feat: declare undici as a peer dependency for Socket Mode - #3040
Open
WilliamBergamin wants to merge 9 commits into
Open
feat: declare undici as a peer dependency for Socket Mode#3040WilliamBergamin wants to merge 9 commits into
WilliamBergamin wants to merge 9 commits into
Conversation
Design and implementation plan for declaring undici as a peer dependency required by @slack/socket-mode@3, with a drift-guard test. Refs: #3039 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
@slack/socket-mode@3 declares undici@^7 as a peer dependency, which Bolt constructs internally via SocketModeClient. Declare it as a Bolt peer so the dependency graph is complete under strict package managers (Yarn/pnpm). Add semver + @types/semver as devDependencies for the drift-guard test. Refs: #3039 Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Reads the installed @slack/socket-mode peerDependencies.undici at test time and asserts Bolt's declared range is a semver subset, so the two can't silently fall out of sync. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Add changeset and a Socket Mode install note for strict package managers. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Drop the install note added earlier; keep the changeset entry. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Drop the drift-guard spec and the now-unused semver / @types/semver devDependencies. The undici peerDependency declaration remains. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Remove semver and @types/semver, which were only used by the drift-guard test removed in the previous commit. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
Drop the spec and plan scaffolding docs; they are not part of the change. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
🦋 Changeset detectedLatest commit: b2a569d The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WilliamBergamin
added
semver:patch
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3040 +/- ##
=======================================
Coverage 94.33% 94.33%
=======================================
Files 43 43
Lines 7360 7360
Branches 679 679
=======================================
Hits 6943 6943
Misses 409 409
Partials 8 8 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The undici peer range permitted versions affected by CVE-2026-12151 (GHSA-vxpw-j846-p89q), a high-severity WebSocket denial-of-service (unbounded fragment count). undici 7.28.0 is the first patched 7.x release. Bump the peer range to ^7.28.0 and refresh the resolved lockfile version accordingly. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
zimeg
approved these changes
Aug 31, 2026
zimeg
left a comment
zimeg
left a comment
Member
There was a problem hiding this comment.
📣 A comment of support overall but it might be a separate task to address? Marking as LGTM in a positive step forward!
| "peerDependencies": { | ||
| "@types/express": "^5.0.0" | ||
| "@types/express": "^5.0.0", | ||
| "undici": "^7.28.0" |
Member
There was a problem hiding this comment.
🏆 praise: This is a good pattern to extend I think! Documentation might need to be updated for certain cases but I don't think that's needed right now.
🔬 question: With context of adjacent PR slackapi/node-slack-sdk#2694 would we want to support undici@^8 here as well?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves #3039.
@slack/boltconstructs aSocketModeClientfrom@slack/socket-mode@3, which declaresundici@^7as a peer dependency. Because Bolt neither declared nor forwardedundici, installs on strict package managers (Yarn Berry, pnpm) surfaced an unmet-peer-dependency error — npm papered over it via transitive resolution, but stricter resolvers did not.This PR declares
undicias a peer dependency of@slack/boltso the requirement is explicit at Bolt's own install boundary. Socket Mode users on strict package managers should installundicialongside@slack/bolt.The peer range is pinned to
^7.28.0(not^7.0.0) to keep consumers offundicireleases affected by CVE-2026-12151 / GHSA-vxpw-j846-p89q.Requirements