Merge branch 'main' into docs-clenaup

Author: lukegalbraithrussell

.github/SECURITY.md

@@ -0,0 +1,63 @@
+# Security Policy
+
+Slack takes the security of its software and services seriously, including all open-source repositories managed through the [slackapi](https://github.com/slackapi) GitHub organization.
+
+## Reporting a Vulnerability
+
+**Do NOT report security vulnerabilities through public GitHub issues, pull requests, or discussions.**
+
+If you believe you have found a security vulnerability in `slack-bolt`, please report it through the Slack bug bounty program on HackerOne:
+
+**<https://hackerone.com/slack>**
+
+Even if `slack-bolt` is not explicitly listed as an in-scope asset on the HackerOne program page, reports for vulnerabilities in this package should still be submitted there. The Slack security team triages reports for all `slackapi` open-source repositories through this program.
+
+If HackerOne is inaccessible, you may alternatively report the issue to [security@salesforce.com](mailto:security@salesforce.com).
+
+Please do not discuss potential vulnerabilities in public without first coordinating with the security team.
+
+## What to Include
+
+To help us triage and respond quickly, please include:
+
+- Type of vulnerability (e.g., signature bypass, token leakage, denial of service)
+- Affected version(s) of `slack-bolt`
+- Step-by-step reproduction instructions
+- Proof-of-concept code or payloads, if available
+- Impact assessment: what an attacker could achieve
+- Any specific configuration required to trigger the vulnerability
+- Affected source file paths, if known
+
+## Threat Model
+
+Bolt for Python is a framework that sits between the Slack platform and developer application code. Its security boundary covers the integrity and confidentiality of that interface.
+
+### In Scope
+
+The following are considered framework vulnerabilities:
+
+- Bypass of request signature verification (HMAC-SHA256 validation)
+- OAuth token leakage or cross-tenant token exposure during authorization flows
+- Denial of service caused by malformed or specially crafted payloads processed by framework internals
+- Authentication or authorization bypass in any built-in adapter
+- Information disclosure through framework error responses or timing side channels
+- Bypass of the `ssl_check` endpoint protections
+
+### Out of Scope
+
+The following are NOT framework vulnerabilities:
+
+- Vulnerabilities in the Python runtime, operating system, or hosting infrastructure
+- Security issues in developer application logic built on top of Bolt (e.g., SQL injection caused by passing unsanitized payload data to a database)
+- Vulnerabilities in third-party PyPI packages chosen and installed by the developer outside of Bolt's direct dependencies
+- Vulnerabilities in Slack's server-side platform infrastructure (report those directly under Slack's main HackerOne scope)
+- Attacks that require possession of a valid signing secret or bot token
+- Arbitrary attribute injection or unsafe deserialization caused by developer code handling untrusted input
+- Issues that only affect end-of-life versions with no reproduction on supported versions
+
+## Disclosure Policy
+
+This project follows coordinated disclosure:
+
+- Allow a reasonable timeframe for the team to investigate, develop, and release a fix before any public disclosure.
+- Researchers who follow responsible disclosure practices are eligible for recognition and bounty consideration through the Slack HackerOne program.

.github/maintainers_guide.md

@@ -71,8 +71,8 @@ If you make changes to `slack_bolt/adapter/*`, please verify if it surely works
 
 ```sh
 # Install all optional dependencies
-$ pip install -r requirements/adapter.txt
-$ pip install -r requirements/adapter_testing.txt
+$ pip install -r requirements/adapter_dev.txt
+$ pip install -r requirements/test_adapter.txt
 
 # Set required env variables
 $ export SLACK_SIGNING_SECRET=***

.github/workflows/ci-build.yml

@@ -48,13 +48,13 @@ jobs:
         run: |
           pip install -U pip
           pip install -U .
-          pip install -r requirements/tools.txt
+          pip install -r requirements/dev_tools.txt
       - name: Type check synchronous modules
         run: mypy --config-file pyproject.toml --exclude "async_|/adapter/"
       - name: Install async and adapter dependencies
         run: |
-          pip install -r requirements/async.txt
-          pip install -r requirements/adapter.txt
+          pip install -r requirements/async_dev.txt
+          pip install -r requirements/adapter_dev.txt
       - name: Type check all modules
         run: mypy --config-file pyproject.toml
 
@@ -88,15 +88,15 @@ jobs:
         run: |
           pip install -U pip
           pip install .
-          pip install -r requirements/testing_without_asyncio.txt
+          pip install -r requirements/test.txt
       - name: Run tests without aiohttp
         run: |
           pytest tests/slack_bolt/ --junitxml=reports/test_slack_bolt.xml
           pytest tests/scenario_tests/ --junitxml=reports/test_scenario.xml
       - name: Install adapter dependencies
         run: |
-          pip install -r requirements/adapter.txt
-          pip install -r requirements/adapter_testing.txt
+          pip install -r requirements/adapter_dev.txt
+          pip install -r requirements/test_adapter.txt
       - name: Run tests for HTTP Mode adapters
         run: |
           pytest tests/adapter_tests/ \
@@ -105,14 +105,14 @@ jobs:
           --junitxml=reports/test_adapter.xml
       - name: Install async dependencies
         run: |
-          pip install -r requirements/async.txt
+          pip install -r requirements/async_dev.txt
       - name: Run tests for Socket Mode adapters
         run: |
           # Requires async test dependencies
           pytest tests/adapter_tests/socket_mode/ --junitxml=reports/test_adapter_socket_mode.xml
       - name: Install all dependencies
         run: |
-          pip install -r requirements/testing.txt
+          pip install -r requirements/test_async.txt
       - name: Run tests for HTTP Mode adapters (ASGI)
         run: |
           # Requires async test dependencies
@@ -155,9 +155,9 @@ jobs:
         run: |
           pip install -U pip
           pip install .
-          pip install -r requirements/adapter.txt
-          pip install -r requirements/testing.txt
-          pip install -r requirements/adapter_testing.txt
+          pip install -r requirements/adapter_dev.txt
+          pip install -r requirements/test_async.txt
+          pip install -r requirements/test_adapter.txt
       - name: Run all tests for codecov
         run: |
           pytest --cov=./slack_bolt/ --cov-report=xml
@@ -179,7 +179,7 @@ jobs:
     if: ${{ !success() && github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' }}
     steps:
       - name: Send notifications of failing tests
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           errors: true
           webhook: ${{ secrets.SLACK_REGRESSION_FAILURES_WEBHOOK_URL }}

.github/workflows/dependencies.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Collect metadata
         id: metadata
-        uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Approve

.github/workflows/pypi-release.yml

@@ -33,7 +33,7 @@ jobs:
           scripts/build_pypi_package.sh
 
       - name: Persist dist folder
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-dist
           path: dist/
@@ -60,7 +60,7 @@ jobs:
       - name: Publish release distributions to test.pypi.org
         # Using OIDC for PyPI publishing (no API tokens needed)
         # See: https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-pypi
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -84,4 +84,4 @@ jobs:
       - name: Publish release distributions to pypi.org
         # Using OIDC for PyPI publishing (no API tokens needed)
         # See: https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-pypi
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

AGENTS.md

@@ -183,7 +183,7 @@ Then wire it into `BoltContext` (`slack_bolt/context/context.py`) and `AsyncBolt
 1. Create `slack_bolt/adapter/<framework>/`
 2. Add `__init__.py` and `handler.py` (or `async_handler.py` for async frameworks)
 3. The handler converts the framework's request to `BoltRequest`, calls `app.dispatch()`, and converts `BoltResponse` back
-4. Add the framework to `requirements/adapter.txt` with version constraints
+4. Add the framework to `requirements/adapter_dev.txt` with version constraints
 5. Add adapter tests in `tests/adapter_tests/` (sync) or `tests/adapter_tests_async/` (async)
 
 ### Adding a Kwargs-Injectable Argument
@@ -205,12 +205,12 @@ The core package has a **single required runtime dependency**: `slack_sdk` (defi
 
 **`requirements/` directory structure:**
 
-- `async.txt` -- async runtime deps (`aiohttp`, `websockets`)
-- `adapter.txt` -- all framework adapter deps (Flask, Django, FastAPI, etc.)
-- `testing.txt` -- test runner deps (`pytest`, `pytest-asyncio`, includes `async.txt`)
-- `testing_without_asyncio.txt` -- test deps without async (`pytest`, `pytest-cov`)
-- `adapter_testing.txt` -- adapter-specific test deps (`moto`, `boddle`, `sanic-testing`)
-- `tools.txt` -- dev tools (`mypy`, `flake8`, `black`)
+- `async_dev.txt` -- async runtime deps (`aiohttp`, `websockets`)
+- `adapter_dev.txt` -- all framework adapter deps (Flask, Django, FastAPI, etc.)
+- `test_async.txt` -- test runner deps (`pytest`, `pytest-asyncio`, includes `async_dev.txt`)
+- `test.txt` -- test deps without async (`pytest`, `pytest-cov`)
+- `test_adapter.txt` -- adapter-specific test deps (`moto`, `boddle`, `sanic-testing`)
+- `dev_tools.txt` -- dev tools (`mypy`, `flake8`, `black`)
 
 When adding a new dependency: add it to the appropriate `requirements/*.txt` file with version constraints, never to `pyproject.toml` `dependencies` (unless it's a core runtime dep, which is very rare).
 

pyproject.toml

@@ -26,6 +26,7 @@ dependencies = ["slack_sdk>=3.38.0,<4"]
 
 [project.urls]
 Documentation = "https://docs.slack.dev/tools/bolt-python/"
+Source = "https://github.com/slackapi/bolt-python"
 
 [tool.setuptools.packages.find]
 include = ["slack_bolt*"]

requirements/adapter.txt requirements/adapter_dev.txtrequirements/adapter.txt renamed to requirements/adapter_dev.txt

@@ -1,28 +1,33 @@
-# pip install -r requirements/adapter.txt
-# NOTE: any of async ones requires pip install -r requirements/async.txt too
+# pip install -r requirements/adapter_dev.txt
+# NOTE: any of async ones requires pip install -r requirements/async_dev.txt too
 # used only under slack_bolt/adapter
 boto3<=2
 bottle>=0.12,<1
-chalice>=1.28,<2;
+chalice>=1.28,<1.31; python_version<"3.9"
+chalice>=1.32.0,<2; python_version>="3.9"
 cheroot<12
 CherryPy>=18,<19
-Django>=3,<6
-falcon>=2,<5; python_version<"3.11"
-falcon>=3.1.1,<5; python_version>="3.11"
+Django>=3.2,<4; python_version<"3.8"
+Django>=4.2.30,<6; python_version>="3.8"
+falcon>=2,<4; python_version<"3.9"
+falcon>=4.2.0,<5; python_version>="3.9"
 fastapi>=0.70.0,<1
 Flask>=1,<4
-Werkzeug>=2,<4
+Werkzeug>=2,<3; python_version<"3.9"
+Werkzeug>=3.1.8,<4; python_version>="3.9"
 pyramid>=1,<3
 setuptools<82  # Pinned: Pyramid depends on pkg_resources (deprecated in setuptools 67.5.0, removed in 82+). See: https://github.com/Pylons/pyramid/issues/3731
 
 # Sanic and its dependencies
 # Note: Sanic imports tracerite with wild card versions
 tracerite<1.1.2; python_version<="3.8"  # older versions of python are not compatible with tracerite>1.1.2
 sanic>=21,<24; python_version<="3.8"
-sanic>=21,<26; python_version>"3.8"
+sanic>=25.3.0,<26; python_version>"3.8"
 
-starlette>=0.19.1,<1
-tornado>=6,<7
+starlette>=0.19.1,<0.45; python_version<"3.9"
+starlette>=0.49.3,<1; python_version>="3.9"
+tornado>=6.2,<7; python_version<"3.9"
+tornado>=6.5.6,<7; python_version>="3.9"
 uvicorn<1                                # The oldest version can vary among Python runtime versions
-gunicorn>=20,<24
+gunicorn>=23.0.0,<24
 websocket_client>=1.2.3,<2               # Socket Mode 3rd party implementation

requirements/async.txt

@@ -0,0 +1,3 @@
+# pip install -r requirements/async_dev.txt
+aiohttp>=3,<4
+websockets<16