Slack breaking changes, updated weekly

Every verified Slack trap in Footgun: changes and behaviors that break code or give wrong results, newest first. Each one has the error you see, the fix, and the date it was last checked. The list updates when the weekly check adds or retires a trap. For the full cause and sources, open the trap, or see all Slack traps.

1. fg-0357· added 2026-10-15· last checked 2026-10-15

   Downloading a Slack file from url_private saves an HTML sign-in page instead of the file

   Symptom

   Downloaded file is a few KB of HTML from slack.com

   Fix

   Fetch url_private_download with a plain HTTP client and an Authorization: Bearer header using a token that has files:read. Check the response content-type before saving.

2. fg-0364· added 2026-10-15· last checked 2026-10-15

   Slack events go missing in production while a developer runs the same app locally in Socket Mode

   Symptom

   Some events reach the laptop and never reach the deployed app

   Fix

   Use a separate Slack app for development, handle reconnects on refresh_requested, and remember Socket Mode apps cannot be listed in the Marketplace.

3. fg-0362· added 2026-10-15· last checked 2026-10-15

   Slack bot token stops working after 12 hours once token rotation is turned on

   Symptom

   token_expired from every Web API call about 12 hours after install

   Fix

   Store the new refresh token from every oauth.v2.access refresh, refresh before expires_in, and keep tokens in a shared database store with refreshes serialized so two workers never redeem the same token. Try rotation in a development app first.

4. fg-0367· added 2026-10-15· last checked 2026-10-15

   views.open fails with expired_trigger_id when the modal opens after a database call

   Symptom

   expired_trigger_id from views.open

   Fix

   Call views.open first with a loading view, then fill it in with views.update once the slow data arrives.

5. fg-0384· added 2026-10-15· last checked 2026-10-15

   apps.manifest.update in CI fails with token_expired once the config token is 12 hours old

   Symptom

   token_expired from apps.manifest.update

   Fix

   Store the config refresh token as a CI secret, rotate it at the start of every run, and save the new refresh token the call returns.

6. fg-0354· added 2026-10-15· last checked 2026-10-15

   Burst of chat.postMessage calls to one channel drops messages or returns ratelimited

   Symptom

   ratelimited with a Retry-After header

   Fix

   Queue outgoing messages per channel at one per second, honor Retry-After, and batch updates into one message where possible.

7. fg-0355· added 2026-10-15· last checked 2026-10-15

   chat.postMessage returns not_in_channel for a bot posting to a public channel

   Symptom

   not_in_channel from chat.postMessage

   Fix

   Add chat:write.public and reinstall, or call conversations.join for public channels. For private channels, invite the bot with /invite.

8. fg-0356· added 2026-10-15· last checked 2026-10-15

   conversations.history returns only 15 messages and rate limits after one call per minute

   Symptom

   ratelimited error on the second conversations.history call within a minute

   Fix

   Build the history reader as an internal app in the customer workspace, or get the app listed in the Marketplace. Otherwise design for 15 messages per minute and store messages from the Events API instead of backfilling.

9. fg-0358· added 2026-10-15· last checked 2026-10-15

   files.upload stops working and returns method_deprecated after the November 2025 sunset

   Symptom

   method_deprecated from files.upload

   Fix

   Switch to files.getUploadURLExternal plus files.completeUploadExternal, or the SDK v2 helpers (filesUploadV2 in Node, files_upload_v2 in Python).

10. fg-0359· added 2026-10-15· last checked 2026-10-15

    files_upload_v2 fails with invalid_channel when given a channel name or user ID

    Symptom

    {'ok': False, 'error': 'invalid_channel', 'channel': '#my_channel'}

    Fix

    Resolve the conversation ID first. For a DM, open it with conversations.open and pass the returned channel ID.

11. fg-0360· added 2026-10-15· last checked 2026-10-15

    Link button in a Slack message shows a warning icon after the user clicks it

    Symptom

    Small warning triangle next to a URL button after click

    Fix

    Register a listener for the button's action_id that only acknowledges.

12. fg-0361· added 2026-10-15· last checked 2026-10-15

    Slack bot posts the same reply two or three times for one message

    Symptom

    Duplicate replies to a single user message

    Fix

    Return 200 at once and do the work afterwards, dedupe on event_id, and ignore or answer retries. Send x-slack-no-retry: 1 on a non-200 if you never want a redelivery.

13. fg-0363· added 2026-10-15· last checked 2026-10-15

    Slack command shows operation_timeout or the work never finishes on Lambda or Cloud Functions

    Symptom

    /command failed with the error "operation_timeout"

    Fix

    Set processBeforeResponse in Bolt JS (or use AwsLambdaReceiver), and in Bolt Python set process_before_response=True and move slow work into lazy listeners.

14. fg-0365· added 2026-10-15· last checked 2026-10-15

    Slack rejects a generated message with invalid_blocks once the report grows

    Symptom

    invalid_blocks from chat.postMessage

    Fix

    Count blocks and truncate text before posting. Split long reports across threaded messages or attach a file.

15. fg-0366· added 2026-10-15· last checked 2026-10-15

    Slack signature check always fails because the framework already parsed the body

    Symptom

    Invalid request signature on every request from Slack

    Fix

    Capture the raw body before any parser runs, compare with a constant-time function, and keep the server clock in sync with NTP.