@slack/[email protected]

What's Changed

This release adds the allowAbsoluteUrls option to the WebClient constructor.

For code using dynamic method names with .apiCall, this will toggle if requests should be sent to absolute URLs provided:

const { WebClient } = require('@slack/web-api');

const web = new WebClient(token, {
  allowAbsoluteUrls: false, // Default: true
});

const _response = await web.apiCall('https://example.com', { /* ... */ });

$ node index.js
[DEBUG]  web-api:WebClient:0 http request url: https://slack.com/api/https://example.com
...
[WARN]  web-api:WebClient:0 http request failed An HTTP protocol error occurred: statusCode = 404

The default allowAbsoluteUrls value is true to avoid a breaking change with this update, but we suggest deciding if this option should be applied to scripts and adjacent code.

Enhancements 🎉

• feat(web-api): add configs to toggle absolute url usage in dynamic api calls in #2176 - Thanks @zimeg!

Maintenance 🧰

• fix(web-api): bump axios to 1.8.3 to address CVE-2025-27152 in #2172 - Thanks @zimeg!

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]
Milestone: https://github.com/slackapi/node-slack-sdk/milestone/131

@slack/[email protected]

What's Changed

This patch release updates the axios dependency used to send webhooks with internal bug fixes.

• fix(webhook): bump axios to 1.8.3 to address CVE-2025-27152 by @zimeg in #2173

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]..@slack/[email protected]
Milestone: https://github.com/slackapi/node-slack-sdk/milestone/130

@slack/[email protected]

What's Changed

The slack run command now exits with the error code returned from the start hook and Node warnings were returned to verbose outputs:

$ slack run --verbose
...
[DEBUG]  web-api:WebClient:0 initialized
...
AppInitializationError: You must provide an appToken when socketMode is set to true. To generate an appToken see: https://api.slack.com/apis/connections/socket#token
...

🚫 The 'start' hook exited with an error (sdk_hook_invocation_failed)
   exit status 1 (local_app_run_error)

$ echo $?
1

🎉 Enhancements

• feat(cli-hooks): output node warnings to stderr for debugging outputs in #2152 - Thanks @zimeg!
• feat(cli-hooks): exit the start process with the subprocess exit code in #2153 - Thanks @zimeg!

🧰 Maintenance

• chore(cli-hooks): release @slack/[email protected] in #2154 - Thanks @zimeg!

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]
Milestone: https://github.com/slackapi/node-slack-sdk/milestone/101?closed=1

@slack/[email protected]+cli.2.32.2

What's Changed

👋 This release adds SLACK_TRACE constants for the env subcommands and introduces a global verbose option that can be passed to all commands for logging and parsing debug outputs:

    const output = await SlackCLI.env.add({
      appPath,
      team,
      secretKey: 'EXAMPLE_VARIABLE_NAME',
      secretValue: 'super-secret-value',
+     verbose: true
    });

+   expect(output).toContain(SlackTracerId.SLACK_TRACE_ENV_ADD_SUCCESS);

🎁 Enhancements

• feat(cli-test): include expected test trace outputs for the "env" subcommands in #2097 - thanks @zimeg!
• feat(cli-test): update traces for env to SLACK_TRACE_ENV_ in #2136 - thanks @mwbrooks!
• feat(cli-test): include a verbose global option for cli commands in #2147 - thanks @zimeg!

🐛 Fixes

• fix(cli-test): remove the trailing newline from parsed cli outputs in #2148 - thanks @zimeg!

⚙️ Maintenance

• chore(cli-test): release @slack/[email protected]+cli2.32.2 in #2149 - thanks @zimeg!

🧰 Dependencies

• chore(deps-dev): bump typescript from 5.7.2 to 5.7.3 in /packages/cli-test in #2134 - thanks @dependabot!

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]+cli.2.32.2

@slack/[email protected]

What's Changed

• chore(deps-dev): bump typescript from 5.5.4 to 5.7.2 in /packages/socket-mode by @dependabot in #2102
• chore(deps-dev): bump mocha from 10.8.2 to 11.0.1 in /packages/socket-mode in the dev-mocha group by @dependabot in #2114
• socket-mode: Handling WS errors during handshake by @filmaj in #2099
• Update webhook and web-api dependencies in oauth, rtm-api, and socket-mode by @hello-ashleyintech in #2119
• Release: @slack/[email protected], @slack/[email protected], @slack/[email protected] by @hello-ashleyintech in #2120

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]

@slack/[email protected]

What's Changed

• socket-mode: Handling WS errors during handshake by @filmaj in #2099
• Update webhook and web-api dependencies in oauth, rtm-api, and socket-mode by @hello-ashleyintech in #2119
• Release: @slack/[email protected], @slack/[email protected], @slack/[email protected] by @hello-ashleyintech in #2120

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]

@slack/[email protected]

What's Changed

• chore(deps-dev): bump sinon from 17.0.2 to 18.0.0 in /packages/oauth in the dev-sinon group by @dependabot in #1983
• chore(deps-dev): bump c8 from 9.1.0 to 10.1.2 in /packages/oauth by @dependabot in #2001
• chore(deps-dev): bump typescript from 5.3.3 to 5.5.4 in /packages/oauth by @dependabot in #2003
• chore(deps-dev): bump sinon from 18.0.1 to 19.0.2 in /packages/oauth in the dev-sinon group by @dependabot in #2031
• Publish @slack/[email protected] by @misscoded in #2035
• Publish @slack/[email protected] by @misscoded in #2036
• oauth(docs): replace hardcoded state secrets with process env variables by @zimeg in #2039
• oauth(fix): remove double quotes from the default 'add to slack' img alt text by @zimeg in #2044
• chore(deps-dev): bump @types/chai from 4.3.20 to 5.0.0 in /packages/oauth in the dev-chai group by @dependabot in #2047
• Revert "chore(deps-dev): bump @types/chai from 4.3.20 to 5.0.0 in /packages/oauth in the dev-chai group" by @hello-ashleyintech in #2052
• chore(deps-dev): bump typescript from 5.5.4 to 5.7.2 in /packages/oauth by @dependabot in #2104
• chore(deps-dev): bump mocha from 10.8.2 to 11.0.1 in /packages/oauth in the dev-mocha group by @dependabot in #2113
• Update webhook and web-api dependencies in oauth, rtm-api, and socket-mode by @hello-ashleyintech in #2119
• Release: @slack/[email protected], @slack/[email protected], @slack/[email protected] by @hello-ashleyintech in #2120

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]

@slack/[email protected]

What's Changed

• chore(deps): bump minimum axios version for web-api and webhook to avoid security vuln by @hello-ashleyintech in #2116
• ci: check for changes to lints separate from writing changes by @zimeg in #2117
• chore: tsconfig skiplibcheck:true - dont typecheck dependency d.ts files #1913 - thanks @filmaj!
• chore: remove eslint, use biome instead in #2006 - thanks @filmaj!
• Release: @slack/[email protected], @slack/[email protected] by @hello-ashleyintech in #2118

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]

@slack/[email protected]

What's Changed

• chore(deps-dev): bump mocha from 10.8.2 to 11.0.1 in /packages/web-api in the dev-mocha group across 1 directory by @dependabot in #2109
• chore(deps): bump minimum axios version for web-api and webhook to avoid security vuln by @hello-ashleyintech in #2116
• ci: check for changes to lints separate from writing changes by @zimeg in #2117
• Release: @slack/[email protected], @slack/[email protected] by @hello-ashleyintech in #2118
• ci: add windows testing to CI by lifting OS into its own test matrix in #2081 - thanks @filmaj!
• feat(web-api): generate Web API response types in #2033 - thanks @misscoded!
• Revert "feat(web-api): add new is_send_allowed optional parameter to assistant.threads.setStatus method" in #2080 - thanks @misscoded!
• feat(web-api): add new is_send_allowed optional parameter to assistant.threads.setStatus method in #2079 - thanks @misscoded!

Full Changelog: https://github.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected]

@slack/[email protected]

What's Changed

This pre-release contains the fix put together in #2099 for issue #2094. Recently, Slack's real-time backend server serving socket-mode connections rolled out a configuration change that unfortunately resulted in many apps seeing error responses (HTTP 409) while establishing a WebSocket connection. This scenario uncovered a catastrophic bug in this socket-mode library: most Bolt JS-based apps would have socket mode connection retries turned on, and this in combination with connection handshake error scenarios caused the library to enter a spiral where it would double the number of WS connections on each retry attempt.

This pre-release provides access to a proposed fix for this issue. We welcome all feedback from the community!