[dependabot]

Bumps github.com/slack-go/slack from 0.30.1 to 0.31.0.

Release notes

Sourced from github.com/slack-go/slack's releases.

v0.31.0

Breaking changes

• ButtonBlockElement is no longer comparable because VisibleToUserIDs is a slice. Value comparisons and map keys using it no longer compile; interface comparisons containing button values can panic. Use comparable identifiers as map keys and compare button contents explicitly:

  // Before
  same := a == b
  // After (import "reflect")
  same := reflect.DeepEqual(a, b)

• If you create these structs without naming their fields, update that code. New fields were added to Block Kit elements, Attachment, File, RemoteFile and Features. Code that supplies values by position now fails to compile. Include the field names, or use the existing New... helper functions where available:

  // Before: values depend on field order.
  element := slack.RichTextSectionBroadcastElement{slack.RTSEBroadcast, "here"}
  // After: each value names its field.
  element := slack.RichTextSectionBroadcastElement{
      Type:  slack.RTSEBroadcast,
      Range: "here",
  }

• Newly supported rich-text elements decode into concrete types instead of *RichTextSectionUnknownElement. Update type assertions and switches for attachment, workflow, Work Object and message mentions; tags; canvas elements; citations; file and List record references; and Salesforce data fields.

• Request signature validation is stricter, and mismatch errors have changed. NewSecretsVerifier rejects signatures without the v0= prefix or whose decoded length is not 32 bytes. Update any test fixtures that relied on the previous permissive parsing. SecretsVerifier.Ensure returns ErrInvalidSignature on a mismatch; replace checks of the old error text with errors.Is(err, slack.ErrInvalidSignature).

• UninstallApp and RotateTokens now use POST, including their Context variants. Update mocks or custom transports that expect GET requests or credentials in the URL to accept form-encoded POST bodies.

• OptionOnWarning callbacks no longer receive the token parameter in form or query parameter maps. Update callbacks that rely on that field.

Added

• Add RTMOptionReadLimit and socketmode.OptionReadLimit to limit incoming WebSocket message sizes on every connection, including reconnects. The default remains unlimited; exceeding a configured limit closes the connection and triggers normal reconnect handling. With compression enabled through a custom dialer, the limit counts compressed bytes and does not bound the size after decompression.

• Block Kit: Add typed Salesforce data fields with record IDs, field metadata, label visibility, and styles. These now decode into RichTextSectionSalesforceDataFieldElement instead of RichTextSectionUnknownElement.

  [!WARNING] has_withheld_salesforce_field_names is based on live Slack responses and is absent from the reference and SDK models.

• Block Kit: Add typed workflow mentions with workflow and trigger IDs, display text, URLs, message locations, and styles. These now decode into RichTextSectionWorkflowMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed Work Object mentions with entity and app IDs, display text, URLs, icons, preview settings, product names, and styles. These now decode into RichTextSectionWorkObjectMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed attachment mentions with app, entity, icon, message, preview, and product metadata. These now decode into RichTextSectionAttachmentMentionElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed rich-text tags with styles and constants for all nine colors. Tags now decode into RichTextSectionTagElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed List record references with record and view IDs, display text, URLs, and styles. These now decode into RichTextSectionListRecordElement instead of RichTextSectionUnknownElement.

• Block Kit: Add typed canvas user mentions and canvas message unfurls, including thread IDs and styles. These now decode into concrete types instead of RichTextSectionUnknownElement.

... (truncated)

Changelog

Sourced from github.com/slack-go/slack's changelog.

[0.31.0] - 2026-10-26

Breaking changes

• ButtonBlockElement is no longer comparable because VisibleToUserIDs is a slice. Value comparisons and map keys using it no longer compile; interface comparisons containing button values can panic. Use comparable identifiers as map keys and compare button contents explicitly:

  // Before
  same := a == b
  // After (import "reflect")
  same := reflect.DeepEqual(a, b)

• If you create these structs without naming their fields, update that code. New fields were added to Block Kit elements, Attachment, File, RemoteFile and Features. Code that supplies values by position now fails to compile. Include the field names, or use the existing New... helper functions where available:

  // Before: values depend on field order.
  element := slack.RichTextSectionBroadcastElement{slack.RTSEBroadcast, "here"}
  // After: each value names its field.
  element := slack.RichTextSectionBroadcastElement{
      Type:  slack.RTSEBroadcast,
      Range: "here",
  }

• Newly supported rich-text elements decode into concrete types instead of *RichTextSectionUnknownElement. Update type assertions and switches for attachment, workflow, Work Object and message mentions; tags; canvas elements; citations; file and List record references; and Salesforce data fields.

• Request signature validation is stricter, and mismatch errors have changed. NewSecretsVerifier rejects signatures without the v0= prefix or whose decoded length is not 32 bytes. Update any test fixtures that relied on the previous permissive parsing. SecretsVerifier.Ensure returns ErrInvalidSignature on a mismatch; replace checks of the old error text with errors.Is(err, slack.ErrInvalidSignature).

• UninstallApp and RotateTokens now use POST, including their Context variants. Update mocks or custom transports that expect GET requests or credentials in the URL to accept form-encoded POST bodies.

• OptionOnWarning callbacks no longer receive the token parameter in form or query parameter maps. Update callbacks that rely on that field.

Security

• SecretsVerifier.Ensure now returns ErrInvalidSignature on a signature mismatch without including the computed signature in the error. Debug logs include only short

... (truncated)

Commits

• 50bf75c chore: prepare v0.31.0 release
• c0aa2b5 docs: require event registry configuration before parsing
• 06d0ccd feat(websocket): add optional read limits
• 9da7b3f ci: add security checks and private vulnerability reporting
• fee045f Refine guidelines for opening pull requests
• 6f14931 fix(security): redact Socket Mode credentials from debug logs
• 278f45a fix(security): keep credentials out of request URLs
• 77e5e63 fix(security): enforce signature version and harden token comparison
• 4b85ee0 fix(upload): release multipart writers on request failure
• 90e3341 docs(socketmode): require registration before the event loop
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)