Batch dependency updates and fix backend security alerts

backend/notifications.js

@@ -7,8 +7,8 @@ const consts = require('./consts');
 const { v4: uuid } = require('uuid');
 
 const fetch = require('node-fetch');
+const axios = require('axios');
 const { gotify } = require("gotify");
-const TelegramBotAPI = require('node-telegram-bot-api');
 let telegram_bot = null;
 const REST = require('@discordjs/rest').REST;
 const API = require('@discordjs/core').API;
@@ -167,12 +167,15 @@ config_api.config_updated.subscribe(change => {
 async function setupTelegramBot() {
     const use_telegram_api = config_api.getConfigItem('ytdl_use_telegram_API');
     const bot_token = config_api.getConfigItem('ytdl_telegram_bot_token');
-    if (!use_telegram_api || !bot_token) return;
+    if (!use_telegram_api || !bot_token) {
+        telegram_bot = null;
+        return;
+    }
     
-    telegram_bot = new TelegramBotAPI(bot_token);
+    telegram_bot = createTelegramBot(bot_token);
     const webhook_proxy = config_api.getConfigItem('ytdl_telegram_webhook_proxy');
     const webhook_url = webhook_proxy ? webhook_proxy : `${utils.getBaseURL()}/api/telegramRequest`;
-    telegram_bot.setWebHook(webhook_url);
+    await telegram_bot.setWebHook(webhook_url);
 }
 
 exports.sendTelegramNotification = async ({body, title, type, url, thumbnail}) => {
@@ -189,7 +192,37 @@ exports.sendTelegramNotification = async ({body, title, type, url, thumbnail}) =
     
     logger.verbose('Sending notification to Telegram');
     if (thumbnail) await telegram_bot.sendPhoto(chat_id, thumbnail);
-    telegram_bot.sendMessage(chat_id, `<b>${title}</b>\n\n${body}\n<a href="${url}">${url}</a>`, {parse_mode: 'HTML'});
+    await telegram_bot.sendMessage(chat_id, `<b>${title}</b>\n\n${body}\n<a href="${url}">${url}</a>`, {parse_mode: 'HTML'});
+}
+
+function createTelegramBot(bot_token) {
+    const base_url = `https://api.telegram.org/bot${bot_token}`;
+
+    async function callTelegram(method, data) {
+        try {
+            const response = await axios.post(`${base_url}/${method}`, data, { timeout: 15000 });
+            return response.data;
+        } catch (err) {
+            const description = err?.response?.data?.description;
+            logger.error(`Telegram API ${method} failed${description ? `: ${description}` : ''}`);
+            if (!description && err) {
+                logger.error(err);
+            }
+            return null;
+        }
+    }
+
+    return {
+        setWebHook(url) {
+            return callTelegram('setWebhook', { url });
+        },
+        sendPhoto(chat_id, photo) {
+            return callTelegram('sendPhoto', { chat_id, photo });
+        },
+        sendMessage(chat_id, text, extra = {}) {
+            return callTelegram('sendMessage', Object.assign({ chat_id, text }, extra));
+        }
+    };
 }
 
 // Discord
@@ -290,4 +323,4 @@ function sendGenericNotification(data) {
         },
         body: JSON.stringify(data),
     });
-}
+}

backend/package.json

@@ -27,7 +27,7 @@
     "@discordjs/core": "^0.5.2",
     "archiver": "^7.0.1",
     "async": "^3.2.3",
-    "async-mutex": "^0.4.0",
+    "async-mutex": "^0.5.0",
     "axios": "^1.13.5",
     "bcryptjs": "^2.4.0",
     "body-parser": "^1.20.4",
@@ -46,14 +46,13 @@
     "lodash": "^4.17.23",
     "lowdb": "^1.0.0",
     "md5": "^2.2.1",
-    "mocha": "^10.8.2",
+    "mocha": "^11.7.5",
     "moment": "^2.29.4",
     "mongodb": "^3.6.9",
     "multer": "^2.0.2",
     "node-fetch": "^2.7.0",
-    "node-id3": "^0.2.6",
-    "node-schedule": "^2.1.0",
-    "node-telegram-bot-api": "^0.67.0",
+    "node-id3": "^0.2.9",
+    "node-schedule": "^2.1.1",
     "passport": "^0.6.0",
     "passport-http": "^0.3.0",
     "passport-jwt": "^4.0.1",
@@ -68,12 +67,13 @@
     "unzipper": "^0.12.3",
     "uuid": "^9.0.1",
     "winston": "^3.7.2",
-    "xmlbuilder2": "^3.0.2"
+    "xmlbuilder2": "^4.0.3"
   },
   "overrides": {
     "brace-expansion": "1.1.12",
     "braces": "3.0.3",
     "cross-spawn": "7.0.6",
+    "diff": "8.0.3",
     "got": "11.8.6",
     "mocha": {
       "js-yaml": "4.1.1"

package.json

@@ -43,13 +43,13 @@
     "fs-extra": "^10.0.0",
     "material-icons": "^1.10.8",
     "nan": "^2.14.1",
-    "ngx-avatars": "1.4.1",
+    "ngx-avatars": "1.10.1",
     "ngx-file-drop": "^15.0.0",
     "rxjs": "^7.8.2",
     "tslib": "^2.0.0",
     "typescript": "~5.9.3",
     "xliff-to-json": "^1.0.4",
-    "zone.js": "~0.15.1"
+    "zone.js": "~0.16.1"
   },
   "devDependencies": {
     "@angular-devkit/build-angular": "^21.1.5",
@@ -60,18 +60,18 @@
     "@types/file-saver": "^2.0.1",
     "@types/jasmine": "^4.3.1",
     "@types/node": "^12.11.1",
-    "@typescript-eslint/eslint-plugin": "^4.29.0",
-    "@typescript-eslint/parser": "^4.29.0",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/parser": "^8.56.1",
     "ajv": "^8.18.0",
-    "eslint": "^7.32.0",
-    "jasmine-core": "~3.6.0",
+    "eslint": "^10.0.2",
+    "jasmine-core": "~6.1.0",
     "jasmine-spec-reporter": "~5.0.0",
     "karma": "~6.4.2",
     "karma-chrome-launcher": "~3.1.0",
     "karma-cli": "~1.0.1",
     "karma-coverage-istanbul-reporter": "~3.0.2",
     "karma-jasmine": "~5.1.0",
-    "karma-jasmine-html-reporter": "1.5.4",
+    "karma-jasmine-html-reporter": "2.2.0",
     "openapi-typescript-codegen": "^0.23.0",
     "ts-node": "~3.0.4"
   },