build(deps): bump @slack/web-api to v8 and @slack/webhook to v8

[claude]

Requested by David Babenko-Sanders · Slack thread

This bumps @slack/web-api from ^6.8.0 to ^8.2.0 and @slack/webhook from ^7.0.0 to ^8.0.2, and declares @slack/types ^3.2.0 as a direct dependency because MessageBuilder imports KnownBlock from it. The new versions use the built-in fetch instead of axios, so axios is no longer in the lockfile. One code change was needed: @slack/types v3 requires image_url on image accessories, so the user section block in MessageBuilder now only adds the avatar accessory when avatar_url is set.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JNyjV4J2pgJaC2WfJpGfCb

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​slack/​types@​2.10.0 ⏵ 3.2.0	+1		+2	-1
	@​slack/​web-api@​6.10.0 ⏵ 8.2.0	+1		+1	+1
	@​slack/​webhook@​7.0.1 ⏵ 8.0.2				+8

View full report

[claude]

LGTM — straightforward Slack SDK major-version bump with a small, correct accompanying code fix.

What was reviewed: the package.json/yarn.lock version bumps for @ slack/web-api, @ slack/webhook, and new @ slack/types dependency; the MessageBuilder.ts change that now only adds the avatar "accessory" image block when user.avatar_url is truthy (avatar_url is optional on MinimalUserInfo, so this avoids emitting an image block with an undefined image_url, matching the stricter @ slack/types v3 typing); and the untouched src/permissions/plugins/slack/index.ts WebClient usage, which doesn't rely on anything removed by the v8 bump (e.g., axios internals).

Extended reasoning...

The change is a mechanical major-version dependency bump (Slack SDK v6/v7 to v8) across package.json/yarn.lock plus one small, well-justified code fix in src/MessageBuilder.ts that conditionally includes the avatar image accessory only when avatar_url is set, matching the now-stricter @ slack/types v3 ImageElement typing. No auth, crypto, or data-exposure surface is touched; the only other Slack SDK consumer (src/permissions/plugins/slack/index.ts) is unmodified and uses APIs unaffected by the bump. The diff is small, self-contained, and the PR's own description accurately matches what the code does.