v0.35.0

This release fixes interaction payload spoofing, preserves huddle profile data, and corrects several message handling and 32-bit compatibility issues.

Upgrade notes

Warning

slackevents.Profile has three new fields. Positional struct literals no longer compile. Convert them to keyed literals before upgrading.

Events API profiles now preserve huddle state, expiration, and call ID through HuddleState, HuddleStateExpirationTS, and HuddleStateCallID.

Use field names when constructing profiles:

profile := slackevents.Profile{
    DisplayName: "Alex",
    Team:        "T123ABC456",
}

Security

InteractionCallbackParse now reads payload exclusively from the form-encoded request body.

Previously, it could accept an unsigned URL query payload while the application verified a signature covering only the body. An attacker who obtained a valid signed request within the accepted timestamp window could replay it with a forged interaction payload.

Callers must supply payload in an application/x-www-form-urlencoded request body. Form parsing errors are now returned to the caller.

See GHSA-pj2x-fjjr-q84c. Thanks to @jjiang-stripe for reporting the issue and providing the fix.

Fixes

• Prevent repeated escaping and data races when reusing a MsgOptionText option.
• Encode context block elements correctly when a block is passed by value.
• Preserve plus signs and percent signs in slacktest message blocks and attachments.
• Keep slacktest bot identities independent when generating RTM connection information.
• Prevent retry jitter panics with large durations on 32-bit platforms.
• Decode JSONTime timestamps outside the 32-bit integer range on 32-bit platforms.

Full changelog: v0.34.0…v0.35.0