Skip to content

Update module github.com/slack-go/slack to v0.23.1 [SECURITY] - #313

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-slack-go-slack-vulnerability
Open

Update module github.com/slack-go/slack to v0.23.1 [SECURITY]#313
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-slack-go-slack-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 13, 2026

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/slack-go/slack v0.13.1 → v0.23.1 age confidence

slack-go SecretsVerifier accepts empty signing secret without precondition

GHSA-gxhx-2686-5h9g

More information

Details

SecretsVerifier in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty SLACK_SIGNING_SECRET), NewSecretsVerifier builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid X-Slack-Signature and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with ErrInvalidConfiguration. This is patched in version 0.23.1.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

slack-go/slack (github.com/slack-go/slack)

v0.23.1

Compare Source

[!IMPORTANT]
Even though this is a [security] patch release, if you were using an empty secret, this is a breaking change due to a change in behaviour. That's on purpose, to ensure you fix your approach so that there are no footguns.

Fixed
  • NewSecretsVerifier now rejects empty signing secrets to avoid accepting forged request
    signatures when applications are misconfigured.

Full Changelog: slack-go/slack@v0.23.0...v0.23.1

v0.23.0

Compare Source

Added

New Contributors

Full Changelog: slack-go/slack@v0.22.0...v0.23.0

v0.22.0

Compare Source

What's Changed

Added
  • OAuth PKCE support - OAuthOptionCodeVerifier option for GetOAuthV2Response, plus GenerateCodeVerifier() and GenerateCodeChallenge() helpers (RFC 7636). client_secret is now conditionally omitted when empty in both GetOAuthV2ResponseContext and RefreshOAuthV2TokenContext.
  • Manifest scope fields - BotOptional and UserOptional on OAuthScopes.
  • Rich text styles - Underline, Highlight, ClientHighlight, and Unlink on RichTextSectionTextStyle. Style field on RichTextSectionUserGroupElement.
  • Assistant search context - Sort, SortDir, Before, After, Highlight, IncludeContextMessages, IncludeDeletedUsers, IncludeMessageBlocks, IncludeArchivedChannels, DisableSemanticSearch, Modifiers, TermClauses parameters and new response types (AssistantSearchContextFile, AssistantSearchContextChannel, AssistantSearchContextMessageContext).
Fixed
  • socketmode: malformed JSON no longer forces reconnect - json.SyntaxError and json.UnmarshalTypeError now emit an EventTypeIncomingError event and continue reading instead of killing the WebSocket connection.
  • socketmode: debug_reconnects query param applied correctly - the parameter was silently discarded due to a missing url.RawQuery assignment.
  • ChannelTypes and ContentTypes now send comma-separated values instead of repeated form keys, matching the convention used by every other method in the library.
Docs
  • assistant:write scope marked as deprecated in favour of chat:write.

Full Changelog: v0.21.1...v0.22.0

v0.21.1

Compare Source

v0.21.1

Added
  • MessageEvent channel type helpers — New ChannelTypeChannel, ChannelTypeGroup,
    ChannelTypeIM, and ChannelTypeMPIM constants plus IsChannel(), IsGroup(), IsIM(), and
    IsMpIM() convenience methods on MessageEvent. No more comparing raw strings to figure out where a
    message came from:
if ev.IsIM() {
    // handle direct message
}
Fixed
  • MessageEvent doc typo — ChannelType documentation listed "mim" instead of the correct "mpim".
  • Duplicate attachment/block serialization — MsgOptionAttachments and MsgOptionBlocks were serializing
    payloads twice (once for the response-URL JSON path, once for the form POST path). Serialization now
    happens once inside formSender.BuildRequestContext. (#​1547)

[!NOTE]
UnsafeApplyMsgOptions no longer includes attachments/blocks keys in the returned values, since marshalling is deferred to send time. This function is documented as unsupported.

v0.21.0

Compare Source

[!WARNING]
This release contains multiple breaking changes. Please review the sections below before upgrading.

Breaking changes

Removed APIs
  • IM struct removed — Use Conversation instead. IsUserDeleted has been moved there.
  • Info.GetBotByID, GetUserByID, GetChannelByID, GetGroupByID, GetIMByID removed — These were deprecated and returned nil unconditionally. Remove any calls to them.
Signature changes

  • ListReactions now uses cursor-based pagination — Returns ([]ReactedItem, string, error) instead of ([]ReactedItem, *Paging, error). ListReactionsParameters replaces Count/Page with Cursor/Limit.

    // Before
items, paging, err := api.ListReactions(params)
// After
items, nextCursor, err := api.ListReactions(params)

  • ListStars/GetStarred now use cursor-based pagination — Same pattern: returns string (next cursor) instead of *Paging. StarsParameters replaces Count/Page with Cursor/Limit.

  • GetAccessLogs now uses cursor-based pagination — Same pattern: returns string (next cursor) instead of *Paging. AccessLogParameters replaces Count/Page with Cursor/Limit.

  • Ack() and Send() now return error (Socket Mode) — Large payloads (≥20KB) that Slack silently dropped are now rejected with an error. Existing call sites that ignore the return value still compile.

Type changes

  • WebhookMessage.UnfurlLinks / UnfurlMedia → *bool — Required to distinguish "omit" from "false".

    // Before
msg := slack.WebhookMessage{UnfurlLinks: true}
// After
t := true
msg := slack.WebhookMessage{UnfurlLinks: &t}

  • User.Has2FA → *bool — nil means absent/unknown (bot tokens), false means explicitly disabled.

Behavior changes
  • MsgOptionBlocks() with no arguments now sends blocks=[] — Previously a silent no-op. If you relied on that, remove the option entirely.
  • admin error strings now start with lowercase — If you match error content in your code, update your comparisons.

Added

  • admin.teams.settings.* API support — Full suite: AdminTeamsSettingsInfo, SetDefaultChannels, SetDescription, SetDiscoverability, SetIcon, SetName ([#​960])
  • BlockFromJSON / MustBlockFromJSON — Create blocks from raw JSON strings, enabling direct use of output from Slack's Block Kit Builder ([#​1497])
  • GetOpenIDConnectUserInfo — Returns identity info via openid.connect.userInfo ([#​967])
  • OAuthOptionAPIURL for package-level OAuth functions — Override the Slack API URL for testing ([#​744])
  • HTTP response headers — Access Slack response headers (X-OAuth-Scopes, X-Ratelimit-*, etc.) via OptionOnResponseHeaders callback ([#​1076])
  • API warning callbacks — Register OptionWarnings(func(warnings []string)) to receive Slack deprecation notices ([#​1540])
  • DNDOptionTeamID — Pass team_id to GetDNDInfo/GetDNDTeamInfo, required after workspace migration ([#​1157])
  • UpdateUserGroupMembersList — Accepts []string instead of comma-separated string ([#​1172])
  • SetUserProfile — Set multiple profile fields in a single API call ([#​1158])
  • RTM events — user_status_changed, user_huddle_changed, user_profile_changed, sh_room_join, sh_room_leave, sh_room_update, channel_updated ([#​1541], [#​858])
  • Socket Mode handlers — HandleShortcut, HandleViewSubmission, HandleViewClosed for Level 3 dispatch by CallbackID ([#​1161])
  • New fields — Username on User ([#​1218]), Blocks/Attachments/Files/Upload on AppMentionEvent ([#​961]), Blocks on MessageEvent ([#​1257]), IsConnectorBot/IsWorkflowBot on User, GuestInvitedBy on UserProfile, CacheTS/EventTS on UserChangeEvent

Fixed

  • UnknownBlock round-trip data loss — Unrecognized block types now preserve their full JSON through unmarshal/marshal cycles
  • WorkflowButtonBlockElement missing from UnmarshalJSON — Plus missing multi_*_select and file_input cases ([#​1539])
  • NewBlockHeader nil pointer dereference — Passing a nil text object no longer panics ([#​1236])
  • ValidateUniqueBlockID false positives — Empty block_id strings no longer flagged as duplicates ([#​1184])
  • Socket Mode: large Ack payloads silently failing — Now uses 32KB write buffer and rejects payloads ≥20KB with an error ([#​1196])

Deprecated

  • slackevents.ParseActionEvent — Cannot parse block_actions. Use slack.InteractionCallback with json.Unmarshal instead ([#​596])
  • slackevents.MessageAction, MessageActionEntity, MessageActionResponse — Legacy interactive_message types only

Full Changelog: slack-go/slack@v0.20.0...v0.21.0

v0.20.0

Compare Source

[!WARNING]
trigger_id and workflow_id are NOT in any documentation or in any of the official
libraries, so exercise caution if you use these.

Added

  • workflow_id and trigger_id in Message — It seems that some types of messages,
    e.g: bot_message, can carry trigger_id and workflow_id. WorkflowID was added by @​clayallsopp in #​1537
  • RichTextQuote.Border field — optional border toggle (matches the docs now)
  • RichTextPreformatted.Language field — enables syntax highlighting for preformatted
    blocks

Fixed

  • Remove embedding of RichTextSection — RichTextQuote and RichTextPreformatted
    are now flattened as they should have always been. This is a breaking change for anyone
    using these structs directly.

New Contributors

Full Changelog: slack-go/slack@v0.19.0...v0.20.0

v0.19.0

Compare Source

Added

Full Changelog: slack-go/slack@v0.18.0...v0.19.0

v0.18.0

Compare Source

This is the first stable release in the 0.18.x series — it includes everything from rc1 and rc2 plus a handful of new features and fixes that landed since.

There are a few breaking changes in this one. I tried to keep them to the minimum necessary but some were long overdue. Here's what you need to know.

Breaking changes

File upload API cleanup (#​1481)

Slack discontinued the old files.upload API back in November 2025, so we finally removed the deprecated UploadFile, UploadFileContext, and FileUploadParameters. The V2 variants have been renamed to drop the suffix:

  • UploadFileV2 → UploadFile
  • UploadFileV2Context → UploadFileContext
  • UploadFileV2Parameters → UploadFileParameters

Should be a quick search-and-replace for most codebases.

GetReactions return type (#​1480)

GetReactions now returns ReactedItem instead of []ItemReaction. This aligns with what the Slack API actually returns — the item itself (message, file, or file_comment) alongside its reactions. To migrate, use resp.Reactions to get at the slice.

Settings pointer fields (#​1461)

Settings.Interactivity and Settings.EventSubscriptions are now pointers so they can be properly omitted when empty. You'll need nil checks if you're accessing these directly.

Minimum Go version is now 1.25

Up from 1.22 in v0.17.x. The go.mod directive is go 1.25.

Added

  • Admin Conversations API — Full admin.conversations.* support: core operations, bulk operations, preferences, retention, restrict access, and EKM channel info. (#​1329)
  • admin.roles.* API methods — listAssignments, addAssignments, and removeAssignments. (#​1520)
  • Chat Streaming API — Real-time chat streaming with example usage. (#​1506)
  • Data Access API — Full support with example implementation. (#​1439)
  • Work Objects — Chat unfurl with Work Object metadata, entity details (flexpane), entity_details_requested event, and associated types. (#​1529)
  • Huddle support — HuddleRoom, HuddleParticipantEvent, and HuddleRecording types for huddle events.
  • Table blocks — Parse and create table blocks. (#​1490, #​1511)
  • Context actions block — context_actions block type. (#​1495)
  • Workflow button — workflow_button block element. (#​1499)
  • Call block data — CallBlock now includes full call data. (#​897)
  • Cursor-based GetUsers pagination (#​1465)
  • GetAllConversations with pagination — Automatic pagination with rate limit handling. (#​1463)
  • focus_on_load for remaining block elements — selects, multi-selects, datepicker, timepicker, plain_text_input, checkboxes, radio_buttons, number_input. (#​1519)
  • Missing User/UserProfile/EnterpriseUser fields — who_can_share_contact_card, always_active, pronouns, image_1024, and more. (#​1526)
  • PlainText/PreviewPlainText on File — Email file objects now include plain text body fields. (#​1522)
  • Attachment image fields — ImageBytes, ImageHeight, ImageWidth. (#​1516)
  • RecordChannel conversation property (#​1513)
  • Title for CreateChannelCanvas (#​1483)
  • loading_messages for SetAssistantThreadsStatus (#​1489)
  • PostEphemeral handler for slacktest (#​1517)
  • PreviewImageName for remote files
  • Audit Logs example (#​1144)

Fixed

  • File upload error wrapping — UploadFile now tells you which of the three upload steps failed. (#​1491)
  • Audit Logs API endpoint — GetAuditLogs was hitting the wrong endpoint; now uses api.slack.com. Added OptionAuditAPIURL for testing. (#​1144)
  • Socket mode dial debugging — Debug logging for custom dialer failures. Helps with proxy/TLS issues. (#​1360)
  • MsgOptionPostMessageParameters metadata — Was silently dropping MetaData. (#​1343)
  • UserProfile.Skype JSON tag — Fixed typo "skyp" → "skype". (#​1524)
  • assistant.threads.setSuggestedPrompts title — Now actually sent when non-empty. (#​1528)
  • PublishView empty hash — No longer sends empty hash in payload. (#​1515)
  • ImageBlockElement validation — Properly validates imageURL or SlackFile. (#​1488)
  • Rich text section channel return (#​1472)
  • KickUserFromConversation error handling — Errors now parsed as a map. (#​1471)

Changed

  • CI test matrix: dropped Go 1.24, added Go 1.26; bumped golangci-lint to v2.10.1. (#​1530)

Full Changelog: slack-go/slack@v0.17.3...v0.18.0

v0.17.3

Compare Source

Previous release. See GitHub releases
for details.

v0.17.2

Compare Source

Features added

New Contributors

Full Changelog: slack-go/slack@v0.17.1...v0.17.2

v0.17.1

Compare Source

This has the potential to be a breaking change if and only if you have been building SlackResponse by hand, which you shouldn't 😬. If you are, my apologies for adding this in a minor version, I thought the likelihood of this to be very very low. See #​1443 for more details.

Features added

  • Add channel_unshared event by @​nlopes in #​1437
  • Add missing Blocks to UploadFileContextV2 by @​dalyndalton in #​1435
    This adds the missing optional dependency for Blocks to the upload file method, allowing users to use rich blocks and buttons during the file upload process.
  • Return Errors field in SlackErrorResponse by @​nlopes in #​1443

Detailed list of all of the changes

New Contributors

Full Changelog: slack-go/slack@v0.17.0...v0.17.1

v0.17.0

Compare Source

MAJOR BREAKING CHANGES

This release has a few major breaking changes. And a couple require developers to pay a bit of attention, else their programs will break.
I am sorry this is the case but such is life sometimes.

See below for the most important, and trickier breaking changes.

Breaking changes
  • Fix message event struct by @​paprikati in #​1391 and #​1408
    Our MessageEvent has been quite wrong for a while. This should fix it but it does mean folks will have to change their code to cope with this new structure. Please be extra vigilant in areas of your code that uses MessageEvent.
  • Function execution events now correctly accept interfaces not strings by @​ProjectBarks in #​1357
    FunctionExecutedEvent had Inputs set as map[string]string but that didn't allow enough flexibility - that has been changed to map[string]interface.
  • Allow emoji value in plain text blocks to be null by @​calebmckay in #​1354
    The Emoji field in TextBlockObject is now a pointer to ensure we can make a distinction between nil and false. Only affects when unmarshalling.
  • Remove Legacy Workflows by @​lorenzoaiello in #​1350
    Slack has deprecated legacy workflows for a long time, and beginning September 26, 2024, Slack stopped executing workflows containing a "step from app." See more at https://api.slack.com/changelog/2023-08-workflow-steps-from-apps-step-back.
  • Implement PublishViewContext to keep hash optional by @​ishitamundhra in #​1322
    PublishViewContext() now requires people to pass a PublishViewContextRequest which became a public type. If you call PublishViewContext() in your code, please adjust accordingly.
  • Renamed AltText to AltTxt and SnippetText to SnippetType (in GetUploadURLExternalParameters and UploadFileV2Parameters) by @​nlopes in #​1422
  • AppHomeOpenedEvent View is now a pointer by @​nlopes in #​1424
    This provides slightly better ergonomics in the case when there's no view yet.

Features added

Fixes

Detailed list of all of the changes

New Contributors

Full Changelog: slack-go/slack@v0.16.0...v0.17.0

v0.16.0

Compare Source

[!WARNING]
This release may mean a breaking change! Read below for more although for most folks this should all be fine.

👋 Hi folks,

I've tried my best to keep this version to just non-breaking changes but there are a couple of changes that might introduce breaking changes in rare circumstances.

If you're upgrading, please pay special attention to:

If you were using only what we provide in the library, this is a non-breaking change, but if not, it may be considered a breaking change.

Next release will likely bring a few required breaking changes (hard deprecations for example).

Thank you to everyone that contributed to this release 🥳

What's Changed

New Contributors

Full Changelog: slack-go/slack@v0.15.0...v0.16.0

v0.15.0

Compare Source

[!WARNING]
This release includes a breaking change since the last release.

What's Changed

v0.15.0 is now available. It does contain minor breaking changes to two Block Kit elements along with a lot of new functionality.

Breaking Changes

Block Kit - Rich Text Section Date Element

If you are using the RichTextSectionDateElement block kit element, there is a new field Format which is now required. It previously did not exist, but was marked as required in the Block Kit Documentation. Similarly, the function NewRichTextSectionDateElement function signature has been updated to require the new parameter. While this may not have previously w

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested review from Danielius1922 and jkralik October 13, 2026 17:03
@renovate

renovate Bot commented Oct 13, 2026

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.22.5 -> 1.25
github.com/stretchr/testify v1.9.0 -> v1.11.1

@coderabbitai

coderabbitai Bot commented Oct 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 21fcd46f-705a-4466-b349-bbbc1b79de0d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Danielius1922 Danielius1922 Awaiting requested review from Danielius1922
@jkralik jkralik Awaiting requested review from jkralik

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants