Bump form-data and node-telegram-bot-api

[dependabot]

Bumps form-data to 3.0.5 and updates ancestor dependencies form-data and node-telegram-bot-api. These dependencies need to be updated together.

Updates form-data from 3.0.1 to 3.0.5

Release notes

Sourced from form-data's releases.

v3.0.2

Fixes

• npmignore temporary build files (#532)
• move util.isArray to Array.isArray (#564)

Tests

• migrate from travis to GHA

Changelog

Sourced from form-data's changelog.

v3.0.5 - 2026-06-12

Commits

• [Fix] escape CR, LF, and " in field names and filenames 8777e67
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape 27c61a5
• [Deps] update hasown 6a8a1c6

v3.0.4 - 2025-07-16

Fixed

• [Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

• [eslint] update linting config f5e7eb0
• [meta] add auto-changelog d2eb290
• [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 e8c574c
• [Fix] Switch to using crypto random for boundary values c6ced61
• [Refactor] use hasown 1a78b5d
• [Fix] validate boundary type in setBoundary() method 70bbaa0
• [Tests] add tests to check the behavior of getBoundary with non-strings b22a64e
• [meta] actually ensure the readme backup isn’t published 0150851
• [meta] remove local commit hooks fc42bb9
• [Dev Deps] remove unused deps a14d09e
• [meta] fix scripts to use prepublishOnly 11d9f73
• [meta] fix readme capitalization fc38b48

v3.0.3 - 2025-02-14

Merged

• [Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

Fixed

• [Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

Commits

• [Refactor] use Object.prototype.hasOwnProperty.call 7fecefe
• [Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript 8261fcb
• Only apps should have lockfiles b82f590
• [Dev Deps] pin request which via tough-cookie ^2.4 depends on psl e5df7f2
• [Deps] update mime-types 5a5bafe

v3.0.2 - 2024-10-10

Merged

... (truncated)

Commits

• be3f3cf v3.0.5
• 6a8a1c6 [Deps] update hasown
• 27c61a5 [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape
• 8777e67 [Fix] escape CR, LF, and " in field names and filenames
• 9c82fcd v3.0.4
• e8c574c [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
• c6ced61 [Fix] Switch to using crypto random for boundary values
• 0150851 [meta] actually ensure the readme backup isn’t published
• fc38b48 [meta] fix readme capitalization
• d2eb290 [meta] add auto-changelog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates form-data from 4.0.0 to 4.0.6

Release notes

Sourced from form-data's releases.

v3.0.2

Fixes

• npmignore temporary build files (#532)
• move util.isArray to Array.isArray (#564)

Tests

• migrate from travis to GHA

Changelog

Sourced from form-data's changelog.

v3.0.5 - 2026-06-12

Commits

• [Fix] escape CR, LF, and " in field names and filenames 8777e67
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape 27c61a5
• [Deps] update hasown 6a8a1c6

v3.0.4 - 2025-07-16

Fixed

• [Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

• [eslint] update linting config f5e7eb0
• [meta] add auto-changelog d2eb290
• [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 e8c574c
• [Fix] Switch to using crypto random for boundary values c6ced61
• [Refactor] use hasown 1a78b5d
• [Fix] validate boundary type in setBoundary() method 70bbaa0
• [Tests] add tests to check the behavior of getBoundary with non-strings b22a64e
• [meta] actually ensure the readme backup isn’t published 0150851
• [meta] remove local commit hooks fc42bb9
• [Dev Deps] remove unused deps a14d09e
• [meta] fix scripts to use prepublishOnly 11d9f73
• [meta] fix readme capitalization fc38b48

v3.0.3 - 2025-02-14

Merged

• [Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

Fixed

• [Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

Commits

• [Refactor] use Object.prototype.hasOwnProperty.call 7fecefe
• [Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript 8261fcb
• Only apps should have lockfiles b82f590
• [Dev Deps] pin request which via tough-cookie ^2.4 depends on psl e5df7f2
• [Deps] update mime-types 5a5bafe

v3.0.2 - 2024-10-10

Merged

... (truncated)

Commits

• be3f3cf v3.0.5
• 6a8a1c6 [Deps] update hasown
• 27c61a5 [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape
• 8777e67 [Fix] escape CR, LF, and " in field names and filenames
• 9c82fcd v3.0.4
• e8c574c [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
• c6ced61 [Fix] Switch to using crypto random for boundary values
• 0150851 [meta] actually ensure the readme backup isn’t published
• fc38b48 [meta] fix readme capitalization
• d2eb290 [meta] add auto-changelog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates node-telegram-bot-api from 0.56.0 to 1.1.0

Release notes

Sourced from node-telegram-bot-api's releases.

v1.0.0

Rewritten in TypeScript

The library has been rewritten from JavaScript to TypeScript and now requires Node.js ≥ 18. The public surface — the TelegramBot class, its method names, their positional arguments, and the emitted events — is otherwise unchanged, so most bots keep working after the breaking changes below.

Migrating from v0.67.x

• ESM-only. The package is "type": "module"; require() no longer works — use import TelegramBot from "node-telegram-bot-api". The class is both the default and a named export. If you are stuck on CommonJS, load it with a dynamic import: const { default: TelegramBot } = await import("node-telegram-bot-api").
• answerCallbackQuery — the legacy answerCallbackQuery(id, text, showAlert) and answerCallbackQuery([options]) forms are removed; use answerCallbackQuery(id, { text, show_alert }).
• thumb → thumbnail on sendAudio / sendDocument / sendVideo / sendAnimation / sendVoice and the sticker methods.
• reply_to_message_id → reply_parameters: { reply_parameters: { message_id } }.
• Reply-keyboard string shorthand removed. KeyboardButton is an object only; use keyboard: [[{ text: "Yes" }]] instead of keyboard: [["Yes"]]. (reply_markup is still serialized for you, or you may pass a pre-stringified value.)
• Error response shape. Errors still expose code (EFATAL / EPARSE / ETELEGRAM) and response, but response is now a plain object, not the raw http.IncomingMessage: read error.response.status (was response.statusCode); error.response.body is unchanged.
• NTBA_FIX_350 removed. filename / contentType are always auto-resolved (including magic-byte sniffing of Buffers); override per call via the file-options argument.
• request constructor option still exists but feeds the internal fetch-based HttpClient (timeouts, default headers) rather than the old request library — review any proxy/agent configuration.
• Build output moved from lib/ to dist/.

Breaking changes for @types/node-telegram-bot-api users

The bundled types replace the community @types/node-telegram-bot-api (DefinitelyTyped) package. Uninstall @types/node-telegram-bot-api; the following differences affect existing typed code:

• Types are no longer namespaced. The old package exposed everything under a TelegramBot.* namespace (TelegramBot.Message, TelegramBot.ChatId, …). Types are now flat named exports — replace TelegramBot.Message with a named import: import TelegramBot, { type Message } from "node-telegram-bot-api". The default import of the class is unchanged.
• *Options interfaces are now *Params types. Per-method option interfaces (SendMessageOptions, SendPhotoOptions, …) are replaced by docs-faithful <Method>Params types that include the positional arguments; each method types

... (truncated)

Changelog

Sourced from node-telegram-bot-api's changelog.

[1.1.0][1.1.0] - 2026-06-13

Bot API 10.1 (June 11, 2026)

Rich Messages

• Added the method sendRichMessage(chatId, richMessage, form?) → Message.
• Added the method sendRichMessageDraft(chatId, draftId, richMessage, form?) → boolean.
• Added the parameter rich_message to editMessageText, alongside a new single-object overload:

  // New (preferred) — text or rich_message:
  editMessageText({ chat_id, message_id, text: "…" })
  editMessageText({ chat_id, message_id, rich_message: { … } })
  // Old (deprecated, still works):
  editMessageText("text", { chat_id, message_id })

• Added the type InputRichMessage (with html / markdown / is_rtl / skip_entity_detection fields), which is JSON-serialized automatically.
• Regenerated src/types/schemas.ts with all new RichMessage, RichText, RichBlock, and related types.

Join Request Queries

• Added the method answerChatJoinRequestQuery(queryId, result, form?) → boolean.
• Added the method sendChatJoinRequestWebApp(queryId, webAppUrl, form?) → boolean.
• Added the fields supports_join_request_queries to User, guard_bot to ChatFullInfo, and query_id to ChatJoinRequest (in the generated types).

Polls

• Added the types Link and InputMediaLink (generated).

[1.0.0][1.0.0] - 2026-06-12

Rewritten in TypeScript

The library has been rewritten from JavaScript to TypeScript and now requires Node.js ≥ 18. The public surface — the TelegramBot class, its method names, their positional arguments, and the emitted events — is otherwise unchanged, so most bots keep working after the breaking changes below.

Migrating from v0.67.x

• ESM-only. The package is "type": "module"; require() no longer works — use import TelegramBot from "node-telegram-bot-api". The class is both the default and a named export. If you are stuck on CommonJS, load it with a dynamic import: const { default: TelegramBot } = await import("node-telegram-bot-api").
• answerCallbackQuery — the legacy answerCallbackQuery(id, text, showAlert)

... (truncated)

Commits

• 827d89d Merge pull request #1313 from yagop/version/1.1.0
• 24d799c 1.1.0
• c082e49 Merge pull request #1308 from yagop/feat/bot-api-10.1
• 7de2cee test: restore the polling/webhook mutual-exclusion unit test
• afc352f Merge pull request #1310 from yagop/chore/claude-skills
• 9952fa7 Merge pull request #1306 from yagop/dependabot/npm_and_yarn/esbuild-0.28.1
• a0b81d3 docs(skills): fail loudly when the changelog version date is missing
• 4909436 Merge pull request #1311 from yagop/fix/anchor-example-command-regex
• 3120280 Potential fix for pull request finding
• e35517d docs(examples): anchor onText command regexes to message start
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.