npm / @slack/bolt
@slack/bolt
What changed in @slack/bolt 4 to 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
9 breaking1 deprecations4 new APIs and options1 behavior and defaults3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@slack/bolt 517 changes
Breaking changes 8
HTTPReceiver and ExpressReceiver reject request bodies larger than 4 MB by default with HTTP 413 before buffering; apps can configure bodyLimit to allow larger payloads or disable the limit.
When no logger option is provided, the default receiver shares the same Logger instance as app.logger, so changing its level after construction affects receiver-side logging too.
The agent option is removed; use clientOptions.fetch to provide a custom fetch implementation for proxy or TLS needs.
The clientTls option is removed; use clientOptions.fetch to provide a custom fetch implementation for proxy or TLS needs.
The unused trailing callback parameter is removed from the AwsHandler type.
The minimum required runtime is Node.js 20; npm must be at least 9.6.4.
respond() uses native fetch for response_url calls, throws RespondError for non-2xx responses, and resolves to a Response on success instead of an axios response object.
The deprecated WorkflowStep class and its associated types, middleware, and utilities are removed. Use CustomFunction and app.function() instead.
Deprecations 1
The legacy AwsCallback export is retained and marked deprecated.
New APIs and options 4
Use clientOptions.fetch to provide a custom fetch implementation for proxy or TLS needs.
context_enterprise_id is added as an optional field for envelopes delivered for Slack Connect channels and Enterprise Grid org-wide apps.
context_team_id is added as an optional field so typed code can route events by the correct workspace.
A dispatcher option is added for proxy or TLS configuration in socket mode.
Behavior and default changes 1
Default error handlers log richer details for web-api errors, including API error codes, rate limit durations, and HTTP status codes, alongside the full error object.
Fixes and other changes 3
The type now allows null, matching AWS API Gateway payloads and APIGatewayProxyEvent so events can be passed directly to an AwsLambdaReceiver handler without a type error.
Authorization errors are now wrapped in AuthorizationError, preserving the original thrown value; non-Error rejections are retained via the wrapped original's cause.
toHandler() returns a 2-argument promise-based function, preventing startup failure on AWS Lambda Node.js 24+.
@slack/bolt 41 changes
Breaking changes 1
Empty signingSecret values are rejected at initialization to prevent accidental HMAC signature forgery.