@openclaw/slack 2026.7.2-beta.7 → 2026.8.1-beta.2

package/dist/{shared-DgIN3Dcr.js → shared-zdT5AMp-.js}

@@ -1,16 +1,16 @@
-import { n as listSlackAccountIds, o as resolveSlackAccountAllowFrom, r as mergeSlackAccountConfig, s as resolveSlackAccountDmPolicy } from "./accounts-CHAeNZOX.js";
-import { t as inspectSlackAccount } from "./account-inspect-DEKpg9Ip.js";
+import { n as listSlackAccountIds, o as resolveSlackAccountAllowFrom, r as mergeSlackAccountConfig, s as resolveSlackAccountDmPolicy } from "./accounts-CK4AVI2_.js";
+import { t as inspectSlackAccount } from "./account-inspect-Drw2gAiN.js";
+import { a as parseSlackTarget } from "./target-parsing-BnMD2ZqZ.js";
 import { t as isSlackPluginAccountConfigured } from "./account-configured-BwfXBo_F.js";
-import { b as getChatChannelMeta, t as probeSlack } from "./probe-CgDsSops.js";
-import { o as SLACK_CHANNEL, t as slackBaseConfigAdapter } from "./config-adapter-CxBQH8fq.js";
-import { t as SlackChannelConfigSchema } from "./config-schema-SgZT6nXV.js";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-CsGH1Dfc.js";
+import { b as getChatChannelMeta, t as probeSlack } from "./probe-HoEg_WxB.js";
+import { n as slackBaseConfigAdapter, t as slackSetupPlugin } from "./channel.setup-Bch9dYmA.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BAy7-EUQ.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DxmvbxBF.js";
 import { adaptScopedAccountAccessor, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { buildMutableAllowEntryDetector, collectStandardAllowlistLists, createDangerousNameMatchingMutableAllowlistWarningCollector, createOpenProviderConfiguredRouteWarningCollector } from "openclaw/plugin-sdk/channel-policy";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
-import { asObjectRecord } from "openclaw/plugin-sdk/runtime-doctor";
+import { asObjectRecord } from "openclaw/plugin-sdk/runtime-doctor-migrations";
 //#region extensions/slack/src/security.ts
 const resolveSlackDmPolicy = createScopedDmSecurityResolver({
 	channelKey: "slack",
@@ -55,10 +55,20 @@ const slackSecurityAdapter = {
 	}
 };
 //#endregion
+//#region extensions/slack/src/security-doctor.ts
+const isSlackMutableUnqualifiedAllowEntry = buildMutableAllowEntryDetector({ stableIdPattern: /^(?:(?:(?:[sS][lL][aA][cC][kK]|[uU][sS][eE][rR]):)?(?:[UWBCGDT][A-Z0-9]{2,}|[A-Za-z0-9]{8,})|<@[A-Za-z0-9]{8,}>)$/ });
+function isSlackMutableAllowEntry(entry) {
+	if (/^team:/i.test(entry)) try {
+		const target = parseSlackTarget(entry);
+		if (target?.kind === "user" && target.teamId) return false;
+	} catch {}
+	return isSlackMutableUnqualifiedAllowEntry(entry);
+}
+//#endregion
 //#region extensions/slack/src/doctor.ts
 const collectSlackMutableAllowlistWarnings = createDangerousNameMatchingMutableAllowlistWarningCollector({
 	channel: "slack",
-	detector: buildMutableAllowEntryDetector({ stableIdPattern: /^(?:(?:(?:[sS][lL][aA][cC][kK]|[uU][sS][eE][rR]):)?(?:[UWBCGDT][A-Z0-9]{2,}|[A-Za-z0-9]{8,})|<@[A-Za-z0-9]{8,}>)$/ }),
+	detector: isSlackMutableAllowEntry,
 	collectLists: (scope) => collectStandardAllowlistLists(scope, {
 		includeGroupAllowFrom: false,
 		includeDm: true,
@@ -78,10 +88,21 @@ const SLACK_AMBIGUOUS_LOWERCASE_CHANNEL_ID_RE = /^(?:channel:)?[cgd][a-z][a-z0-9
 const SLACK_CHANNEL_NAME_RE = /^[\p{L}\p{M}\p{N}_-]{1,80}$/u;
 const SLACK_CHANNEL_NAME_ALPHANUMERIC_RE = /[\p{L}\p{N}]/u;
 function looksLikeSlackChannelId(channelKey) {
-	return SLACK_CANONICAL_CHANNEL_ID_RE.test(channelKey) || SLACK_LOWERCASE_CHANNEL_ID_RE.test(channelKey) || SLACK_PREFIXED_CANONICAL_CHANNEL_ID_RE.test(channelKey) || SLACK_PREFIXED_LOWERCASE_CHANNEL_ID_RE.test(channelKey);
+	const workspaceChannelId = parseWorkspaceQualifiedChannelId(channelKey);
+	return workspaceChannelId !== void 0 && /^[CG]/i.test(workspaceChannelId) || SLACK_CANONICAL_CHANNEL_ID_RE.test(channelKey) || SLACK_LOWERCASE_CHANNEL_ID_RE.test(channelKey) || SLACK_PREFIXED_CANONICAL_CHANNEL_ID_RE.test(channelKey) || SLACK_PREFIXED_LOWERCASE_CHANNEL_ID_RE.test(channelKey);
 }
 function looksLikeSlackDmId(channelKey) {
-	return SLACK_CANONICAL_DM_ID_RE.test(channelKey) || SLACK_PREFIXED_LOWERCASE_DM_ID_RE.test(channelKey);
+	const workspaceChannelId = parseWorkspaceQualifiedChannelId(channelKey);
+	return workspaceChannelId !== void 0 && /^D/i.test(workspaceChannelId) || SLACK_CANONICAL_DM_ID_RE.test(channelKey) || SLACK_PREFIXED_LOWERCASE_DM_ID_RE.test(channelKey);
+}
+function parseWorkspaceQualifiedChannelId(channelKey) {
+	if (!/^team:/i.test(channelKey)) return;
+	try {
+		const target = parseSlackTarget(channelKey);
+		return target?.kind === "channel" && target.teamId ? target.id : void 0;
+	} catch {
+		return;
+	}
 }
 function looksLikeSlackChannelNameKey(channelKey) {
 	const name = channelKey.startsWith("#") ? channelKey.slice(1) : channelKey;
@@ -189,29 +210,13 @@ const slackConfigAdapter = {
 };
 function createSlackPluginBase(params) {
 	return {
-		id: SLACK_CHANNEL,
+		...slackSetupPlugin,
 		meta: {
-			...getChatChannelMeta(SLACK_CHANNEL),
+			...getChatChannelMeta(slackSetupPlugin.id),
 			preferSessionLookupForAnnounceTarget: true
 		},
 		setupWizard: params.setupWizard,
-		...params.setupContract ? { setupContract: params.setupContract } : {},
-		capabilities: {
-			chatTypes: [
-				"direct",
-				"channel",
-				"thread"
-			],
-			reactions: true,
-			threads: true,
-			media: true,
-			nativeCommands: true
-		},
-		commands: {
-			nativeCommandsAutoEnabled: false,
-			nativeSkillsAutoEnabled: false,
-			resolveNativeCommandName: ({ commandKey, defaultName }) => commandKey === "status" ? "agentstatus" : defaultName
-		},
+		setupContract: params.setupContract,
 		doctor: slackDoctor,
 		agentPrompt: {
 			inboundFormattingHints: () => ({
@@ -233,20 +238,10 @@ function createSlackPluginBase(params) {
 				"- Slack Block Kit or presentation text fields are sent as Slack mrkdwn directly; use `*bold*`, `_italic_`, `~strike~`, `<url|label>` links, and avoid Markdown headings or pipe tables there."
 			]
 		},
-		streaming: { blockStreamingCoalesceDefaults: {
-			minChars: 1500,
-			idleMs: 1e3
-		} },
-		reload: { configPrefixes: ["channels.slack"] },
 		security: slackSecurityAdapter,
-		configSchema: SlackChannelConfigSchema,
 		config: {
+			...slackSetupPlugin.config,
 			...slackConfigAdapter,
-			hasConfiguredState: ({ env }) => [
-				"SLACK_APP_TOKEN",
-				"SLACK_BOT_TOKEN",
-				"SLACK_USER_TOKEN"
-			].some((key) => typeof env?.[key] === "string" && env[key]?.trim().length > 0),
 			isConfigured: (account) => isSlackPluginAccountConfigured(account),
 			describeAccount: (account) => describeAccountSnapshot({
 				account,
@@ -260,8 +255,7 @@ function createSlackPluginBase(params) {
 		secrets: {
 			secretTargetRegistryEntries,
 			collectRuntimeConfigAssignments
-		},
-		setup: params.setup
+		}
 	};
 }
 //#endregion

package/dist/{slash-dispatch.runtime-zPkyl7dB.js → slash-dispatch.runtime-Bnr9GR1S.js}

@@ -1,4 +1,4 @@
-import { r as deliverSlackSlashReplies$1 } from "./replies-4s_Vq_z9.js";
+import { r as deliverSlackSlashReplies$1 } from "./replies-CeOfv82I.js";
 import { resolveAgentRoute as resolveAgentRoute$1 } from "openclaw/plugin-sdk/routing";
 import { resolveMarkdownTableMode as resolveMarkdownTableMode$1 } from "openclaw/plugin-sdk/markdown-table-runtime";
 import { resolveConversationLabel as resolveConversationLabel$1 } from "openclaw/plugin-sdk/conversation-runtime";

package/dist/{streaming-compat-3_X-21wW.js → streaming-compat-B-e0mqM0.js}

@@ -1,5 +1,5 @@
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { getChannelStreamingConfigObject, resolveChannelStreamingNativeTransport } from "openclaw/plugin-sdk/channel-outbound";
+import { getChannelStreamingConfigObject, resolveChannelStreamingNativeTransport } from "openclaw/plugin-sdk/channel-streaming-config";
 //#region extensions/slack/src/streaming-compat.ts
 function normalizeStreamingMode(value) {
 	if (typeof value !== "string") return null;
@@ -20,18 +20,13 @@ function mapSlackLegacyDraftStreamModeToStreaming(mode) {
 	if (mode === "status_final") return "progress";
 	return "partial";
 }
-function mapStreamingModeToSlackLegacyDraftStreamMode(mode) {
-	if (mode === "block") return "append";
-	if (mode === "progress") return "status_final";
-	return "replace";
-}
 function resolveSlackStreamingMode(params = {}) {
 	const parsedStreaming = parseStreamingMode(getChannelStreamingConfigObject(params)?.mode ?? params.streaming);
 	if (parsedStreaming) return parsedStreaming;
 	const legacyStreamMode = parseSlackLegacyDraftStreamMode(params.streamMode);
 	if (legacyStreamMode) return mapSlackLegacyDraftStreamModeToStreaming(legacyStreamMode);
 	if (typeof params.streaming === "boolean") return params.streaming ? "partial" : "off";
-	return "partial";
+	return "progress";
 }
 function resolveSlackNativeStreaming(params = {}) {
 	const canonical = resolveChannelStreamingNativeTransport(params);
@@ -41,4 +36,4 @@ function resolveSlackNativeStreaming(params = {}) {
 	return true;
 }
 //#endregion
-export { resolveSlackNativeStreaming as n, resolveSlackStreamingMode as r, mapStreamingModeToSlackLegacyDraftStreamMode as t };
+export { resolveSlackStreamingMode as n, resolveSlackNativeStreaming as t };

package/dist/{target-parsing-N6lHogYZ.js → target-parsing-BnMD2ZqZ.js}

@@ -1,7 +1,42 @@
 import { buildMessagingTarget, ensureTargetId, parseMentionPrefixOrAtUserTarget, requireTargetKind } from "openclaw/plugin-sdk/channel-targets";
 //#region extensions/slack/src/target-parsing.ts
 const SLACK_CHANNEL_API_ID_RE = /^[CDG][0-9][A-Z0-9]{7,}$/i;
-const SLACK_USER_API_ID_RE = /^[UW][A-Z0-9]{8,}$/i;
+const SLACK_USER_API_ID_RE = /^[BUW][A-Z0-9]{8,}$/i;
+const SLACK_QUALIFIED_TARGET_RE = /^team:([^:]+):(user|channel):([^:]+)$/i;
+function decodeSlackTargetPart(raw) {
+	try {
+		return decodeURIComponent(raw).trim() || void 0;
+	} catch {
+		return;
+	}
+}
+function parseQualifiedSlackTarget(raw) {
+	const match = SLACK_QUALIFIED_TARGET_RE.exec(raw);
+	if (!match) {
+		if (/^team:/i.test(raw)) throw new Error("Slack workspace targets require team:<team-id>:channel:<channel-id> or team:<team-id>:user:<user-id>");
+		return;
+	}
+	const teamId = decodeSlackTargetPart(match[1] ?? "");
+	const kind = match[2]?.toLowerCase();
+	const id = decodeSlackTargetPart(match[3] ?? "");
+	const idPattern = kind === "user" ? /^[BUW][A-Z0-9]+$/i : /^[CDG][A-Z0-9]+$/i;
+	if (!teamId || !/^T[A-Z0-9]+$/i.test(teamId) || !kind || !id || !idPattern.test(id)) throw new Error("Invalid Slack workspace-qualified target");
+	return {
+		kind,
+		id,
+		teamId,
+		raw,
+		normalized: `team:${teamId.toLowerCase()}:${kind}:${id.toLowerCase()}`
+	};
+}
+function formatSlackTarget(params) {
+	const teamId = params.teamId?.trim();
+	const id = params.id.trim();
+	if (!teamId) return params.explicitKind ? `${params.kind}:${id}` : id;
+	const idPattern = params.kind === "user" ? /^[BUW][A-Z0-9]+$/i : /^[CDG][A-Z0-9]+$/i;
+	if (!/^T[A-Z0-9]+$/i.test(teamId) || !idPattern.test(id)) throw new Error("Invalid Slack workspace-qualified target");
+	return `team:${encodeURIComponent(teamId)}:${params.kind}:${encodeURIComponent(id)}`;
+}
 function isUnambiguousSlackUserId(rawId) {
 	const id = rawId.trim();
 	return /^[UW][A-Z0-9]+$/.test(id) || /^[uw][0-9][a-z0-9]{7,}$/.test(id);
@@ -15,6 +50,8 @@ function canonicalizeSlackApiTargetId(kind, rawId, rawTarget) {
 function parseSlackTarget(raw, options = {}) {
 	const trimmed = raw.trim();
 	if (!trimmed) return;
+	const qualifiedTarget = parseQualifiedSlackTarget(trimmed);
+	if (qualifiedTarget) return qualifiedTarget;
 	const userTarget = parseMentionPrefixOrAtUserTarget({
 		raw: trimmed,
 		mentionPattern: /^<@([A-Z0-9]+)>$/i,
@@ -66,8 +103,9 @@ function looksLikeSlackTargetId(raw) {
 	if (/^<@([A-Z0-9]+)>$/i.test(trimmed)) return true;
 	if (/^(user|channel):/i.test(trimmed)) return true;
 	if (/^slack:/i.test(trimmed)) return true;
+	if (/^team:/i.test(trimmed)) return true;
 	if (/^[@#]/.test(trimmed)) return true;
 	return /^[CUWGD][A-Z0-9]{8,}$/i.test(trimmed);
 }
 //#endregion
-export { resolveSlackChannelId as a, parseSlackTarget as i, looksLikeSlackTargetId as n, slackTargetsMatch as o, normalizeSlackMessagingTarget as r, canonicalizeSlackApiTargetId as t };
+export { parseSlackTarget as a, normalizeSlackMessagingTarget as i, formatSlackTarget as n, resolveSlackChannelId as o, looksLikeSlackTargetId as r, slackTargetsMatch as s, canonicalizeSlackApiTargetId as t };

package/dist/{targets-KmjP2E8s.js → targets-Cx5W_n3W.js}

@@ -1,4 +1,4 @@
-import { i as parseSlackTarget, o as slackTargetsMatch } from "./target-parsing-N6lHogYZ.js";
+import { a as parseSlackTarget, s as slackTargetsMatch } from "./target-parsing-BnMD2ZqZ.js";
 //#region extensions/slack/src/targets.ts
 function matchesResolvedUserTarget(target, currentMessagingTarget) {
 	const resolvedId = target.trim();

package/node_modules/@slack/bolt/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Wed, 08 Jul 2026 06:47:45 GMT
+ * Last updated: Mon, 27 Jul 2026 17:32:10 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@slack/bolt/node_modules/@types/node/crypto.d.ts

@@ -1185,7 +1185,7 @@ declare module "node:crypto" {
      * and it will be impossible to extract the private key from the returned object.
      * @since v11.6.0
      */
-    function createPublicKey(key: PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | BinaryLike): KeyObject;
+    function createPublicKey(key: PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | KeyLike): KeyObject;
     /**
      * Creates and returns a new key object containing a secret key for symmetric
      * encryption or `Hmac`.

package/node_modules/@slack/bolt/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "26.1.1",
+    "version": "26.1.2",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~8.3.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "a59119b073061829bc67a5bf6bc2b8ecb0a5a6196058e3c73172a00440f4e16d",
+    "typesPublisherContentHash": "359a01a58cecf5a30fb7b7a7b10c4f5c332339421ef5cbc9932fc492f472a5b4",
     "typeScriptVersion": "5.6"
 }

package/node_modules/@slack/socket-mode/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Wed, 08 Jul 2026 06:47:45 GMT
+ * Last updated: Mon, 27 Jul 2026 17:32:10 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@slack/socket-mode/node_modules/@types/node/crypto.d.ts

@@ -1185,7 +1185,7 @@ declare module "node:crypto" {
      * and it will be impossible to extract the private key from the returned object.
      * @since v11.6.0
      */
-    function createPublicKey(key: PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | BinaryLike): KeyObject;
+    function createPublicKey(key: PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | KeyLike): KeyObject;
     /**
      * Creates and returns a new key object containing a secret key for symmetric
      * encryption or `Hmac`.

package/node_modules/@slack/socket-mode/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "26.1.1",
+    "version": "26.1.2",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~8.3.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "a59119b073061829bc67a5bf6bc2b8ecb0a5a6196058e3c73172a00440f4e16d",
+    "typesPublisherContentHash": "359a01a58cecf5a30fb7b7a7b10c4f5c332339421ef5cbc9932fc492f472a5b4",
     "typeScriptVersion": "5.6"
 }

package/node_modules/@slack/web-api/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Wed, 08 Jul 2026 06:47:45 GMT
+ * Last updated: Mon, 27 Jul 2026 17:32:10 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@slack/web-api/node_modules/@types/node/crypto.d.ts

@@ -1185,7 +1185,7 @@ declare module "node:crypto" {
      * and it will be impossible to extract the private key from the returned object.
      * @since v11.6.0
      */
-    function createPublicKey(key: PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | BinaryLike): KeyObject;
+    function createPublicKey(key: PublicKeyInput | RawPublicKeyInput | JsonWebKeyInput | KeyLike): KeyObject;
     /**
      * Creates and returns a new key object containing a secret key for symmetric
      * encryption or `Hmac`.

package/node_modules/@slack/web-api/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "26.1.1",
+    "version": "26.1.2",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~8.3.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "a59119b073061829bc67a5bf6bc2b8ecb0a5a6196058e3c73172a00440f4e16d",
+    "typesPublisherContentHash": "359a01a58cecf5a30fb7b7a7b10c4f5c332339421ef5cbc9932fc492f472a5b4",
     "typeScriptVersion": "5.6"
 }

package/node_modules/undici/lib/cache/memory-cache-store.js

@@ -218,17 +218,62 @@ class MemoryCacheStore extends EventEmitter {
 }
 
 function findEntry (key, entries, now) {
-  return entries.find((entry) => (
-    entry.deleteAt > now &&
-    entry.method === key.method &&
-    (entry.vary == null || Object.keys(entry.vary).every(headerName => {
-      if (entry.vary[headerName] === null) {
-        return key.headers[headerName] === undefined
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i]
+    if (
+      entry.deleteAt > now &&
+      entry.method === key.method &&
+      varyMatches(key, entry)
+    ) {
+      return entry
+    }
+  }
+}
+
+function varyMatches (key, entry) {
+  if (entry.vary == null) {
+    return true
+  }
+
+  for (const headerName in entry.vary) {
+    if (Object.hasOwn(entry.vary, headerName) && !headerValueEquals(key.headers?.[headerName], entry.vary[headerName])) {
+      return false
+    }
+  }
+
+  return true
+}
+
+/**
+ * @param {string|string[]|null|undefined} lhs
+ * @param {string|string[]|null|undefined} rhs
+ * @returns {boolean}
+ */
+function headerValueEquals (lhs, rhs) {
+  if (lhs == null && rhs == null) {
+    return true
+  }
+
+  if ((lhs == null && rhs != null) ||
+      (lhs != null && rhs == null)) {
+    return false
+  }
+
+  if (Array.isArray(lhs) && Array.isArray(rhs)) {
+    if (lhs.length !== rhs.length) {
+      return false
+    }
+
+    for (let i = 0; i < lhs.length; i++) {
+      if (lhs[i] !== rhs[i]) {
+        return false
       }
+    }
+
+    return true
+  }
 
-      return entry.vary[headerName] === key.headers[headerName]
-    }))
-  ))
+  return lhs === rhs
 }
 
 module.exports = MemoryCacheStore

package/node_modules/undici/lib/cache/sqlite-cache-store.js

@@ -454,7 +454,13 @@ function headerValueEquals (lhs, rhs) {
       return false
     }
 
-    return lhs.every((x, i) => x === rhs[i])
+    for (let i = 0; i < lhs.length; i++) {
+      if (lhs[i] !== rhs[i]) {
+        return false
+      }
+    }
+
+    return true
   }
 
   return lhs === rhs

package/node_modules/undici/lib/core/request.js

@@ -390,7 +390,13 @@ function processHeader (request, key, val) {
       } else if (typeof val[i] === 'object') {
         throw new InvalidArgumentError(`invalid ${key} header`)
       } else {
-        arr.push(`${val[i]}`)
+        // Coerce primitives (and reject unsafe coercions such as functions
+        // with a crafted toString/Symbol.toPrimitive).
+        const str = `${val[i]}`
+        if (!isValidHeaderValue(str)) {
+          throw new InvalidArgumentError(`invalid ${key} header`)
+        }
+        arr.push(str)
       }
     }
     val = arr
@@ -401,7 +407,12 @@ function processHeader (request, key, val) {
   } else if (val === null) {
     val = ''
   } else {
+    // Coerce primitives (and reject unsafe coercions such as functions
+    // with a crafted toString/Symbol.toPrimitive).
     val = `${val}`
+    if (!isValidHeaderValue(val)) {
+      throw new InvalidArgumentError(`invalid ${key} header`)
+    }
   }
 
   if (headerName === 'host') {

package/node_modules/undici/lib/dispatcher/client-h1.js

@@ -10,6 +10,7 @@ const {
   RequestContentLengthMismatchError,
   ResponseContentLengthMismatchError,
   RequestAbortedError,
+  InvalidArgumentError,
   HeadersTimeoutError,
   HeadersOverflowError,
   SocketError,
@@ -1134,8 +1135,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }
 
   if (body && typeof body.read === 'function') {