@openclaw/slack 2026.8.1 → 2026.8.33

package/node_modules/@slack/bolt/node_modules/negotiator/package.json

@@ -1,7 +1,7 @@
 {
   "name": "negotiator",
   "description": "HTTP content negotiation",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Federico Romero <federico.romero@outboxlabs.com>",
@@ -17,27 +17,33 @@
     "accept-charset"
   ],
   "repository": "jshttp/negotiator",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
+  "dependencies": {
+    "content-type": "^2.1.0"
+  },
   "devDependencies": {
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
-    "mocha": "9.1.3",
-    "nyc": "15.1.0"
+    "mocha": "^11.7.0",
+    "nyc": "^17.1.0",
+    "vitest": "3.2.4"
   },
   "files": [
     "lib/",
-    "HISTORY.md",
-    "LICENSE",
-    "index.js",
-    "README.md"
+    "index.js"
   ],
   "engines": {
-    "node": ">= 0.6"
+    "node": ">=18"
   },
   "scripts": {
+    "bench": "vitest bench",
     "lint": "eslint .",
-    "test": "mocha --reporter spec --check-leaks --bail test/",
+    "test": "mocha --reporter spec --check-leaks test/",
     "test:debug": "mocha --reporter spec --check-leaks --inspect --inspect-brk test/",
-    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
+    "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
     "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

package/node_modules/@slack/bolt/node_modules/proxy-addr/HISTORY.md

@@ -1,144 +1,150 @@
-2.0.7 / 2021-05-31
-==================
+2.0.8
+=====
+
+  * Fix [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) ([GHSA-jqcg-44mw-7w3h](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h))
+
+
+2.0.7
+=====
 
   * deps: forwarded@0.2.0
     - Use `req.socket` over deprecated `req.connection`
 
-2.0.6 / 2020-02-24
-==================
+2.0.6
+=====
 
   * deps: ipaddr.js@1.9.1
 
-2.0.5 / 2019-04-16
-==================
+2.0.5
+=====
 
   * deps: ipaddr.js@1.9.0
 
-2.0.4 / 2018-07-26
-==================
+2.0.4
+=====
 
   * deps: ipaddr.js@1.8.0
 
-2.0.3 / 2018-02-19
-==================
+2.0.3
+=====
 
   * deps: ipaddr.js@1.6.0
 
-2.0.2 / 2017-09-24
-==================
+2.0.2
+=====
 
   * deps: forwarded@~0.1.2
     - perf: improve header parsing
     - perf: reduce overhead when no `X-Forwarded-For` header
 
-2.0.1 / 2017-09-10
-==================
+2.0.1
+=====
 
   * deps: forwarded@~0.1.1
     - Fix trimming leading / trailing OWS
     - perf: hoist regular expression
   * deps: ipaddr.js@1.5.2
 
-2.0.0 / 2017-08-08
-==================
+2.0.0
+=====
 
   * Drop support for Node.js below 0.10
 
-1.1.5 / 2017-07-25
-==================
+1.1.5
+=====
 
   * Fix array argument being altered
   * deps: ipaddr.js@1.4.0
 
-1.1.4 / 2017-03-24
-==================
+1.1.4
+=====
 
   * deps: ipaddr.js@1.3.0
 
-1.1.3 / 2017-01-14
-==================
+1.1.3
+=====
 
   * deps: ipaddr.js@1.2.0
 
-1.1.2 / 2016-05-29
-==================
+1.1.2
+=====
 
   * deps: ipaddr.js@1.1.1
     - Fix IPv6-mapped IPv4 validation edge cases
 
-1.1.1 / 2016-05-03
-==================
+1.1.1
+=====
 
   * Fix regression matching mixed versions against multiple subnets
 
-1.1.0 / 2016-05-01
-==================
+1.1.0
+=====
 
   * Fix accepting various invalid netmasks
     - IPv4 netmasks must be contingous
     - IPv6 addresses cannot be used as a netmask
   * deps: ipaddr.js@1.1.0
 
-1.0.10 / 2015-12-09
-===================
+1.0.10
+======
 
   * deps: ipaddr.js@1.0.5
     - Fix regression in `isValid` with non-string arguments
 
-1.0.9 / 2015-12-01
-==================
+1.0.9
+=====
 
   * deps: ipaddr.js@1.0.4
     - Fix accepting some invalid IPv6 addresses
     - Reject CIDRs with negative or overlong masks
   * perf: enable strict mode
 
-1.0.8 / 2015-05-10
-==================
+1.0.8
+=====
 
   * deps: ipaddr.js@1.0.1
 
-1.0.7 / 2015-03-16
-==================
+1.0.7
+=====
 
   * deps: ipaddr.js@0.1.9
     - Fix OOM on certain inputs to `isValid`
 
-1.0.6 / 2015-02-01
-==================
+1.0.6
+=====
 
   * deps: ipaddr.js@0.1.8
 
-1.0.5 / 2015-01-08
-==================
+1.0.5
+=====
 
   * deps: ipaddr.js@0.1.6
 
-1.0.4 / 2014-11-23
-==================
+1.0.4
+=====
 
   * deps: ipaddr.js@0.1.5
     - Fix edge cases with `isValid`
 
-1.0.3 / 2014-09-21
-==================
+1.0.3
+=====
 
   * Use `forwarded` npm module
 
-1.0.2 / 2014-09-18
-==================
+1.0.2
+=====
 
   * Fix a global leak when multiple subnets are trusted
   * Support Node.js 0.6
   * deps: ipaddr.js@0.1.3
 
-1.0.1 / 2014-06-03
-==================
+1.0.1
+=====
 
   * Fix links in npm package
 
-1.0.0 / 2014-05-08
-==================
+1.0.0
+=====
 
   * Add `trust` argument to determine proxy trust on
     * Accepts custom function
@@ -150,12 +156,12 @@
   * Add `proxyaddr.compile` to pre-compile `trust` function
     to make subsequent calls faster
 
-0.0.1 / 2014-05-04
-==================
+0.0.1
+=====
 
   * Fix bad npm publish
 
-0.0.0 / 2014-05-04
-==================
+0.0.0
+=====
 
   * Initial release

package/node_modules/@slack/bolt/node_modules/proxy-addr/README.md

@@ -37,7 +37,7 @@ proxyaddr(req, function (addr) { return addr === '127.0.0.1' })
 proxyaddr(req, function (addr, i) { return i < 1 })
 ```
 
-The `trust` arugment may also be a single IP address string or an
+The `trust` argument may also be a single IP address string or an
 array of trusted addresses, as plain IP addresses, CIDR-formatted
 strings, or IP/netmask strings.
 

package/node_modules/@slack/bolt/node_modules/proxy-addr/index.js

@@ -256,6 +256,13 @@ function trustMulti (subnets) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var ipconv
     var kind = ip.kind()
 
@@ -272,6 +279,12 @@ function trustMulti (subnets) {
           continue
         }
 
+        if (subnetkind !== 'ipv4' && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+          // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+          // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+          continue
+        }
+
         if (!ipconv) {
           // Convert IP to match subnet IP kind
           ipconv = subnetkind === 'ipv4'
@@ -280,6 +293,9 @@ function trustMulti (subnets) {
         }
 
         trusted = ipconv
+      } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+        // A native IPv6 candidate cannot match an IPv4-mapped subnet
+        continue
       }
 
       if (trusted.match(subnetip, subnetrange)) {
@@ -308,6 +324,13 @@ function trustSingle (subnet) {
     if (!isip(addr)) return false
 
     var ip = parseip(addr)
+
+    if (ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
+      // Canonicalize IPv4-mapped candidates to IPv4 so a mapped address
+      // cannot bypass the cross-family guard via the same-family path
+      ip = ip.toIPv4Address()
+    }
+
     var kind = ip.kind()
 
     if (kind !== subnetkind) {
@@ -316,10 +339,19 @@ function trustSingle (subnet) {
         return false
       }
 
+      if (!subnetisipv4 && !(subnetrange >= 96 && subnetip.isIPv4MappedAddress())) {
+        // IPv6 subnet only spans IPv4 when it is a mapped subnet whose
+        // prefix covers the ::ffff: marker; otherwise it must not match IPv4
+        return false
+      }
+
       // Convert IP to match subnet IP kind
       ip = subnetisipv4
         ? ip.toIPv4Address()
         : ip.toIPv4MappedAddress()
+    } else if (kind === 'ipv6' && subnetip.isIPv4MappedAddress()) {
+      // A native IPv6 candidate cannot match an IPv4-mapped subnet
+      return false
     }
 
     return ip.match(subnetip, subnetrange)

package/node_modules/@slack/bolt/node_modules/proxy-addr/package.json

@@ -1,7 +1,7 @@
 {
   "name": "proxy-addr",
   "description": "Determine address of proxied request",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "keywords": [
@@ -10,6 +10,10 @@
     "x-forwarded-for"
   ],
   "repository": "jshttp/proxy-addr",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "dependencies": {
     "forwarded": "0.2.0",
     "ipaddr.js": "1.9.1"
@@ -17,11 +21,11 @@
   "devDependencies": {
     "benchmark": "2.1.4",
     "beautify-benchmark": "0.2.4",
-    "deep-equal": "1.0.1",
+    "deep-equal": "1.1.2",
     "eslint": "7.26.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.23.4",
-    "eslint-plugin-markdown": "2.2.0",
+    "eslint-plugin-import": "2.32.0",
+    "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
     "eslint-plugin-promise": "4.3.1",
     "eslint-plugin-standard": "4.1.0",

package/node_modules/typebox/build/format/email.mjs

@@ -1,4 +1,4 @@
-const Email = /^(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[^"\\]|\\.)*")@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*|\[(?:IPv6:[a-f0-9:]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3})\])$/i;
+const Email = /^(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[^"\\]|\\[\x20-\x7e])*")@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*|\[(?:IPv6:[a-f0-9:]+|(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3})\])$/i;
 /**
  * Returns true if the value is an Email
  * @specification https://datatracker.ietf.org/doc/html/rfc5322

package/node_modules/typebox/build/format/idna/idn-hostname.mjs

@@ -1,6 +1,9 @@
 import * as FormatBidi from './format/bidi.mjs';
 import * as LabelUnicode from './label/unicode.mjs';
 import * as LabelPuny from './label/puny.mjs';
+// ------------------------------------------------------------------
+// IsLabel
+// ------------------------------------------------------------------
 function IsValidLabelLength(value) {
     return value.length > 0 && value.length <= 63;
 }
@@ -8,9 +11,24 @@ function IsLabel(value) {
     return IsValidLabelLength(value) && (LabelPuny.IsPunyLabel(value) ||
         LabelUnicode.IsUnicodeLabel(value));
 }
+// ------------------------------------------------------------------
+// NormalizeHostname
+//
+// Normalizes a hostname for label validation. Normalizes for NFC
+// such that equivalent codepoint sequences can be uniformly
+// compared. It also removes codepoints that IDNA mapping ignores,
+// and converts full stop variants to ASCII '.' so the hostname can
+// be split into labels.
+// ------------------------------------------------------------------
 function NormalizeHostname(value) {
-    return value.normalize('NFC').replace(/[\u002E\u3002\uFF0E\uFF61]/g, '.');
+    return value
+        .normalize('NFC')
+        .replace(/[\u00ad\u034f\u180b-\u180d\u200b\ufe00-\ufe0f\u{e0100}-\u{e01ef}]/gu, '') // RE_IGNORED_MAPPING
+        .replace(/[\u002E\u3002\uFF0E\uFF61]/g, '.'); // RE_FULL_STOP_MAPPING
 }
+// ------------------------------------------------------------------
+// IsIdnHostname
+// ------------------------------------------------------------------
 export function IsIdnHostname(value) {
     if (value.length === 0 || value.includes(' '))
         return false;

package/node_modules/typebox/package.json

@@ -1,7 +1,7 @@
 {
   "name": "typebox",
   "description": "Json Schema Type Builder with Static Type Resolution for TypeScript",
-  "version": "1.3.16",
+  "version": "1.3.17",
   "keywords": [
     "typescript",
     "jsonschema"

package/node_modules/undici/lib/dispatcher/balanced-pool.js

@@ -49,14 +49,16 @@ function defaultFactory (origin, opts) {
 }
 
 class BalancedPool extends PoolBase {
-  constructor (upstreams = [], { factory = defaultFactory, ...opts } = {}) {
+  constructor (upstreams = [], { factory = defaultFactory, connect, tls, ...opts } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
 
     super(opts)
 
-    this[kOptions] = { ...util.deepClone(opts) }
+    if (connect && typeof connect !== 'function') connect = { ...connect }
+    if (tls && typeof tls !== 'function') tls = { ...tls }
+    this[kOptions] = { ...util.deepClone(opts), connect, tls }
     this[kOptions].interceptors = opts.interceptors
       ? { ...opts.interceptors }
       : undefined

package/node_modules/undici/lib/dispatcher/client-h1.js

@@ -1012,7 +1012,7 @@ function onSocketClose () {
 
 function clearIdleSocketValidation (socket) {
   if (socket[kIdleSocketValidationTimeout]) {
-    clearTimeout(socket[kIdleSocketValidationTimeout])
+    clearImmediate(socket[kIdleSocketValidationTimeout])
     socket[kIdleSocketValidationTimeout] = null
   }
 
@@ -1021,15 +1021,23 @@ function clearIdleSocketValidation (socket) {
 
 function scheduleIdleSocketValidation (client, socket) {
   socket[kIdleSocketValidation] = 1
-  socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+  // Yield to the check phase (after poll) so unsolicited bytes / FIN / RST
+  // already pending on this idle keep-alive socket are processed before the
+  // next request is written (GHSA-35p6-xmwp-9g52).
+  //
+  // setTimeout(0) pays Node's ~1ms timer floor on every sequential reuse
+  // (#5493). setImmediate avoids that, but an *unref'd* Immediate lets poll
+  // block for ~500ms when the event loop is otherwise idle (#5600 / #5606).
+  // A ref'd Immediate both keeps the pending request alive and makes poll
+  // return immediately — the hybrid those issues asked for.
+  socket[kIdleSocketValidationTimeout] = setImmediate(() => {
     socket[kIdleSocketValidationTimeout] = null
     socket[kIdleSocketValidation] = 2
 
     if (client[kSocket] === socket && !socket.destroyed) {
       client[kResume]()
     }
-  }, 0)
-  socket[kIdleSocketValidationTimeout].unref?.()
+  })
 }
 
 /**