popstas / telegram-functions-bot / 20701370480

73%

push

github

refactor: Audit the dependencies (#182)

* refactor: audit and optimize dependencies

Security fixes:
- Update @modelcontextprotocol/sdk 1.15.1 → 1.25.1 (fixes DNS rebinding vulnerability)
- Update js-yaml 4.1.0 → 4.1.1 (fixes prototype pollution)
- Run npm audit fix (resolved 6 vulnerabilities: 4 high, 2 moderate)

Dependency updates:
- Update @agentic/core, better-sqlite3, express, form-data
- Update google-auth-library, langfuse, mqtt, telegramify-markdown
- Update tsx, undici to latest patch versions
- Update openai 5.9.0 → 6.15.0 (breaking change)
- Keep zod at v3 (v4 has peer dependency conflicts with @agentic/core)

Bloat reduction (~152 packages removed):
- Replace googleapis with @googleapis/sheets (saves ~50-100MB)
- Replace lodash.debounce with native implementation
- Replace recursive-readdir with native fs.readdir (Node 18.17+)

Code changes:
- Implement native debounce function in src/config.ts
- Update google.ts to use OAuth2Client/GoogleAuth directly
- Update readGoogleSheet.ts to use @googleapis/sheets
- Update obsidian_read.ts to use fs/promises readdir
- Update test mocks for removed dependencies
- Add fake timers to debounce tests

Total dependency reduction: ~152 packages, ~50-100MB
All tests passing (89 suites, 399 tests)

* fix: add OpenAI v6 compatibility for tool calls

OpenAI v6 introduced ChatCompletionMessageCustomToolCall which doesn't
have the 'function' property, causing TypeScript errors when accessing
toolCall.function.name and toolCall.function.arguments.

Changes:
- Add isFunctionToolCall() type guard in all affected files
- Filter/check tool calls before accessing function property
- Affected files:
  - src/helpers/gpt/llm.ts
  - src/helpers/gpt/tools.ts
  - src/helpers/gpt/responsesApi.ts
  - src/helpers/gpt/toolFormatting.ts

All tests passing, typecheck clean.

* fix: replace 'any' with proper types in debounce function

---------

Co-authored-by: Claude <noreply@anthropic.com>

1421 of 2165 branches covered (65.64%)

Branch coverage included in aggregate %.

20 of 26 new or added lines in 8 files covered. (76.92%)

2652 of 3133 relevant lines covered (84.65%)

7.08 hits per line