[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/slack-go/slack	v0.29.0 → v0.30.1

---

Release Notes

slack-go/slack (github.com/slack-go/slack)

v0.30.1

Compare Source

[!IMPORTANT]
This is a security release. Upgrade if your app passes file URLs from messages or events to GetFile. Full details are in CHANGELOG.md.

Security

GetFile, GetFileContext and UploadToURL now send the token only to https URLs on slack.com, slack-gov.com and their subdomains, and to the host set with OptionAPIURL. Any other URL returns an error before a request is made.

The url_private of a remote or external file (File.IsExternal) points outside Slack, so GetFile(file.URLPrivate) sent the token to that host. See GHSA-3q3v-34v2-g88f.

A test that points GetFile at an httptest server must also pass that server to OptionAPIURL:

api := slack.New("xoxb-test", slack.OptionAPIURL(ts.URL+"/"))
err := api.GetFile(ts.URL+"/files-pri/T1-F1/a.txt", &buf)

Thanks to @​Lordseriouspig (what a handle... 😂) for the report.

Full Changelog: slack-go/slack@v0.30.0...v0.30.1

v0.30.0

Compare Source

[!WARNING]
This release has breaking changes. It needs Go 1.26 or later, DeleteFileComment takes its arguments in a new order, and four methods have new variadic signatures that break interfaces and mocks. Read Breaking changes before you upgrade. Full details are in CHANGELOG.md.

Breaking changes

DeleteFileComment takes (fileID, commentID)

DeleteFileComment now uses the same argument order as DeleteFileCommentContext (#​1611). Swap the arguments of every call:

// Before
err := api.DeleteFileComment(commentID, fileID)
// After
err := api.DeleteFileComment(fileID, commentID)

The compiler cannot catch this because both arguments are strings. A call that still passes a comment ID (Fc…) will return an error in order to try to catch it. YMMV so please raise an issue if you encounter issues

Variadic options on CreateManifest and GetUserInfo

CreateManifest, CreateManifestContext, GetUserInfo and GetUserInfoContext now take variadic options. An interface or mock that declares the old signature needs the new parameter:

// Before
type slackAPI interface {
      GetUserInfo(user string) (*slack.User, error)
      CreateManifest(manifest *slack.Manifest, token string) (*slack.ManifestResponse, error)
}

// After
type slackAPI interface {
      GetUserInfo(user string, options ...slack.GetUserInfoOption) (*slack.User, error)
      CreateManifest(manifest *slack.Manifest, token string, options ...slack.CreateManifestOption) (*slack.ManifestResponse, error)
}

Other

• The minimum supported Go version is now 1.26 (#​1581).
• UpdateUserGroupsParams has a new slice field, AdditionalChannels, so it can no longer be compared with == or used as a map key (#​1599).

Added

• Agent messaging events (app_context_changed, agent_session_stopped, agent_session_title_changed), AppContext on AppHomeOpenedEvent and MessageEvent, authorizations on EventsAPICallbackEvent, and SetAgentSessionStatus and RenameAgentSession for agents.sessions.* by @​rliddler in #​1607
• AppId, Credentials and OAuthAuthorizeUrl in the CreateManifest response by @​sivchari in #​1587
• Features.AgentView and Features.AssistantView app manifest settings by @​yuya-takeyama in #​1589
• More app manifest keys, so a typed export and update keeps them: Features.UnfurlDomains, Features.RichPreviews, Features.Search, OAuthConfig.PKCEEnabled, OAuthConfig.TokenManagementEnabled, Settings.IsMCPEnabled, Settings.TokenRotationEnabled, Settings.IncomingWebhooks, Settings.FunctionRuntime, Settings.SIWSLinks, EventSubscriptions.MetadataSubscriptions and OutgoingDomains by @​nlopes in #​1609, #​1610 and #​1612
• Attachment.HideColor and Block Kit TaskCardBlock.HideTitle by @​mkende in #​1590
• additional_channels and include_count options for usergroups.create and usergroups.update by @​JaiminBrahmbhatt in #​1599
• SetAppIcon for apps.icon.set by @​JaiminBrahmbhatt in #​1597
• AdminTeamsList for admin.teams.list by @​JaiminBrahmbhatt in #​1593
• AdminUsersList for admin.users.list by @​JaiminBrahmbhatt in #​1595
• New UserGroup fields: AutoProvision, ChannelCount, EnterpriseSubteamID, IsEditingRestricted, IsIDPGroup, IsMembershipLocked, IsOrgLevel, IsSection, IsSubteam and IsVisible by @​JaiminBrahmbhatt in #​1605
• GetUsersOptionIncludeLocale and GetUserInfoOptionIncludeLocale to choose whether users.list and users.info return locale by @​JaiminBrahmbhatt in #​1603 and @​nlopes in #​1613
• CreateManifestRaw, UpdateManifestRaw, ExportManifestRaw and ValidateManifestRaw, which keep manifest keys that Manifest does not model, and CreateManifestOptionTeamID by @​JaiminBrahmbhatt in #​1601

Changed

• Go 1.26 is the minimum supported version, and CI covers Go 1.26 and 1.27 by @​nlopes in #​1581
• DeleteFileComment takes (fileID, commentID) by @​nlopes in #​1611

Fixed

• Socket Mode and RTM reconnects wait at most 5 minutes between attempts, and RetryConfig.BackoffMax caps the Web API retry delay, by @​shushenghong in #​1586
• Socket Mode reconnects when the stream ends in the middle of a TLS record instead of panicking by @​shushenghong in #​1608
• GetFile returns an error when the token cannot read the file instead of saving the sign-in page by @​richardmilles in #​1582

Other

• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @​dependabot[bot] in #​1584

New Contributors

• @​rliddler made their first contribution in #​1607
• @​shushenghong made their first contribution in #​1586
• @​yuya-takeyama made their first contribution in #​1589
• @​mkende made their first contribution in #​1590
• @​JaiminBrahmbhatt made their first contribution in #​1599
• @​richardmilles made their first contribution in #​1582

Full Changelog: slack-go/slack@v0.29.0...v0.30.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.