[dependabot]

Bumps github.com/slack-go/slack from 0.32.0 to 0.35.0.

Release notes

Sourced from github.com/slack-go/slack's releases.

v0.35.0

This release fixes interaction payload spoofing, preserves huddle profile data, and corrects several message handling and 32-bit compatibility issues.

Upgrade notes

[!WARNING] slackevents.Profile has three new fields. Positional struct literals no longer compile. Convert them to keyed literals before upgrading.

Events API profiles now preserve huddle state, expiration, and call ID through HuddleState, HuddleStateExpirationTS, and HuddleStateCallID.

Use field names when constructing profiles:

profile := slackevents.Profile{
    DisplayName: "Alex",
    Team:        "T123ABC456",
}

Security

InteractionCallbackParse now reads payload exclusively from the form-encoded request body.

Previously, it could accept an unsigned URL query payload while the application verified a signature covering only the body. An attacker who obtained a valid signed request within the accepted timestamp window could replay it with a forged interaction payload.

Callers must supply payload in an application/x-www-form-urlencoded request body. Form parsing errors are now returned to the caller.

See GHSA-pj2x-fjjr-q84c. Thanks to @​jjiang-stripe for reporting the issue and providing the fix.

Fixes

• Prevent repeated escaping and data races when reusing a MsgOptionText option.
• Encode context block elements correctly when a block is passed by value.
• Preserve plus signs and percent signs in slacktest message blocks and attachments.
• Keep slacktest bot identities independent when generating RTM connection information.
• Prevent retry jitter panics with large durations on 32-bit platforms.
• Decode JSONTime timestamps outside the 32-bit integer range on 32-bit platforms.

Full changelog: v0.34.0…v0.35.0

v0.34.0

Huge thank you to Michal Mazurek (@​akfaew) for submitting a bunch of patches for this release.

Breaking changes — read before upgrading

[!WARNING] v0.34.0 includes breaking API, decoding, serialization, and event-dispatch changes.

**Your code may fail to compile. Code that still compiles may decode, serialize,

... (truncated)

Changelog

Sourced from github.com/slack-go/slack's changelog.

[0.35.0] - 2026-11-05

A big thank you to @​jjiang-stripe for the security find and fix!

Breaking changes (but mostly shouldn't affect anyone)

[!WARNING] slackevents.Profile now includes three huddle fields. Positional struct literals no longer compile. Use keyed literals when constructing a profile:

profile := slackevents.Profile{
  DisplayName: "Alex",
  Team:        "T123ABC456",
}

Security

• InteractionCallbackParse no longer falls back to the URL query string for the payload field. A request's signature only covers its POST body, so the fallback let a validly-signed request be replayed with an attacker-controlled payload smuggled in via the query string. Callers must supply payload in an application/x-www-form-urlencoded request body. Form parsing errors are now returned to the caller.

Fixed

• Prevent repeated escaping and data races when reusing a MsgOptionText option.
• Preserve plus signs and percent signs in slacktest message blocks and attachments.
• Encode context block elements as an array when a block is passed by value.
• Keep slacktest bot identities independent when generating RTM connection information.
• Preserve huddle state, expiration, and call ID in Events API user profiles as slackevents.Profile.HuddleState, HuddleStateExpirationTS, and HuddleStateCallID. These fields follow Slack's documented user_huddle_changed payload.
• Fix retry jitter panics for large durations on 32-bit platforms.
• Decode JSONTime timestamps outside the 32-bit integer range on 32-bit platforms.

[0.34.0] - 2026-11-03

Huge thank you to Michal Mazurek (@​akfaew) for submitting a bunch of patches for this release.

Breaking changes — read before upgrading

[!WARNING] v0.34.0 includes breaking API, decoding, serialization, and event-dispatch changes.

**Your code may fail to compile. Code that still compiles may decode, serialize,

... (truncated)

Commits

• 819557b chore: bump to v0.35.0
• ab47cab Merge commit from fork
• 5dde801 fix(block): marshal context elements from values (#1706)
• 0b8dc72 test(chat): cover text option reuse
• 5592f9f fix(chat): keep text options safe to reuse (#1703)
• 2ee8147 refactor: share reaction item decoding (#1700)
• b80941d refactor: simplify block decoder dispatch (#1697)
• 11eb9d3 refactor: decode block values directly (#1699)
• 68d04de fix(slacktest): decode message form fields once (#1705)
• f9a7a78 refactor: reuse standard response methods for kicks (#1701)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)