fix(deps): vuln unstable: github.com/slack-go/slack · minor: github.com/stretchr/testify [go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: Security update — 2 packages upgraded (UNSTABLE changes included)

Manifests changed:

• go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
github.com/slack-go/slack	v0.17.3	v0.29.0	unstable	Direct	2 MEDIUM
github.com/stretchr/testify	v1.11.1	v1.12.1	minor	Direct	-

---

Security Details

ℹ️ Other Vulnerabilities (2)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/slack-go/slack	GHSA-gxhx-2686-5h9g	MODERATE	slack-go SecretsVerifier accepts empty signing secret without precondition	v0.17.3	0.23.1	View
github.com/slack-go/slack	GO-2026-5410	MODERATE	SecretsVerifier accepts empty signing secret without precondition in github.com/slack-go/slack	v0.17.3	0.23.1	View

---

Pausing automation
Set the case status to Blocked in Case Management to pause ADMS automation for this dependency. ADMS will skip updating it in the manifest while its case is Blocked — other dependencies in this PR (or future PRs) are unaffected. ADMS never changes a Blocked case's status automatically; move it back to Open (or another active status) yourself when you're ready to resume. See the case link in the table above.

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-us1-prod]

 

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

CI | python-checks — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

License check failed due to modified LICENSE-3rdparty.csv with unintended changes.

📋 Copy fix prompt

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/main HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: engraver-auto-version-upgrade/unstable/go/0-1787812385

CI | python-checks
Commit: fb07222d4e21ff22e7558e5c28277930e2cae46f
Error (code / quality):
License check failed due to modified LICENSE-3rdparty.csv with unintended changes.
CI job: https://github.com/DataDog/chaos-controller/actions/runs/33046295563/job/98430968028

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 45.85% (-0.02%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f87a0f7 | Docs | View more details | Give us feedback!}