Skip to content
Block Kit for React
Esc
↑↓navigate↵open⌘Jpreview
On this page

Upgrading

What changes for your code when you move to a newer release, and what to do about it.

The changelog lists every change in a release. This page covers only the ones that can change how your app behaves, newest first, and what to do about each. While the package is on 0.x, a minor release (0.5, 0.6) can contain breaking changes; a patch release doesn’t.

0.6

Links, link buttons and overflow options now follow only http, https, mailto, slack and relative URLs (#214). Any other scheme (javascript:, data:, vbscript: and the rest) is dropped without an error: a link keeps its text and has no href, and a button still sends its action but opens nothing. Image URLs aren’t checked. See URL safety.

You don’t need to change anything. On React 18, which the package supports, earlier releases let a crafted javascript: link in a message run script in the page, so upgrade if you render messages written by people you don’t trust.

The interaction relay refuses cross-site posts

createInteractionRelay now answers a browser post from another site’s page with a 403 (#217). httpTransport already sends the header the relay looks for, so the playground and your own page keep working, and server-to-server calls are unaffected.

It also takes an optional token. Set it on the relay and the same value on httpTransport as soon as the relay is reachable from anywhere but your own machine; see Protecting the relay.

Web API resolvers return bare names

The resolvers from @nkootstra/block-kit/web-api now return general and eng rather than #general and @eng (#210), which fixes mentions that rendered as ##general. If your own code shows these names and relied on the prefix, add it yourself.

0.5

Overflow actions no longer send the option’s URL

An overflow action’s selected_option carries only text and value, as Slack’s does (#124). A link option still opens its page. If a handler read selected_option.url, look the URL up in your own options by value.

The same release brought other payloads closer to Slack’s, which only adds fields:

  • plain_text objects in state.values and onStateChange carry emoji: true.
  • A radio buttons action echoes the element’s initial_option.
  • An icon button action carries the button’s icon and text.

State lists every input

In a modal or Home tab, state.values holds every input block’s element, in onStateChange, block_actions and view_submission (#133). An input nobody touched reports null for a single value and [] for a list. Check the value rather than whether the key exists.

Typing sends fewer actions

With on_character_entered, an input sends one action with the whole value once typing pauses for 300 ms, not one per keystroke (#133). A rich text input dispatches only on its trigger (Enter by default) and only when its input block sets dispatch_action; before, it sent an action on every keystroke.

Last updated on