Renovate: Update module github.com/slack-go/slack to v0.23.1 [SECURITY] by renovate[bot] · Pull Request #385 · sapcc/maintenance-controller

renovate · 2026-05-14T22:49:57Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/slack-go/slack	`v0.17.3` → `v0.23.1`

slack-go `SecretsVerifier` accepts empty signing secret without precondition

GHSA-gxhx-2686-5h9g

More information

Details

func NewSecretsVerifier(header http.Header, secret string) (SecretsVerifier, error) {
    hash := hmac.New(sha256.New, []byte(secret))    // raw secret, no precondition
}

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

slack-go `SecretsVerifier` accepts empty signing secret without precondition

GHSA-gxhx-2686-5h9g

More information

Details

func NewSecretsVerifier(header http.Header, secret string) (SecretsVerifier, error) {
    hash := hmac.New(sha256.New, []byte(secret))    // raw secret, no precondition
}

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

slack-go/slack (github.com/slack-go/slack)

`v0.23.1`

Compare Source

[!IMPORTANT]
Even though this is a [security] patch release, if you were using an empty secret, this is a breaking change due to a change in behaviour. That's on purpose, to ensure you fix your approach so that there are no footguns.

Fixed

NewSecretsVerifier now rejects empty signing secrets to avoid accepting forged request
signatures when applications are misconfigured.

Full Changelog: slack-go/slack@v0.23.0...v0.23.1

`v0.23.0`

Compare Source

Added

feat(socketmode): expose socketmode handler dispatcher method by @nlopes in #1550
feat(block): add card and carousel blocks by @nlopes in #1551
feat(assistant): add username and icon to status update by @charleenwang in #1553
feat(block): add alert block by @nlopes in #1552