chore(deps): bump @slack/bolt from 4.7.3 to 5.0.0

[dependabot]

Bumps @slack/bolt from 4.7.3 to 5.0.0.

Changelog

Sourced from @​slack/bolt's changelog.

5.0.0

Major Changes

• d284e69: Drop Node.js 18 support. The minimum required runtime is now Node.js 20 (npm >=9.6.4).

• d284e69: Remove deprecated WorkflowStep class and all associated types, middleware, and utilities. Use CustomFunction and app.function() instead.

• d284e69: Replace axios with native fetch for response_url calls. Remove agent and clientTls options from AppOptions — use clientOptions.fetch to provide a custom fetch implementation for proxy/TLS needs. Add a dispatcher option to SocketModeReceiver for proxy/TLS configuration in socket mode.

  respond() now throws a RespondError when the response_url request returns a non-2xx status (restoring the throw-on-failure behavior that axios provided) and resolves to a Response on success rather than an axios response object.

Minor Changes

• d284e69: Improve error handling by leveraging @slack/web-api v8 error classes. Authorization errors are now properly wrapped in an AuthorizationError, preserving the original thrown value (non-Error rejections are retained via the cause of the wrapped original). Default error handlers log richer details for web-api errors (API error codes, rate limit durations, HTTP status codes) alongside the full error object, so stack traces and causes remain available. The @slack/web-api error classes (SlackError, WebAPIPlatformError, WebAPIRequestError, WebAPIHTTPError, WebAPIRateLimitedError) can be imported from @slack/web-api for instanceof checks.

Patch Changes

• 9839a50: Pass the App's named bolt-app ConsoleLogger to the default receivers when no logger option is provided. Previously the App constructor built a named logger on this.logger but threaded the raw (potentially undefined) constructor argument into initReceiver, so HTTPReceiver / SocketModeReceiver each built their own anonymous logger and receiver-side log lines (e.g. unhandled HTTP requests on custom routes) appeared without the bolt-app prefix.

  Behaviour change for the no-logger case: the default receiver now shares the same Logger instance as app.logger, so a downstream app.logger.setLevel(...) after construction will affect receiver-side logging too. This is consistent with the existing behaviour that already mutates this.logger's level via the logLevel constructor option. Apps that supplied their own logger are unaffected; apps that relied on the receiver's logger being independent of app.logger will need to pass a separate logger into the receiver explicitly.

• e1c21d7: Fix AwsLambdaReceiver.toHandler() so Bolt apps on the AWS Lambda Node.js 24+ runtime no longer fail at startup with Runtime.CallbackHandlerDeprecated. The returned handler is now a 2-arg promise-based function; the unused trailing callback parameter has been removed from the AwsHandler type. The legacy AwsCallback export is retained and marked @deprecated.

• f2de079: Add context_team_id and context_enterprise_id as optional fields on the EnvelopedEvent type. Slack's Events API delivers these on the envelope for Slack Connect channels and Enterprise Grid org-wide apps, where team_id may refer to a workspace different from the one the bot is installed in. Without the typed fields, downstream code had to reach for @ts-expect-error or unsafe casts to route by the correct workspace.

Commits

• e2b90aa chore: release (#2978)
• b3df46d chore(deps): bump fastify from 5.9.0 to 5.10.0 in /examples/custom-receiver (...
• d284e69 feat: release @​slack/bolt@​5.0.0 (#2940)
• 602b744 chore(deps): bump @​koa/router from 15.6.0 to 15.7.0 in /examples/custom-recei...
• 3dec9b2 chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /examples/custom-rece...
• a687320 chore(deps): bump fastify from 5.8.5 to 5.9.0 in /examples/custom-receiver (#...
• 53aa90b chore(deps): bump @​slack/types from 2.21.1 to 2.22.0 (#2997)
• 85a92fa chore(deps): bump @​slack/web-api from 7.17.0 to 7.18.0 (#2996)
• 2425685 docs: updates for agent_view release (#2995)
• e3936b4 chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2994)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps @slack/bolt from 4.7.3 to 5.0.0. This major release requires Node.js 20+, removes the deprecated WorkflowStep API, and switches response_url calls from axios to native fetch.

Migration

• Replace WorkflowStep with CustomFunction and app.function().
• Remove agent and clientTls from AppOptions; use clientOptions.fetch for custom fetch and dispatcher on SocketModeReceiver for proxy/TLS.
• respond() now throws RespondError on non-2xx responses and resolves to a Response.
• When no logger is passed, default receivers now share app.logger; pass a separate logger to the receiver to keep it independent.
• AwsLambdaReceiver.toHandler() now returns a 2-arg promise-based handler; the callback parameter is removed.

^{Written for commit c99890c. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
databuddy-status	Ready	Preview	Sep 2, 2026 4:17am UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
dashboard	Skipped		Sep 2, 2026 4:17am UTC
documentation	Skipped		Sep 2, 2026 4:17am UTC

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
links (preview)	Ready	Visit Preview	Inspect	Sep 2, 2026 4:16am