replaced by reply_parameters.
  • (Types breaking) disable_web_page_preview and link_preview_options replaced by link_preview_options.
  🎉 BIG announcement 🥳

  Telegraf v4 - Last Major Update

  This will be the last major update for Telegraf v4.

  What to Expect

  If you are currently using Telegraf v4, you can continue using it as you have been. Telegraf v4 will be supported until February 2025, with the following commitments:

  • Bug fixes and security updates will still be released for Telegraf v4.
  • The existing documentation for Telegraf v4 will remain available.
  • New API updates will only focus on ensuring compatibility with the latest Telegram Bot API. No new convenience features will be added to Telegraf v4.

  Introducing Telegraf v5

  In the coming weeks, we plan to release Telegraf v5. v5 will bring a revamped API, new functionalities, numerous convenient helpers, an improved approach to handling updates, and enhanced documentation.

  One of the key highlights of Telegraf v5 is its platform-agnostic nature, allowing you to run it on any JavaScript runtime environment, including Deno, Bun, edge runtimes (such as Cloudflare Workers and Vercel), browsers, and more.

  Smooth Transition to v5

  If you have closely followed the development of v4 in the past year and stayed updated with deprecation notices, the transition to v5 will be relatively seamless for you. For those still using v4, we will provide a comprehensive migration guide to assist you in upgrading to v5. Stay tuned for more information on the release of v5!

  Thanks for all the love ❤️! Go follow the releases channel on Telegram: t.me/Telegraf_JS.

  You can sponsor the maintainer (@ MKRhere) via GitHub Sponsors, Patreon, or Ko-fi.

• 4.16.0-rc.2 - 2024-02-21
• 4.16.0-rc.1 - 2024-02-21
• 4.15.3 - 2023-12-03
  
  • Fix: unable to upload media
  • Fix: thumbnail is now respected in all APIs that accept it
• 4.15.2 - 2023-11-30
  

  EXPERIMENTAL_SESSION_CHECKS introduced in the last minor release had been reporting false positives. This has been fixed; it will now work as intended.

• 4.15.1 - 2023-11-29
  

  • 🔧 Fixed sendPhoto and friends irrecoverably erroring if passed an invalid path, such as a directory.

  • ⚠️ Set the env var EXPERIMENTAL_SESSION_CHECKS=1 to catch session bugs in your code.

    When this is enabled, Telegraf will throw errors if you access/assign to session after Telegraf thinks the middleware chain has exhausted. This can happen if you're missing awaits in async code, and session changes might not get persisted! Previously, these bugs were silently ignored until someone noticed their session was not saved. It's always safe to enable this feature. This behaviour may be default in v5.

• 4.15.0 - 2023-10-23
  

  This is a rather minor release.

  anyOf and allOf filter combinators

  v4.11.0 introduced support for type-guard filters in Composer::on, which allowed you to filter updates based on their content.

  This release adds two new combinators to the filter API: anyOf and allOf. This will play very nicely with custom filters. For example:

  import { anyOf, allOf } from "telegraf/filters";

  // must match all filters
  bot.on(allOf(message(), isGroup), ctx => {
  // ...
  });

  Deprecating hookPath

  The confusingly named hookPath in bot.launch webhook options is now deprecated. It will be removed in the next major release. You can start using path instead, today.

  ---

  Meanwhile, we're working on new modules to add to the Telegraf ecosystem. Look forward to them, and join discussions in the official Telegraf chat!

• 4.14.0 - 2023-09-22
  
  • ⬆️ Bot API 6.9 support
  • Added missing Markup.keyboard([]).persistent() method
• 4.13.1 - 2023-09-02
  
  • Fix README to mention API 6.8
• 4.13.0 - 2023-09-02
• 4.12.3-canary.1 - 2023-04-01
• 4.12.2 - 2023-03-09
• 4.12.1 - 2023-03-07
• 4.12.0 - 2023-03-05
• 4.11.2 - 2022-11-19
• 4.11.1 - 2022-11-19
• 4.11.1-canary.2 - 2022-11-19
• 4.11.1-canary.1 - 2022-11-19
• 4.11.0 - 2022-11-18
• 4.11.0-canary.1 - 2022-11-12
• 4.10.0 - 2022-10-01
• 4.9.2 - 2022-09-13
• 4.9.1 - 2022-08-29
• 4.9.0 - 2022-08-26
• 4.9.0-canary.12 - 2022-08-24
• 4.9.0-canary.11 - 2022-08-24
• 4.9.0-canary.10 - 2022-08-18
• 4.9.0-canary.9 - 2022-05-18
• 4.9.0-canary.8 - 2022-05-18
• 4.9.0-canary.7 - 2022-05-18
• 4.9.0-canary.6 - 2022-05-15
• 4.9.0-canary.5 - 2022-05-15
• 4.9.0-canary.4 - 2022-05-15
• 4.9.0-canary.3 - 2022-05-15
• 4.9.0-canary.2 - 2022-05-15
• 4.9.0-canary.1 - 2022-05-15
• 4.8.6 - 2022-07-25
• 4.8.5 - 2022-06-08
• 4.8.5-canary.1 - 2022-06-08
• 4.8.4 - 2022-06-07
• 4.8.3 - 2022-05-29
• 4.8.2 - 2022-05-13
• 4.8.1 - 2022-04-29
• 4.8.0 - 2022-04-29
• 4.8.0-canary.8 - 2022-04-29
• 4.8.0-canary.7 - 2022-04-29
• 4.8.0-canary.6 - 2022-04-29
• 4.8.0-canary.5 - 2022-04-28
• 4.8.0-canary.4 - 2022-04-28
• 4.8.0-canary.3 - 2022-04-28
• 4.8.0-canary.2 - 2022-04-28
• 4.8.0-canary.1 - 2022-04-28
• 4.7.0 - 2022-02-05
• 4.7.0-canary.1 - 2022-02-04
• 4.6.0 - 2022-01-15
• 4.5.2 - 2021-12-08

from telegraf GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs