Bolt 5 does not provide the undici peer required by @slack/socket-mode 3

Description

Installing @slack/bolt@5.0.0 with Yarn 4 reports that Bolt does not provide the undici peer dependency required by @slack/socket-mode@3.0.0.

Bolt installs and constructs the Socket Mode client internally when socketMode: true, but it neither declares undici as a dependency nor exposes it as a peer dependency for Bolt consumers.

The Socket Mode v3 migration guide says that Socket Mode replaced ws with undici@^7 and that, without custom proxy or TLS configuration, no additional action should be required beyond upgrading:

https://docs.slack.dev/tools/node-slack-sdk/migration/socket-mode/migrating-socket-mode-package-to-v3

Versions

• Node.js: 24.x
• Yarn: 4.18.0
• @slack/bolt: 5.0.0
• @slack/socket-mode: 3.0.0

Minimal reproduction

package.json:

{
  "name": "bolt-undici-reproduction",
  "private": true,
  "packageManager": "yarn@4.18.0",
  "dependencies": {
    "@slack/bolt": "5.0.0"
  }
}

Run:

corepack yarn install
yarn explain peer-requirements

Yarn reports:

@slack/bolt@npm:5.0.0 doesn't provide undici to @slack/socket-mode@npm:3.0.0

The relevant dependency relationship is:

@slack/bolt@5.0.0
└── @slack/socket-mode@3.0.0
    └── undici@^7.0.0 (peer dependency)

Expected behaviour

Installing Bolt with Socket Mode support should produce a complete dependency graph without requiring consumers to discover and manually provide a transitive runtime dependency.

Bolt could either:

1. Declare undici@^7.0.0 as a dependency; or
2. Forward it as a Bolt peer dependency and document that Bolt consumers using Socket Mode must install it.

Because Bolt constructs SocketModeClient internally, declaring it as a Bolt dependency appears to provide the most straightforward consumer experience.

npm comparison

A clean installation using modern npm automatically resolves the peer:

@slack/bolt@5.0.0
└─┬ @slack/socket-mode@3.0.0
  └── undici@7.29.0

This may make the missing relationship less visible to npm users, while Yarn's peer validation exposes it.

Current Yarn workaround

We currently patch the missing relationship using Yarn's packageExtensions:

packageExtensions:
  "@slack/bolt@5.0.0":
    dependencies:
      undici: ^7.0.0

Could you confirm whether the Undici peer dependency on Socket Mode is intentional and whether Bolt should provide or forward it?

Start with the package.json metadata for @slack/bolt and its @slack/socket-mode dependency, then reproduce the report with corepack yarn install and yarn explain peer-requirements. Done means Bolt's published dependency graph provides the undici runtime requirement without a peer warning or a consumer-side packageExtension.