diff --git a/CHANGELOG.md b/CHANGELOG.md index 9d4cb83b551..68bc9cd52b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -83,6 +83,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Docs/Slack manifest scopes: add missing DM/group-DM bot scopes (`im:read`, `im:write`, `mpim:read`, `mpim:write`) to the Slack app manifest example so DM setup guidance is complete. (#29999) Thanks @JcMinarro. - Slack/Bot attachment-only messages: when `allowBots: true`, bot messages with empty `text` now include non-forwarded attachment `text`/`fallback` content so webhook alerts are not silently dropped. (#27616) - Slack/Inbound media auth + HTML guard: keep Slack auth headers on forwarded shared attachment image downloads, and reject login/error HTML payloads (while allowing expected `.html` uploads) when resolving Slack media so auth failures do not silently pass as files. (#18642) - Slack/Security ingress mismatch guard: drop slash-command and interaction payloads when app/team identifiers do not match the active Slack account context (including nested `team.id` interaction payloads), preventing cross-app or cross-workspace payload injection into system-event handling. (#29091) Thanks @Solvely-Colin. diff --git a/docs/channels/slack.md b/docs/channels/slack.md index 4fa23cf1ee7..6cd8bfccf81 100644 --- a/docs/channels/slack.md +++ b/docs/channels/slack.md @@ -359,7 +359,11 @@ Notes: "channels:read", "groups:history", "im:history", + "im:read", + "im:write", "mpim:history", + "mpim:read", + "mpim:write", "users:read", "app_mentions:read", "assistant:write",