From 7acf79c84837665c171c47f60482dd6347fd1b2f Mon Sep 17 00:00:00 2001 From: "shuwen.wu" Date: Wed, 2 Sep 2026 18:05:45 +0800 Subject: [PATCH 1/4] fix: add error handling for JSON.parse in admin.analytics.getFile response The JSON.parse at line 802 was not wrapped in a try-catch, which could cause an unhandled exception if the response body is not valid JSON. This is inconsistent with the similar operation at line 811 which is properly wrapped. Added try-catch to handle parse failures gracefully, returning { ok: false, error: } instead of throwing. --- packages/web-api/src/WebClient.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/web-api/src/WebClient.ts b/packages/web-api/src/WebClient.ts index e212cf5dd..3dcb7552c 100644 --- a/packages/web-api/src/WebClient.ts +++ b/packages/web-api/src/WebClient.ts @@ -799,7 +799,12 @@ export class WebClient extends Methods { // if it isn't a Gzip response but is from the admin.analytics.getFile request, // decode the ArrayBuffer to JSON read the error const buffer = await response.arrayBuffer(); - data = JSON.parse(new TextDecoder().decode(buffer)); + try { + data = JSON.parse(new TextDecoder().decode(buffer)); + } catch (_) { + // failed to parse the response body as JSON + data = { ok: false, error: new TextDecoder().decode(buffer) }; + } } else { const text = await response.text(); try { From 42b4af70303df6231d8df519409ed94c3b5ec902 Mon Sep 17 00:00:00 2001 From: "shuwen.wu" Date: Wed, 2 Sep 2026 18:06:32 +0800 Subject: [PATCH 2/4] fix: safely extract error message from unknown error type Before this fix, the code assumed `e` is an Error object and accessed `e.message` directly. If `e` was a primitive value or undefined, this could result in undefined being passed to GenerateInstallUrlError. Now we use the same pattern as line 289 in this file: `e instanceof Error ? e.message : String(e)` This ensures a valid string is always passed to GenerateInstallUrlError. --- packages/oauth/src/install-provider.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/oauth/src/install-provider.ts b/packages/oauth/src/install-provider.ts index 1e1eddb14..affe47186 100644 --- a/packages/oauth/src/install-provider.ts +++ b/packages/oauth/src/install-provider.ts @@ -401,10 +401,10 @@ export class InstallProvider { res.end(body); } } catch (e: unknown) { - const message = `An unhandled error occurred while processing an install path request (error: ${e})`; + const errorMessage = e instanceof Error ? e.message : String(e); + const message = `An unhandled error occurred while processing an install path request (error: ${errorMessage})`; this.logger.error(message); - // biome-ignore lint/suspicious/noExplicitAny: errors can be any - throw new GenerateInstallUrlError((e as any).message); + throw new GenerateInstallUrlError(errorMessage); } } From f49dc748d38b8e2236481b5e2fd46eedda84dcb2 Mon Sep 17 00:00:00 2001 From: "shuwen.wu" Date: Wed, 2 Sep 2026 18:07:17 +0800 Subject: [PATCH 3/4] fix: use consistent URL validation pattern in IncomingWebhook The URL validation in IncomingWebhook used `if (url === undefined)` which only catches undefined values. WebhookTrigger.ts uses the more robust `if (!url)` which catches undefined, null, and empty string. For consistency and better validation, updated IncomingWebhook to use the same pattern as WebhookTrigger.ts. --- packages/webhook/src/IncomingWebhook.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/webhook/src/IncomingWebhook.ts b/packages/webhook/src/IncomingWebhook.ts index ba19ee2f6..e417cca65 100644 --- a/packages/webhook/src/IncomingWebhook.ts +++ b/packages/webhook/src/IncomingWebhook.ts @@ -71,7 +71,7 @@ export class IncomingWebhook { timeout: 0, }, ) { - if (url === undefined) { + if (!url) { throw new Error('Incoming webhook URL is required'); } From 841aaa0d61ac87f1c84ff7e7b69cf568cec7de68 Mon Sep 17 00:00:00 2001 From: Wu Shuwen Date: Mon, 7 Sep 2026 01:03:35 +0800 Subject: [PATCH 4/4] chore: retrigger CLA check after signing