Security | Removed Deprecated Packages

Author: Bredrumb

.github/workflows/deploy-tomoribot.yml

@@ -277,12 +277,17 @@ jobs:
         with:
           fetch-depth: 0 # Fetch full history for TruffleHog
 
+      # TODO: Before merging to main, restore branch comparison mode:
+      # - name: Fetch main branch for comparison
+      #   run: git fetch origin main:main
+
       - name: Run TruffleHog secret scan
         uses: trufflesecurity/trufflehog@main
         with:
           path: ./
-          base: ${{ github.event.repository.default_branch }}
-          head: HEAD
+          # TODO: Before merging to main, uncomment these lines to scan only new commits:
+          # base: ${{ github.event.repository.default_branch }}
+          # head: HEAD
           extra_args: --only-verified
         continue-on-error: true
         id: trufflehog

bun.lock

@@ -38,15 +38,13 @@
 		"axios": "^1.13.2",
 		"bing-translate-api": "^4.1.0",
 		"bun-types": "^1.3.2",
-		"deepl": "^1.0.13",
 		"discord.js": "14.25.0",
 		"dotenv": "^17.2.3",
-		"gif-frames": "^1.0.1",
+		"gifuct-js": "^2.1.2",
 		"google-translate-api-x": "^10.7.2",
 		"libsodium-wrappers": "^0.7.15",
 		"pg": "^8.16.3",
 		"sharp": "^0.34.5",
-		"sql": "^0.78.0",
 		"zod": "^4.1.12"
 	},
 	"devDependencies": {

package.json

@@ -1,12 +1,10 @@
 import { translate } from "bing-translate-api";
 import type { Client, Message } from "discord.js";
-import deepl from "deepl";
 import { translate as googleTranslate } from "google-translate-api-x";
 import { log } from "../../utils/misc/logger";
 import { sendTranslationEmbed } from "../../utils/discord/embedHelper";
 import type {
 	BingResponse,
-	DeeplResponse,
 	GoogleResponse,
 } from "../../types/misc/translation";
 import { TranslationProvider } from "../../types/discord/embed";
@@ -44,14 +42,8 @@ const handler = async (_client: Client, message: Message): Promise<void> => {
 		log.info("Japanese message detected, translating...");
 
 		// Get translations from each provider
-		const [bingResult, deeplResult, googleResult] = await Promise.all([
+		const [bingResult, googleResult] = await Promise.all([
 			translate(message.content, undefined, "en") as Promise<BingResponse>,
-			deepl({
-				free_api: true,
-				text: message.content,
-				target_lang: "EN",
-				auth_key: process.env.DEEPL_KEY || "",
-			}) as Promise<DeeplResponse>,
 			googleTranslate(message.content, {
 				to: "en",
 				forceBatch: false,
@@ -63,7 +55,6 @@ const handler = async (_client: Client, message: Message): Promise<void> => {
 			text: message.content,
 			translations: {
 				[TranslationProvider.GOOGLE]: googleResult.text,
-				[TranslationProvider.DEEPL]: deeplResult.data.translations[0].text,
 				[TranslationProvider.BING]: bingResult.translation,
 			},
 			initialProvider: TranslationProvider.GOOGLE,

src/events/messageCreate/jpTrans.ts

@@ -61,7 +61,6 @@ export type ConfirmationResult = {
  */
 export enum TranslationProvider {
 	GOOGLE = "google",
-	DEEPL = "deepl",
 	BING = "bing",
 }
 
@@ -70,7 +69,6 @@ export enum TranslationProvider {
  */
 export const TRANSLATOR_COLORS = {
 	[TranslationProvider.GOOGLE]: "#DE3163", // Google red
-	[TranslationProvider.DEEPL]: "#09B1CE", // DeepL blue
 	[TranslationProvider.BING]: "#7DDA58", // Bing green
 } as const satisfies Record<TranslationProvider, ColorResolvable>;
 
@@ -79,7 +77,6 @@ export const TRANSLATOR_COLORS = {
  */
 export const TRANSLATOR_STYLES = {
 	[TranslationProvider.GOOGLE]: ButtonStyle.Danger,
-	[TranslationProvider.DEEPL]: ButtonStyle.Primary,
 	[TranslationProvider.BING]: ButtonStyle.Success,
 } as const satisfies Record<TranslationProvider, ButtonStyle>;
 

src/types/discord/embed.ts

@@ -1,15 +1,3 @@
-/**
- * Response type for DeepL API
- */
-export interface DeeplResponse {
-	data: {
-		translations: Array<{
-			text: string;
-			detected_source_language: string;
-		}>;
-	};
-}
-
 /**
  * Response type for Bing Translate API
  */

src/types/external/gif-frames.d.ts

@@ -4,7 +4,7 @@
  * for use with LLM providers that don't support GIF format
  */
 
-import gifFrames from "gif-frames";
+import { parseGIF, decompressFrames } from "gifuct-js";
 import sharp from "sharp";
 import { log } from "../misc/logger";
 
@@ -168,13 +168,11 @@ async function extractFramesInternal(
 		gifBuffer = gifSource;
 	}
 
-	// 2. Get frame metadata to determine total frame count
-	// Extract all frames first to get accurate count
-	const allFramesData = await gifFrames({
-		url: gifBuffer,
-		frames: "all",
-		cumulative: true, // Important: composite frames for GIFs with delta encoding
-	});
+	// 2. Parse and decompress the GIF
+	// parseGIF expects ArrayBuffer, convert Buffer to ArrayBuffer
+	const uint8Array = new Uint8Array(gifBuffer);
+	const gif = parseGIF(uint8Array.buffer);
+	const allFramesData = decompressFrames(gif, true); // buildPatch=true for RGBA data
 
 	const totalFrames = allFramesData.length;
 	log.info(`GIF Processor: Total frames in GIF: ${totalFrames}`);
@@ -276,7 +274,7 @@ function calculateKeyframeIndices(
 /**
  * Process a single GIF frame: convert to JPEG and compress
  *
- * @param frameData - Frame data from gif-frames
+ * @param frameData - Frame data from gifuct-js
  * @param frameNumber - Sequential frame number in the output (0-indexed)
  * @param totalOutputFrames - Total number of frames in the output (keyframes)
  * @param originalFrameIndex - Original frame index in the source GIF
@@ -285,28 +283,30 @@ function calculateKeyframeIndices(
  * @returns Processed frame with base64 data
  */
 async function processFrame(
-	frameData: { getImage: () => NodeJS.ReadableStream },
+	frameData: {
+		patch: Uint8ClampedArray;
+		dims: { width: number; height: number; top: number; left: number };
+	},
 	frameNumber: number,
 	totalOutputFrames: number,
 	originalFrameIndex: number,
 	totalSourceFrames: number,
 	config: Required<GifProcessorConfig>,
 ): Promise<ProcessedGifFrame> {
-	// 1. Get the frame as a buffer
-	const frameStream = frameData.getImage();
-	const chunks: Buffer[] = [];
-
-	// Convert stream to buffer
-	await new Promise<void>((resolve, reject) => {
-		frameStream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-		frameStream.on("end", () => resolve());
-		frameStream.on("error", (error) => reject(error));
-	});
-
-	const frameBuffer = Buffer.concat(chunks);
+	// 1. Convert RGBA pixel data to raw buffer
+	// gifuct-js provides patch as Uint8ClampedArray with RGBA pixel data
+	const { patch, dims } = frameData;
+	const frameBuffer = Buffer.from(patch.buffer);
 
 	// 2. Process with sharp: resize and convert to JPEG
-	const processedBuffer = await sharp(frameBuffer)
+	// Create Sharp instance from raw RGBA pixel data
+	const processedBuffer = await sharp(frameBuffer, {
+		raw: {
+			width: dims.width,
+			height: dims.height,
+			channels: 4, // RGBA
+		},
+	})
 		.resize(config.maxWidth, undefined, {
 			fit: "inside", // Maintain aspect ratio
 			withoutEnlargement: true, // Don't upscale small images