[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/slack-go/slack	v0.29.0 → v0.32.0

---

Release Notes

slack-go/slack (github.com/slack-go/slack)

v0.32.0

Compare Source

This release expands Slack Code support with channel views, context bars, and canvas collaboration, and fixes permission diagnostics, slash-command decoding, and workflow-button validation.

[!IMPORTANT]
Please read all the notes below, not just the breaking changes. Some changes deserve paying close attention to, like new fields in SlackResponse, and all the new *AgentConversation* methods.

Breaking changes

• Update interfaces, mocks, and function values that use the old canvas creation
  signatures. CreateCanvas and CreateCanvasContext now accept
  options ...CreateCanvasOption. Existing direct calls still compile, but these
  methods no longer satisfy interfaces with the old fixed signatures. Add the
  variadic parameter to interface and mock declarations; adapt stored function
  values or wrap the call in a function with the old signature.
• Use field names when initializing Properties, SlackResponse,
  KickUserFromConversationSlackResponse, or SlackErrorResponse. New fields
  make positional literals fail to compile. Existing keyed literals still work.

Added

• Show code diffs, HTML reports, Block Kit interfaces, and canvases in Slack Code
  channels. Use SetAgentConversationView to publish or update a view,
  ListAgentConversationViews to discover attached views, and
  RemoveAgentConversationView to remove them. All have Context variants.
  Slack documents pull-request views too, but live requests have returned
  invalid_view_type; publish a unified diff with AgentViewTypeDiff if that
  happens.
• Give a code channel useful context. Set context-bar links, action items,
  a summary message, and external resource details with
  SetAgentConversationProperties or its Context variant. Read session status,
  title, assigned agents, origin message, context-bar ownership, summary, and
  managed views through Properties.AgentSession and Properties.CodeChannel
  in conversation responses.
• Read and revise canvases attached to code channels.
  GetAgentConversationCanvas retrieves markdown and comment threads, including
  replies and optional resolved threads. SetAgentConversationCanvasContent
  replaces the markdown while preserving section IDs and comment anchors on
  unchanged sections. Both have Context variants.
• Create a canvas directly in a channel, including in free workspaces that
  require a channel. Pass CreateCanvasOptionChannelID(channelID) to
  CreateCanvas or CreateCanvasContext (#​1623).
• Try the new examples/slack_code CLI for channel
  setup, context bars, views, canvases, commands, metadata inspection, and archival.
  It includes sample HTML, Block Kit, markdown, and unified-diff files.

Fixed

• See which scopes are missing when an API call fails. Slack's needed and
  provided values are now preserved in responses and SlackErrorResponse, even
  for methods that return only an error. Use errors.As to inspect Needed and
  Provided; the error text is unchanged.
• Discover code-channel views even when Slack returns an empty legacy views
  array. ListAgentConversationViews also preserves session_views, including
  view types, names, and owner IDs.
• Receive slash commands when Slack omits is_enterprise_install. JSON
  decoding now accepts absent or null values, including observed Slack Code
  context-bar action deliveries over Socket Mode.
• Send workflow buttons without an action ID. An empty
  WorkflowButtonBlockElement.ActionID is omitted from JSON so the button passes
  Slack's block validation. Populated IDs are preserved.

Documentation and testing

• Clarify that Slack documents raw_number table cells for publishing. If a
  workspace rejects them with invalid_blocks, send the number as a
  TableRawTextCell. Null cells remain a received-only representation.
• Add regression coverage for code-channel lifecycle events, Block Kit view
  interactions, and agent slash commands through the existing HTTP and Socket
  Mode parsers and handlers.

Full Changelog: slack-go/slack@v0.31.0...v0.32.0

v0.31.0

Compare Source

Breaking changes

• ButtonBlockElement is no longer comparable because VisibleToUserIDs is a slice.
  Value comparisons and map keys using it no longer compile; interface comparisons containing button values can panic. Use comparable identifiers as map keys and compare button contents explicitly:

  // Before
  same := a == b
  // After (import "reflect")
  same := reflect.DeepEqual(a, b)

• If you create these structs without naming their fields, update that code. New fields were added to Block Kit elements, Attachment, File, RemoteFile and Features. Code that supplies values by position now fails to compile. Include the field names, or use the existing New... helper functions where available:

  // Before: values depend on field order.
  element := slack.RichTextSectionBroadcastElement{slack.RTSEBroadcast, "here"}
  // After: each value names its field.
  element := slack.RichTextSectionBroadcastElement{
      Type:  slack.RTSEBroadcast,
      Range: "here",
  }

• Newly supported rich-text elements decode into concrete types instead of *RichTextSectionUnknownElement. Update type assertions and switches for attachment, workflow, Work Object and message mentions; tags; canvas elements; citations; file and List record references; and Salesforce data fields.

• Request signature validation is stricter, and mismatch errors have changed. NewSecretsVerifier rejects signatures without the v0= prefix or whose decoded length is not 32 bytes. Update any test fixtures that relied on the previous permissive parsing. SecretsVerifier.Ensure returns ErrInvalidSignature on a mismatch; replace checks of the old error text with errors.Is(err, slack.ErrInvalidSignature).

• UninstallApp and RotateTokens now use POST, including their Context variants. Update mocks or custom transports that expect GET requests or credentials in the URL to accept form-encoded POST bodies.

• OptionOnWarning callbacks no longer receive the token parameter in form or query parameter maps. Update callbacks that rely on that field.

Added

• Add RTMOptionReadLimit and socketmode.OptionReadLimit to limit incoming WebSocket message sizes on every connection, including reconnects. The default remains unlimited; exceeding a configured limit closes the connection and triggers normal reconnect handling. With compression enabled through a custom dialer, the limit counts compressed bytes and does not bound the size after decompression.

• Block Kit: Add typed Salesforce data fields with record IDs, field metadata, label visibility, and styles. These now decode into RichTextSectionSalesforceDataFieldElement instead of RichTextSectionUnknownElement.

  [!WARNING]
  has_withheld_salesforce_field_names is based on live Slack responses and is absent from the reference and SDK models.

• Block Kit: Add typed workflow mentions with workflow and trigger IDs, display text, URLs, message locations, and styles. These now decode into RichTextSectionWorkflowMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed Work Object mentions with entity and app IDs, display text, URLs, icons, preview settings, product names, and styles. These now decode into RichTextSectionWorkObjectMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed attachment mentions with app, entity, icon, message, preview, and product metadata. These now decode into RichTextSectionAttachmentMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed rich-text tags with styles and constants for all nine colors. Tags now decode into RichTextSectionTagElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed List record references with record and view IDs, display text, URLs, and styles. These now decode into RichTextSectionListRecordElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed canvas user mentions and canvas message unfurls, including thread IDs and styles. These now decode into concrete types instead of RichTextSectionUnknownElement.

• Block Kit: Add typed canvas rich-text elements with labels, section links, title visibility, styles, and skill metadata. These now decode into RichTextSectionCanvasElement instead of RichTextSectionUnknownElement.

• Block Kit: Add RichTextSectionCitationElement with typed file, external, web, message, and memory details for rich-text citations. Preserve unknown detail variants as raw JSON. Citations now decode into this concrete type instead of RichTextSectionUnknownElement.

• Block Kit: Add typed file
  and message mention
  rich-text elements, including styles and optional metadata. These now decode into concrete
  types instead of RichTextSectionUnknownElement.

• Add image alt text, GIF, PDF, 800px and inline thumbnails, audio and transcription metadata, preview truncation, remote file identifiers, canvas and List metadata, title blocks, and sharing and app metadata to File. Preserve sharing and app metadata in RemoteFile responses.

• Block Kit: Add missing element fields for button accessibility, agent prompts, visibility, conversation selection, rich-text input sizing, and rich-text styles and metadata, including shared emoji URLs.

• Add IsShare, IsMsgUnfurl and Files to Attachment, so the files of a forwarded message are decoded rather than dropped.

• Add CreateAgentConversation and ArchiveAgentConversation (plus Context variants) for agents.conversations.create and agents.conversations.archive.

• Add SetAgentConversationCommands (plus Context variant) and Features.CodeChannels for agent slash commands.

• Add all 12 Slack Lists API methods, with Context variants and scoped options for lists, access, items, and exports.

• Block Kit: Add DataTableActionCell for buttons in data_table blocks, with an optional raw_text or raw_number fallback (#​1618).

• Add AdminAppsApprovedList and AdminAppsRestrictedList (plus Context variants) for the admin.apps.approved.list and admin.apps.restricted.list methods, with typed app, scope and pagination responses (#​1614).

• Add AdminAppsRequestsList (plus Context variant) for the admin.apps.requests.list method, with typed request and pagination responses (#​1615).

• File now unmarshals the video fields of the file object: the video thumbnail (ThumbVideo, ThumbVideoW, ThumbVideoH and ThumbVideoTimestamp) and DurationMs, HLS, HLSEmbed, HLSPreview, MediaDisplayType, MP4, MP4Low and VTT.

Fixed

• RTM: Keep reader errors scoped to their connection and stop the old reader before reconnecting, so stale errors cannot close the next connection.
• slackevents.ParseEvent returns an error for an event_callback with a missing or null inner event instead of panicking.
• Release multipart upload writers when a request fails or returns before consuming the request body.

Full Changelog: slack-go/slack@v0.30.1...v0.31.0

v0.30.1

Compare Source

[!IMPORTANT]
This is a security release. Upgrade if your app passes file URLs from messages or events to GetFile. Full details are in CHANGELOG.md.

Security

GetFile, GetFileContext and UploadToURL now send the token only to https URLs on slack.com, slack-gov.com and their subdomains, and to the host set with OptionAPIURL. Any other URL returns an error before a request is made.

The url_private of a remote or external file (File.IsExternal) points outside Slack, so GetFile(file.URLPrivate) sent the token to that host. See GHSA-3q3v-34v2-g88f.

A test that points GetFile at an httptest server must also pass that server to OptionAPIURL:

api := slack.New("xoxb-test", slack.OptionAPIURL(ts.URL+"/"))
err := api.GetFile(ts.URL+"/files-pri/T1-F1/a.txt", &buf)

Thanks to @​Lordseriouspig (what a handle... 😂) for the report.

Full Changelog: slack-go/slack@v0.30.0...v0.30.1

v0.30.0

Compare Source

[!WARNING]
This release has breaking changes. It needs Go 1.26 or later, DeleteFileComment takes its arguments in a new order, and four methods have new variadic signatures that break interfaces and mocks. Read Breaking changes before you upgrade. Full details are in CHANGELOG.md.

Breaking changes

DeleteFileComment takes (fileID, commentID)

DeleteFileComment now uses the same argument order as DeleteFileCommentContext (#​1611). Swap the arguments of every call:

// Before
err := api.DeleteFileComment(commentID, fileID)
// After
err := api.DeleteFileComment(fileID, commentID)

The compiler cannot catch this because both arguments are strings. A call that still passes a comment ID (Fc…) will return an error in order to try to catch it. YMMV so please raise an issue if you encounter issues

Variadic options on CreateManifest and GetUserInfo

CreateManifest, CreateManifestContext, GetUserInfo and GetUserInfoContext now take variadic options. An interface or mock that declares the old signature needs the new parameter:

// Before
type slackAPI interface {
      GetUserInfo(user string) (*slack.User, error)
      CreateManifest(manifest *slack.Manifest, token string) (*slack.ManifestResponse, error)
}

// After
type slackAPI interface {
      GetUserInfo(user string, options ...slack.GetUserInfoOption) (*slack.User, error)
      CreateManifest(manifest *slack.Manifest, token string, options ...slack.CreateManifestOption) (*slack.ManifestResponse, error)
}

Other

• The minimum supported Go version is now 1.26 (#​1581).
• UpdateUserGroupsParams has a new slice field, AdditionalChannels, so it can no longer be compared with == or used as a map key (#​1599).

Added

• Agent messaging events (app_context_changed, agent_session_stopped, agent_session_title_changed), AppContext on AppHomeOpenedEvent and MessageEvent, authorizations on EventsAPICallbackEvent, and SetAgentSessionStatus and RenameAgentSession for agents.sessions.* by @​rliddler in #​1607
• AppId, Credentials and OAuthAuthorizeUrl in the CreateManifest response by @​sivchari in #​1587
• Features.AgentView and Features.AssistantView app manifest settings by @​yuya-takeyama in #​1589
• More app manifest keys, so a typed export and update keeps them: Features.UnfurlDomains, Features.RichPreviews, Features.Search, OAuthConfig.PKCEEnabled, OAuthConfig.TokenManagementEnabled, Settings.IsMCPEnabled, Settings.TokenRotationEnabled, Settings.IncomingWebhooks, Settings.FunctionRuntime, Settings.SIWSLinks, EventSubscriptions.MetadataSubscriptions and OutgoingDomains by @​nlopes in #​1609, #​1610 and #​1612
• Attachment.HideColor and Block Kit TaskCardBlock.HideTitle by @​mkende in #​1590
• additional_channels and include_count options for usergroups.create and usergroups.update by @​JaiminBrahmbhatt in #​1599
• SetAppIcon for apps.icon.set by @​JaiminBrahmbhatt in #​1597
• AdminTeamsList for admin.teams.list by @​JaiminBrahmbhatt in #​1593
• AdminUsersList for admin.users.list by @​JaiminBrahmbhatt in #​1595
• New UserGroup fields: AutoProvision, ChannelCount, EnterpriseSubteamID, IsEditingRestricted, IsIDPGroup, IsMembershipLocked, IsOrgLevel, IsSection, IsSubteam and IsVisible by @​JaiminBrahmbhatt in #​1605
• GetUsersOptionIncludeLocale and GetUserInfoOptionIncludeLocale to choose whether users.list and users.info return locale by @​JaiminBrahmbhatt in #​1603 and @​nlopes in #​1613
• CreateManifestRaw, UpdateManifestRaw, ExportManifestRaw and ValidateManifestRaw, which keep manifest keys that Manifest does not model, and CreateManifestOptionTeamID by @​JaiminBrahmbhatt in #​1601

Changed

• Go 1.26 is the minimum supported version, and CI covers Go 1.26 and 1.27 by @​nlopes in #​1581
• DeleteFileComment takes (fileID, commentID) by @​nlopes in #​1611

Fixed

• Socket Mode and RTM reconnects wait at most 5 minutes between attempts, and RetryConfig.BackoffMax caps the Web API retry delay, by @​shushenghong in #​1586
• Socket Mode reconnects when the stream ends in the middle of a TLS record instead of panicking by @​shushenghong in #​1608
• GetFile returns an error when the token cannot read the file instead of saving the sign-in page by @​richardmilles in #​1582

Other

• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @​dependabot[bot] in #​1584

New Contributors

• @​rliddler made their first contribution in #​1607
• @​shushenghong made their first contribution in #​1586
• @​yuya-takeyama made their first contribution in #​1589
• @​mkende made their first contribution in #​1590
• @​JaiminBrahmbhatt made their first contribution in #​1599
• @​richardmilles made their first contribution in #​1582

Full Changelog: slack-go/slack@v0.29.0...v0.30.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.