# What changed in @slack/bolt

> 18 changes in @slack/bolt 4 to 5 from its official release notes, upgrade guides and advisories: 9 breaking, 1 deprecations, 4 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@slack/bolt/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @slack/bolt 5

### Breaking changes

- HTTPReceiver and ExpressReceiver reject request bodies larger than 4 MB by default with HTTP 413 before buffering; apps can configure bodyLimit to allow larger payloads or disable the limit. (5.1.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.1.0)
- When no logger option is provided, the default receiver shares the same Logger instance as app.logger, so changing its level after construction affects receiver-side logging too. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- The agent option is removed; use clientOptions.fetch to provide a custom fetch implementation for proxy or TLS needs. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- The clientTls option is removed; use clientOptions.fetch to provide a custom fetch implementation for proxy or TLS needs. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- The unused trailing callback parameter is removed from the AwsHandler type. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- The minimum required runtime is Node.js 20; npm must be at least 9.6.4. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- respond() uses native fetch for response_url calls, throws RespondError for non-2xx responses, and resolves to a Response on success instead of an axios response object. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- The deprecated WorkflowStep class and its associated types, middleware, and utilities are removed. Use CustomFunction and app.function() instead. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)

### Deprecations

- The legacy AwsCallback export is retained and marked deprecated. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)

### New APIs and options

- Use clientOptions.fetch to provide a custom fetch implementation for proxy or TLS needs. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- context_enterprise_id is added as an optional field for envelopes delivered for Slack Connect channels and Enterprise Grid org-wide apps. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- context_team_id is added as an optional field so typed code can route events by the correct workspace. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- A dispatcher option is added for proxy or TLS configuration in socket mode. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)

### Behavior and default changes

- Default error handlers log richer details for web-api errors, including API error codes, rate limit durations, and HTTP status codes, alongside the full error object. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)

### Fixes and other changes

- The type now allows null, matching AWS API Gateway payloads and APIGatewayProxyEvent so events can be passed directly to an AwsLambdaReceiver handler without a type error. (5.1.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.1.0)
- Authorization errors are now wrapped in AuthorizationError, preserving the original thrown value; non-Error rejections are retained via the wrapped original's cause. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)
- toHandler() returns a 2-argument promise-based function, preventing startup failure on AWS Lambda Node.js 24+. (5.0.0) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v5.0.0)

## @slack/bolt 4

### Breaking changes

- Empty signingSecret values are rejected at initialization to prevent accidental HMAC signature forgery. (4.7.3) — [release notes](https://github.com/slackapi/bolt-js/releases/tag/v4.7.3)