feat: declare undici as a peer dependency for Socket Mode - #3040
WilliamBergamin wants to merge 11 commits into
Conversation
Design and implementation plan for declaring undici as a peer dependency required by @slack/socket-mode@3, with a drift-guard test. Refs: #3039 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
@slack/socket-mode@3 declares undici@^7 as a peer dependency, which Bolt constructs internally via SocketModeClient. Declare it as a Bolt peer so the dependency graph is complete under strict package managers (Yarn/pnpm). Add semver + @types/semver as devDependencies for the drift-guard test. Refs: #3039 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Reads the installed @slack/socket-mode peerDependencies.undici at test time and asserts Bolt's declared range is a semver subset, so the two can't silently fall out of sync. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Add changeset and a Socket Mode install note for strict package managers. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Drop the install note added earlier; keep the changeset entry. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Drop the drift-guard spec and the now-unused semver / @types/semver devDependencies. The undici peerDependency declaration remains. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Remove semver and @types/semver, which were only used by the drift-guard test removed in the previous commit. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Drop the spec and plan scaffolding docs; they are not part of the change. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
🦋 Changeset detectedLatest commit: 408814a The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WilliamBergamin
added
semver:patch
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3040 +/- ##
=======================================
Coverage 94.38% 94.38%
=======================================
Files 43 43
Lines 7426 7426
Branches 704 704
=======================================
Hits 7009 7009
Misses 408 408
Partials 9 9 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The undici peer range permitted versions affected by CVE-2026-12151 (GHSA-vxpw-j846-p89q), a high-severity WebSocket denial-of-service (unbounded fragment count). undici 7.28.0 is the first patched 7.x release. Bump the peer range to ^7.28.0 and refresh the resolved lockfile version accordingly. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
zimeg
left a comment
zimeg
left a comment
There was a problem hiding this comment.
📣 A comment of support overall but it might be a separate task to address? Marking as LGTM in a positive step forward!
| "peerDependencies": { | ||
| "@types/express": "^5.0.0" | ||
| "@types/express": "^5.0.0", | ||
| "undici": "^7.28.0" |
There was a problem hiding this comment.
🏆 praise: This is a good pattern to extend I think! Documentation might need to be updated for certain cases but I don't think that's needed right now.
🔬 question: With context of adjacent PR slackapi/node-slack-sdk#2694 would we want to support undici@^8 here as well?
There was a problem hiding this comment.
Yess I merged slackapi/node-slack-sdk#2694 we need to release it and then apply the same pattern here as well 🤔
This branch has not been deployed
2 participants
Summary
Resolves #3039.
@slack/boltconstructs aSocketModeClientfrom@slack/socket-mode@3, which declaresundici@^7as a peer dependency. Because Bolt neither declared nor forwardedundici, installs on strict package managers (Yarn Berry, pnpm) surfaced an unmet-peer-dependency error — npm papered over it via transitive resolution, but stricter resolvers did not.This PR declares
undicias a peer dependency of@slack/boltso the requirement is explicit at Bolt's own install boundary. Socket Mode users on strict package managers should installundicialongside@slack/bolt.The peer range is pinned to
^7.28.0(not^7.0.0) to keep consumers offundicireleases affected by CVE-2026-12151 / GHSA-vxpw-j846-p89q.Requirements