AG-58752 Upgrade @slack/web-api to 8.1.1 to drop vulnerable axios

[slvvko]

Summary

Task: AG-58752

Upgrade @slack/web-api from 7.15.1 to 8.1.1 to fix CVE-2026-44486 (HIGH, axios < 1.16.0 leaks Proxy-Authorization to redirect targets in the Node.js adapter).

Since 8.0.0 the Slack SDK no longer depends on axios at all (it uses the native Fetch API), so this removes the vulnerable transitive dependency entirely instead of pinning a patched axios version.

This replaces PR #30, which added axios 1.16.0 as a direct dependency but left the vulnerable transitive axios 1.15.2 in the lockfile — it did not actually fix the CVE.

Changes

• package.json: @slack/web-api 7.15.1 → 8.1.1 (exact pin, latest stable)
• yarn.lock: regenerated — axios, form-data, is-stream, is-electron subtrees removed (~190 lines deleted)
• CHANGELOG.md: Unreleased → Fixed entry
• bin/: regenerated via yarn build (chunk hash renames only, no src changes)

Why this is safe

• The codebase only uses WebClient, LogLevel, and chat.postMessage — all unchanged in 8.x
• No usage of removed options (agent, tls) or deprecated methods (files.upload, rtm.start)
• Error handling is a plain console.error(error) in a catch block; the new WebAPIPlatformError classes are backward compatible for that pattern
• Requires Node >= 20; the repo already requires >= 22.17

Verification

• yarn install — clean
• yarn build — passes
• yarn lint — passes
• yarn test — 10 suites / 34 tests pass
• yarn why axios — no match (vulnerable dependency removed)
• Runtime smoke test: WebClient constructs in CJS, real chat.postMessage against the Slack API returns the expected WebAPIPlatformError with an invalid token (native fetch transport works)

[totadavid95]

Reviewed the @slack/web-api 7.15.1 → 8.1.1 upgrade, lockfile regeneration, and changelog/version updates. The dependency change itself is sound: the codebase only uses WebClient, LogLevel, and chat.postMessage, error handling is a plain console.error(error) (backward compatible with 8.x), and CI is green. One issue to address before merge: the .gitignore change ignores dist/ while the build still outputs to bin/, and it removes the bin/* guard. See the inline comment.