@openclaw/slack 2026.10.10 → 2026.11.5-beta.1

package/node_modules/@slack/bolt/node_modules/body-parser/lib/read.js

@@ -17,7 +17,7 @@ const iconv = require('iconv-lite')
 const onFinished = require('on-finished')
 const zlib = require('node:zlib')
 const hasBody = require('type-is').hasBody
-const contentType = require('content-type')
+const { getCharset } = require('./utils')
 
 /**
  * Module exports.
@@ -25,12 +25,6 @@ const contentType = require('content-type')
 
 module.exports = read
 
-/**
- * @const
- * whether current node version has zstandard support
- */
-const hasZstandardSupport = 'createZstdDecompress' in zlib
-
 /**
  * Read a request into a buffer and parse.
  *
@@ -85,53 +79,38 @@ function read (req, res, next, parse, debug, options) {
   }
 
   let length
+  const opts = options
   let stream
 
-  const verify = options.verify
-
-  // assert charset is supported before creating the decompression stream, so an
-  // unsupported charset cannot leave a decoder piped with no error listener
-  if (verify && encoding !== null && !iconv.encodingExists(encoding)) {
-    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
-      charset: encoding.toLowerCase(),
-      type: 'charset.unsupported'
-    }))
-  }
+  // read options
+  const verify = opts.verify
 
   try {
-    const contentEncoding = (req.headers['content-encoding'] || 'identity').toLowerCase()
-
-    debug('content-encoding "%s"', contentEncoding)
-
-    if (options.inflate === false && contentEncoding !== 'identity') {
-      throw createError(415, 'content encoding unsupported', {
-        encoding: contentEncoding,
-        type: 'encoding.unsupported'
-      })
-    }
-
     // get the content stream
-    if (contentEncoding === 'identity') {
-      length = req.headers['content-length']
-      stream = req
-    } else {
-      stream = createDecompressionStream(contentEncoding, debug)
-      req.pipe(stream)
-    }
+    stream = contentstream(req, debug, opts.inflate)
+    length = stream.length
+    stream.length = undefined
   } catch (err) {
     return next(err)
   }
 
   // set raw-body options
-  const rawBodyOptions = {
-    length,
-    encoding: verify ? null : encoding,
-    limit: options.limit
+  opts.length = length
+  opts.encoding = verify
+    ? null
+    : encoding
+
+  // assert charset is supported
+  if (opts.encoding === null && encoding !== null && !iconv.encodingExists(encoding)) {
+    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
+      charset: encoding.toLowerCase(),
+      type: 'charset.unsupported'
+    }))
   }
 
   // read body
   debug('read body')
-  getBody(stream, rawBodyOptions, function (error, body) {
+  getBody(stream, opts, function (error, body) {
     if (error) {
       let _error
 
@@ -159,17 +138,6 @@ function read (req, res, next, parse, debug, options) {
       return
     }
 
-    // detach and destroy the decompression stream to
-    // avoid decompression errors on the finished stream
-    if (stream !== req) {
-      req.unpipe(stream)
-      stream.on('error', () => {})
-      stream.destroy()
-
-      // consume any remaining bytes so the HTTP request can finish
-      req.resume()
-    }
-
     // verify
     if (verify) {
       try {
@@ -177,7 +145,7 @@ function read (req, res, next, parse, debug, options) {
         verify(req, res, body, encoding)
       } catch (err) {
         next(createError(403, err, {
-          body,
+          body: body,
           type: err.type || 'entity.verify.failed'
         }))
         return
@@ -204,6 +172,38 @@ function read (req, res, next, parse, debug, options) {
   })
 }
 
+/**
+ * Get the content stream of the request.
+ *
+ * @param {Object} req
+ * @param {Function} debug
+ * @param {boolean} inflate
+ * @returns {Object}
+ * @private
+ */
+function contentstream (req, debug, inflate) {
+  const encoding = (req.headers['content-encoding'] || 'identity').toLowerCase()
+  const length = req.headers['content-length']
+
+  debug('content-encoding "%s"', encoding)
+
+  if (inflate === false && encoding !== 'identity') {
+    throw createError(415, 'content encoding unsupported', {
+      encoding: encoding,
+      type: 'encoding.unsupported'
+    })
+  }
+
+  if (encoding === 'identity') {
+    req.length = length
+    return req
+  }
+
+  const stream = createDecompressionStream(encoding, debug)
+  req.pipe(stream)
+  return stream
+}
+
 /**
  * Create a decompression stream for the given encoding.
  * @param {string} encoding
@@ -222,16 +222,12 @@ function createDecompressionStream (encoding, debug) {
     case 'br':
       debug('brotli decompress body')
       return zlib.createBrotliDecompress()
-    case 'zstd':
-      if (hasZstandardSupport) {
-        debug('zstd decompress body')
-        return zlib.createZstdDecompress()
-      }
+    default:
+      throw createError(415, 'unsupported content encoding "' + encoding + '"', {
+        encoding: encoding,
+        type: 'encoding.unsupported'
+      })
   }
-  throw createError(415, 'unsupported content encoding "' + encoding + '"', {
-    encoding,
-    type: 'encoding.unsupported'
-  })
 }
 
 /**
@@ -249,16 +245,3 @@ function dump (req, callback) {
     req.resume()
   }
 }
-
-/**
- * Get the charset of a request.
- *
- * @param {Object} req
- * @returns {string | undefined}
- * @private
- */
-function getCharset (req) {
-  const header = req.headers['content-type']
-  if (!header) return undefined
-  return contentType.parse(header).parameters.charset?.toLowerCase()
-}

package/node_modules/@slack/bolt/node_modules/body-parser/lib/types/json.js

@@ -23,7 +23,7 @@ const { normalizeOptions } = require('../utils')
 module.exports = json
 
 /**
- * RegExp to match the first non-whitespace character in a string.
+ * RegExp to match the first non-space in a string.
  *
  * Allowed whitespace is defined in RFC 7159:
  *
@@ -33,7 +33,7 @@ module.exports = json
  *            %x0A /              ; Line feed or New line
  *            %x0D )              ; Carriage return
  */
-const FIRST_NON_WHITESPACE_REGEXP = /^[\x20\x09\x0a\x0d]*([^\x20\x09\x0a\x0d]|$)/ // eslint-disable-line no-control-regex
+const FIRST_CHAR_REGEXP = /^[\x20\x09\x0a\x0d]*([^\x20\x09\x0a\x0d])/ // eslint-disable-line no-control-regex
 
 const JSON_SYNTAX_CHAR = '#'
 const JSON_SYNTAX_REGEXP = /#+/g
@@ -80,12 +80,10 @@ function createJsonParser (options) {
         return {}
       }
 
-      if (body[0] !== '{' && body[0] !== '[') {
-        const first = firstNonWhitespaceChar(body)
-        if (first !== '{' && first !== '[') {
-          debug('strict violation')
-          throw createStrictSyntaxError(body, first)
-        }
+      const first = firstchar(body)
+      if (first !== '{' && first !== '[') {
+        debug('strict violation')
+        throw createStrictSyntaxError(body, first)
       }
 
       try {
@@ -154,10 +152,12 @@ function createStrictSyntaxError (str, char) {
  * @returns {string|undefined}
  * @private
  */
-function firstNonWhitespaceChar (str) {
-  const match = FIRST_NON_WHITESPACE_REGEXP.exec(str)
+function firstchar (str) {
+  const match = FIRST_CHAR_REGEXP.exec(str)
 
-  return match && match[1] ? match[1] : undefined
+  return match
+    ? match[1]
+    : undefined
 }
 
 /**

package/node_modules/@slack/bolt/node_modules/body-parser/lib/types/urlencoded.js

@@ -98,12 +98,12 @@ function createQueryParser (options) {
     try {
       return qs.parse(body, {
         allowPrototypes: true,
-        arrayLimit,
-        depth,
-        charsetSentinel,
-        interpretNumericEntities,
+        arrayLimit: arrayLimit,
+        depth: depth,
+        charsetSentinel: charsetSentinel,
+        interpretNumericEntities: interpretNumericEntities,
         charset: encoding,
-        parameterLimit,
+        parameterLimit: parameterLimit,
         strictDepth: true
       })
     } catch (err) {

package/node_modules/@slack/bolt/node_modules/body-parser/lib/utils.js

@@ -5,16 +5,31 @@
  */
 
 const bytes = require('bytes')
+const contentType = require('content-type')
 const typeis = require('type-is')
 
 /**
  * Module exports.
  */
 module.exports = {
+  getCharset,
   normalizeOptions,
   passthrough
 }
 
+/**
+ * Get the charset of a request.
+ *
+ * @param {Object} req
+ * @returns {string | undefined}
+ * @private
+ */
+function getCharset (req) {
+  const header = req.headers['content-type']
+  if (!header) return undefined
+  return contentType.parse(header).parameters.charset?.toLowerCase()
+}
+
 /**
  * Get the simple type checker.
  *

package/node_modules/@slack/bolt/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "2.4.0",
+  "version": "2.3.0",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -27,21 +27,26 @@
   },
   "dependencies": {
     "bytes": "^3.1.2",
-    "content-type": "^2.1.0",
+    "content-type": "^2.0.0",
     "debug": "^4.4.3",
     "http-errors": "^2.0.1",
-    "iconv-lite": "^0.7.3",
+    "iconv-lite": "^0.7.2",
     "on-finished": "^2.4.1",
-    "qs": "^6.16.1",
+    "qs": "^6.15.2",
     "raw-body": "^3.0.2",
     "type-is": "^2.1.0"
   },
   "devDependencies": {
-    "eslint": "^9.39.5",
+    "eslint": "^8.57.1",
+    "eslint-config-standard": "^14.1.1",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-markdown": "^3.0.1",
+    "eslint-plugin-node": "^11.1.0",
+    "eslint-plugin-promise": "^6.6.0",
+    "eslint-plugin-standard": "^4.1.0",
     "mocha": "^11.7.6",
-    "neostandard": "^0.13.0",
     "nyc": "^17.1.0",
-    "supertest": "7.3.0"
+    "supertest": "^7.2.2"
   },
   "files": [
     "lib/",

package/node_modules/@slack/bolt/node_modules/content-disposition/README.md

@@ -17,17 +17,17 @@ $ npm install content-disposition
 ## API
 
 ```js
-const contentDisposition = require('content-disposition')
+import { create, parse, format } from 'content-disposition';
 ```
 
-### contentDisposition(filename, options)
+### create(filename, options)
 
 Create an attachment `Content-Disposition` header value using the given file name,
 if supplied. The `filename` is optional and if no file name is desired, but you
 want to specify `options`, set `filename` to `undefined`.
 
 ```js
-res.setHeader('Content-Disposition', contentDisposition('∫ maths.pdf'))
+res.setHeader('Content-Disposition', create('∫ maths.pdf'));
 ```
 
 **note** HTTP headers are of the ISO-8859-1 character set. If you are writing this
@@ -40,73 +40,139 @@ the `'binary'` encoding in Node.js.
 
 ##### fallback
 
-If the `filename` option is outside ISO-8859-1, then the file name is actually
+If the `filename` option is outside US-ASCII, then the file name is actually
 stored in a supplemental field for clients that support Unicode file names and
-a ISO-8859-1 version of the file name is automatically generated.
+a US-ASCII version of the file name is automatically generated.
 
-This specifies the ISO-8859-1 file name to override the automatic generation or
+This specifies the US-ASCII file name to override the automatic generation or
 disables the generation all together, defaults to `true`.
 
-  - A string will specify the ISO-8859-1 file name to use in place of automatic
-    generation.
-  - `false` will disable including a ISO-8859-1 file name and only include the
-    Unicode version (unless the file name is already ISO-8859-1).
-  - `true` will enable automatic generation if the file name is outside ISO-8859-1.
+- A string will specify the US-ASCII file name to use in place of automatic
+  generation.
+- `false` will disable including a US-ASCII file name and only include the
+  Unicode version (unless the file name is already US-ASCII).
+- `true` will enable automatic generation if the file name is outside US-ASCII.
 
-If the `filename` option is ISO-8859-1 and this option is specified and has a
+If the `filename` option is US-ASCII and this option is specified and has a
 different value, then the `filename` option is encoded in the extended field
-and this set as the fallback field, even though they are both ISO-8859-1.
+and this set as the fallback field, even though they are both US-ASCII.
 
 ##### type
 
 Specifies the disposition type, defaults to `"attachment"`. This can also be
 `"inline"`, or any other value (all values except inline are treated like
 `attachment`, but can convey additional information if both parties agree to
-it). The type is normalized to lower-case.
+it).
 
-### contentDisposition.parse(string)
+### parse(string, options)
 
 ```js
-const disposition = contentDisposition.parse('attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt')
+const disposition = parse(
+  'attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt',
+);
 ```
 
 Parse a `Content-Disposition` header string. This automatically handles extended
 ("Unicode") parameters by decoding them and providing them under the standard
-parameter name. This will return an object with the following properties (examples
-are shown for the string `'attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt'`):
+parameter name. This will return an object with the following properties:
 
- - `type`: The disposition type (always lower case). Example: `'attachment'`
+- `type`: The disposition type (always lower case). Example: `'attachment'`
 
- - `parameters`: An object of the parameters in the disposition (name of parameter
-   always lower case and extended versions replace non-extended versions). Example:
-   `{filename: "€ rates.txt"}`
+- `parameters`: An object of the parameters in the disposition (name of parameter
+  always lower case and extended versions replace non-extended versions). Example:
+  `{filename: "€ rates.txt"}`
+
+#### Options
+
+##### multipart
+
+Parse parameters using browser `multipart/form-data` behavior.
+
+```js
+parse('form-data; name="file"; filename="the %22plans%22.pdf"', {
+  multipart: true,
+});
+```
+
+##### extended
+
+Parse RFC 5987 extended header parameters automatically when decoding
+parameters, defaults to `true`.
+
+### format(obj, options)
+
+```js
+const disposition = format({
+  type: 'attachment',
+  parameters: {
+    filename: '€ rates.txt',
+  },
+});
+```
+
+Formats an object to a `Content-Disposition` header string. This automatically
+handles extended ("Unicode") parameters and returns a string. Example:
+`'attachment; filename*=UTF-8''%E2%82%AC%20rates.txt'`
+
+#### Options
+
+##### multipart
+
+Format parameters using browser `multipart/form-data` behavior. This quotes
+parameter values, escapes `"` as `%22`, and writes Unicode values directly
+instead of using extended parameters.
+
+```js
+format(
+  {
+    type: 'form-data',
+    parameters: { name: 'file', filename: '€ rates.txt' },
+  },
+  { multipart: true },
+);
+```
+
+##### extended
+
+Encode Unicode parameter values using RFC 5987 extended header parameters,
+e.g. `filename*=`, defaults to `true`.
 
 ## Examples
 
 ### Send a file for download
 
 ```js
-const contentDisposition = require('content-disposition')
-const fs = require('fs')
-const http = require('http')
-const onFinished = require('on-finished')
+const contentDisposition = require('content-disposition');
+const fs = require('fs');
+const http = require('http');
+const onFinished = require('on-finished');
 
-const filePath = '/path/to/public/plans.pdf'
+const filePath = '/path/to/public/plans.pdf';
 
-http.createServer(function onRequest (req, res) {
+http.createServer(function onRequest(req, res) {
   // set headers
-  res.setHeader('Content-Type', 'application/pdf')
-  res.setHeader('Content-Disposition', contentDisposition(filePath))
+  res.setHeader('Content-Type', 'application/pdf');
+  res.setHeader('Content-Disposition', contentDisposition(filePath));
 
   // send file
-  const stream = fs.createReadStream(filePath)
-  stream.pipe(res)
+  const stream = fs.createReadStream(filePath);
+  stream.pipe(res);
   onFinished(res, function () {
-    stream.destroy()
-  })
-})
+    stream.destroy();
+  });
+});
 ```
 
+## Local demo
+
+Run the upload inspector locally:
+
+```sh
+npm run demo
+```
+
+Then open `http://127.0.0.1:3000` in your browser. The demo lets you upload files, inspect the multipart upload part headers sent by the browser, and compare them with the download `Content-Disposition` header generated by this package.
+
 ## Testing
 
 ```sh
@@ -118,11 +184,15 @@ $ npm test
 - [RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1][rfc-2616]
 - [RFC 5987: Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters][rfc-5987]
 - [RFC 6266: Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)][rfc-6266]
+- [RFC 8187: Indicating Character Encoding and Language for HTTP Header Field Parameters][rfc-8187]
+- [HTML Living Standard: Multipart form data][html-form]
 - [Test Cases for HTTP Content-Disposition header field (RFC 6266) and the Encodings defined in RFCs 2047, 2231 and 5987][tc-2231]
 
 [rfc-2616]: https://datatracker.ietf.org/doc/html/rfc2616
 [rfc-5987]: https://datatracker.ietf.org/doc/html/rfc5987
 [rfc-6266]: https://datatracker.ietf.org/doc/html/rfc6266
+[rfc-8187]: https://datatracker.ietf.org/doc/html/rfc8187
+[html-form]: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
 [tc-2231]: http://greenbytes.de/tech/tc2231/
 
 ## License

package/node_modules/@slack/bolt/node_modules/content-disposition/dist/index.d.ts

@@ -0,0 +1,72 @@
+/*!
+ * content-disposition
+ * Copyright(c) 2014-2017 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+export interface ContentDisposition {
+    /**
+     * Content-Disposition type, such as "attachment" or "inline"
+     */
+    type: string;
+    /**
+     * Content-Disposition parameters, such as "filename"
+     */
+    parameters: Record<string, string>;
+}
+export interface CreateOptions {
+    /**
+     * Content-Disposition type, defaults to "attachment"
+     * @default "attachment"
+     */
+    type?: string;
+    /**
+     * Fallback filename for non-US-ASCII strings. If true, a fallback will be generated by replacing non-US-ASCII characters with "?". If false, no fallback will be generated.
+     * @default true
+     */
+    fallback?: string | boolean;
+}
+/**
+ * Create an attachment Content-Disposition header.
+ */
+export declare function create(filename?: string, options?: CreateOptions): string;
+export interface ParseOptions {
+    /**
+     * Whether to decode RFC 8187 encoded parameters.
+     * @default true
+     */
+    extended?: boolean;
+    /**
+     * Parse parameters as sent by browsers in `multipart/form-data`.
+     * @default false
+     */
+    multipart?: boolean;
+}
+/**
+ * Parse Content-Disposition header string.
+ */
+export declare function parse(header: string, options?: ParseOptions): ContentDisposition;
+/**
+ * Decode a RFC 8187 field value (gracefully).
+ */
+export declare function decodeExtended(str: string): string | undefined;
+export interface FormatOptions {
+    /**
+     * Whether to use extended parameter encoding for non-ISO-8859-1 strings.
+     * If false, an error will be thrown when formatting such strings.
+     * @default true
+     */
+    extended?: boolean;
+    /**
+     * Format parameters as sent by browsers in `multipart/form-data`.
+     * @default false
+     */
+    multipart?: boolean;
+}
+/**
+ * Format object to Content-Disposition header.
+ */
+export declare function format(obj: Partial<ContentDisposition>, options?: FormatOptions): string;
+/**
+ * Encode a Unicode string for HTTP (RFC 8187).
+ */
+export declare function encodeExtended(str: string): string;