chore(deps): bump @slack/bolt from 4.7.3 to 5.1.0

[dependabot]

Bumps @slack/bolt from 4.7.3 to 5.1.0.

Changelog

Sourced from @​slack/bolt's changelog.

5.1.0

Minor Changes

• 6cf7b0c: Enforce a configurable request body size limit in HTTPReceiver and ExpressReceiver to prevent unauthenticated large-body denial-of-service attempts. Both receivers previously buffered the entire request body into memory before signature verification, so a flood of large invalid requests could exhaust memory and crash a publicly exposed app.

  Both receivers now reject request bodies larger than a new bodyLimit option with an HTTP 413 response before the whole body is buffered. The limit is enforced on the bytes actually received (not the Content-Length header, which a client controls) and applies even when signatureVerification is false. It defaults to 4194304 (4 MB); pass a different number of bytes, a bytes-style string like '4mb', or Infinity to disable it (not recommended in production).

  This is a security fix with a minor behavioral change: requests with bodies larger than 4 MB are now rejected with 413 by default (previously unbounded). Apps that legitimately receive larger payloads can raise bodyLimit on the receiver.

Patch Changes

• b9acd4f: Fix AwsEventV1.multiValueQueryStringParameters to allow null, matching the actual AWS API Gateway payload and the @types/aws-lambda APIGatewayProxyEvent type. This resolves the type error when passing an APIGatewayProxyEvent directly to the handler returned by AwsLambdaReceiver.

5.0.0

Major Changes

• d284e69: Drop Node.js 18 support. The minimum required runtime is now Node.js 20 (npm >=9.6.4).

• d284e69: Remove deprecated WorkflowStep class and all associated types, middleware, and utilities. Use CustomFunction and app.function() instead.

• d284e69: Replace axios with native fetch for response_url calls. Remove agent and clientTls options from AppOptions — use clientOptions.fetch to provide a custom fetch implementation for proxy/TLS needs. Add a dispatcher option to SocketModeReceiver for proxy/TLS configuration in socket mode.

  respond() now throws a RespondError when the response_url request returns a non-2xx status (restoring the throw-on-failure behavior that axios provided) and resolves to a Response on success rather than an axios response object.

Minor Changes

• d284e69: Improve error handling by leveraging @slack/web-api v8 error classes. Authorization errors are now properly wrapped in an AuthorizationError, preserving the original thrown value (non-Error rejections are retained via the cause of the wrapped original). Default error handlers log richer details for web-api errors (API error codes, rate limit durations, HTTP status codes) alongside the full error object, so stack traces and causes remain available. The @slack/web-api error classes (SlackError, WebAPIPlatformError, WebAPIRequestError, WebAPIHTTPError, WebAPIRateLimitedError) can be imported from @slack/web-api for instanceof checks.

Patch Changes

• 9839a50: Pass the App's named bolt-app ConsoleLogger to the default receivers when no logger option is provided. Previously the App constructor built a named logger on this.logger but threaded the raw (potentially undefined) constructor argument into initReceiver, so HTTPReceiver / SocketModeReceiver each built their own anonymous logger and receiver-side log lines (e.g. unhandled HTTP requests on custom routes) appeared without the bolt-app prefix.

  Behaviour change for the no-logger case: the default receiver now shares the same Logger instance as app.logger, so a downstream app.logger.setLevel(...) after construction will affect receiver-side logging too. This is consistent with the existing behaviour that already mutates this.logger's level via the logLevel constructor option. Apps that supplied their own logger are unaffected; apps that relied on the receiver's logger being independent of app.logger will need to pass a separate logger into the receiver explicitly.

• e1c21d7: Fix AwsLambdaReceiver.toHandler() so Bolt apps on the AWS Lambda Node.js 24+ runtime no longer fail at startup with Runtime.CallbackHandlerDeprecated. The returned handler is now a 2-arg promise-based function; the unused trailing callback parameter has been removed from the AwsHandler type. The legacy AwsCallback export is retained and marked @deprecated.

• f2de079: Add context_team_id and context_enterprise_id as optional fields on the EnvelopedEvent type. Slack's Events API delivers these on the envelope for Slack Connect channels and Enterprise Grid org-wide apps, where team_id may refer to a workspace different from the one the bot is installed in. Without the typed fields, downstream code had to reach for @ts-expect-error or unsafe casts to route by the correct workspace.

Commits

• ffbe0b6 chore: release (#3020)
• 6cf7b0c feat(receivers): add configurable bodyLimit to cap request body size (#3057)
• 08d52ee chore(deps-dev): bump @​changesets/cli from 2.30.0 to 3.0.1 (#3067)
• f7a7379 chore(deps-dev): update serverless requirement from ^4.41.0 to ^4.41.1 in /ex...
• 0542410 chore(deps-dev): bump @​changesets/get-release-plan from 4.0.15 to 4.0.16 (#3066)
• 278eb5b chore(deps-dev): bump @​changesets/config from 3.1.3 to 3.1.4 (#3063)
• b4d97d8 chore(deps-dev): bump @​changesets/assemble-release-plan from 6.0.9 to 6.0.10 ...
• d374244 chore(deps-dev): bump @​changesets/get-dependents-graph from 2.1.3 to 2.1.4 (#...
• 9ae4bde ci: allow Dependabot to update the changesets toolchain (#3061)
• e973b79 chore(deps): bump @​slack/web-api from 8.0.0 to 8.1.1 (#3059)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dashboard	Ready	Preview	Sep 18, 2026 3:36pm UTC
databuddy-status	Ready	Preview	Sep 18, 2026 3:36pm UTC
documentation	Ready	Preview	Sep 18, 2026 3:36pm UTC

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
links (preview)	Ready	Visit Preview	Inspect	Sep 18, 2026 3:34pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f4c363cc-9f32-4b6c-ac68-372162cc6d3a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}