[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Bumps the form-data resolution from 4.0.5 to 4.0.6 to fix a high-severity CRLF injection vulnerability (CVE in unescaped multipart field names and filenames).

Resolves Dependabot alert #557.

💡 Motivation and Context

form-data 4.0.5 is vulnerable to CRLF injection via unescaped multipart field names and filenames. Version 4.0.6 patches this.

💚 How did you test it?

• yarn install completes successfully
• CI will validate no regressions

📝 Checklist

• I added tests to verify changes
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing
• No breaking changes

🔮 Next steps

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• fix(deps): bump form-data from 4.0.5 to 4.0.6 by antonis in #6297

• chore(deps): bump tar from 7.5.11 to 7.5.16 by dependabot in #6293
• fix(ci): Update renamed @sentry-internal/* packages in JS updater script by antonis in #6294
• chore(deps): bump launch-editor from 2.11.1 to 2.14.1 by dependabot in #6291
• chore(deps-dev): bump @babel/core from 7.26.7 to 7.29.6 by dependabot in #6292
• fix(deps): Resolve shell-quote to >=1.8.4 (Dependabot RNSentryModule.captureEvent is ignoring environment #547) by antonis in #6286
• fix(ci): Support version catalog in android SDK version check by antonis in #6280
• test(e2e): Bump E2E tests to React Native 0.86.0 by antonis in #6268
• feat(android): Add nativeStackAndroid support to NativeLinkedErrors by lucas-zimerman in #6278
• chore(deps): bump ruby/setup-ruby from 1.310.0 to 1.313.0 by dependabot in #6282
• chore(deps): update Maestro to v2.6.1 by github-actions in #6277
• chore(deps): bump gradle/actions from 6.1.0 to 6.2.0 by dependabot in #6284
• chore(deps): bump getsentry/craft from 2.26.8 to 2.26.10 by dependabot in #6283
• chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.26.8 to 2.26.10 by dependabot in #6281
• chore(deps): update Sentry Android Gradle Plugin to v6.11.0 by github-actions in #6275
• chore(deps): update Android SDK to v8.43.2 by github-actions in #6273
• chore(deps): bump joi from 17.13.3 to 17.13.4 by dependabot in #6279
• chore(deps): update Cocoa SDK to v9.17.1 by github-actions in #6272
• docs(replay): clarify fast renderer option docs by leohara in #6276
• feat(core): Warn when multiple versions of Sentry JS SDK are detected by antonis in #6269

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against d6d628c