build(deps): Bump fastlane to 2.240.1 to resolve rubyzip advisory by antonis · Pull Request #6788 · getsentry/sentry-react-native

antonis · 2026-09-28T07:27:59Z

📢 Type of change

Bugfix
New feature
Enhancement
Refactoring

📜 Description

Bumps fastlane from 2.220.0/2.228.0 to 2.240.1 in the three Ruby build-tooling manifests and regenerates their lockfiles:

Manifest	fastlane	rubyzip
`performance-tests/Gemfile.lock`	2.228.0 → 2.240.1	2.4.1 → 3.7.0
`samples/react-native/Gemfile.lock`	2.220.0 → 2.240.1	2.3.2 → 3.7.0
`samples/react-native-macos/Gemfile.lock`	2.220.0 → 2.240.1	2.3.2 → 3.7.0

fastlane 2.240.0 is the first release to require rubyzip >= 3.4.0, so bumping fastlane is what lets rubyzip move onto the patched line. The fastlane jump also carries expected transitive updates in its subtree (faraday 1→2, aws-sdk, bigdecimal, digest-crc, etc.).

💡 Motivation and Context

Resolves the open high-severity Dependabot alerts for the rubyzip path traversal vulnerability (GHSA-47m2-wp7j-p9vc, patched in 3.4.0) — alerts #654, #653, #652. The only patched rubyzip is 3.4.0; there is no 2.x fix, and fastlane < 2.240.0 capped rubyzip at < 3.0.0.

💚 How did you test it?

CI

📝 Checklist

I added tests to verify changes.
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
I updated the docs if needed.
I updated the wizard if needed.
All tests passing.
Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
No breaking changes.

🔮 Next steps

fastlane 2.240.0 is the first release to require rubyzip >= 3.4.0, which is the first patched version for the path traversal advisory (GHSA-47m2-wp7j-p9vc). Bump fastlane and regenerate the three Gemfile.lock files so rubyzip resolves to 3.7.0. Affected: performance-tests, samples/react-native, samples/react-native-macos (all build/CI tooling only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-09-28T07:28:30Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

build(deps): Bump fastlane to 2.240.1 to resolve rubyzip advisory by antonis in #6788

chore(deps): bump getsentry/craft from 2.31.0 to 2.31.2 by dependabot in #6793
chore(deps): bump the codeql-action group with 3 updates by dependabot in #6789
chore(deps): bump ruby/setup-ruby from 1.324.0 to 1.327.0 by dependabot in #6790
chore(deps): bump getsentry/github-workflows/updater from 3.4.0 to 3.4.1 by dependabot in #6792
chore(deps): bump getsentry/github-workflows/danger from 4013fc6e1aeb1be1f9d3b4d232624f0ec1afa613 to 36c729264d2edc29ebae61950c50e1e9f043ad7e by dependabot in #6791
chore(deps): update Cocoa SDK to v9.29.2 by github-actions in #6787
feat(replay): Populate trace_ids in mobile replay events by antonis in #6786
chore(deps): update Cocoa SDK to v9.29.1 by github-actions in #6785
chore(deps): update Android SDK to v8.58.0 by github-actions in #6778
fix(build): Prevent update-android.sh from failing on SIGPIPE by antonis in #6777
chore(deps): update Wizard to v8.0.0 by github-actions in #6775

_{🤖 This preview updates automatically when you update the PR.}

sentry · 2026-09-28T07:40:19Z

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
Sentry RN	io.sentry.reactnative.sample	8.28.0 (108)	Release

⚙️ sentry-react-native Build Distribution Settings

github-actions · 2026-09-28T07:40:52Z

Android (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	472.48 ms	499.76 ms	27.28 ms
Size	50.56 MiB	56.51 MiB	5.95 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`5789645`+dirty	426.82 ms	495.42 ms	68.60 ms
`fa21fca`+dirty	453.80 ms	468.46 ms	14.66 ms
`a216cb9`+dirty	458.66 ms	531.47 ms	72.81 ms
`0307fa4`+dirty	454.16 ms	518.35 ms	64.18 ms
`5569641`+dirty	406.43 ms	428.51 ms	22.08 ms
`53a3f8e`+dirty	451.90 ms	500.02 ms	48.12 ms
`6a3eb4c`+dirty	430.90 ms	489.98 ms	59.08 ms
`5fe1c6c`+dirty	401.62 ms	445.28 ms	43.66 ms
`a636fa4`+dirty	486.70 ms	508.53 ms	21.83 ms
`15d4514`+dirty	406.77 ms	428.06 ms	21.29 ms

App size

Revision	Plain	With Sentry	Diff
`5789645`+dirty	49.74 MiB	54.85 MiB	5.11 MiB
`fa21fca`+dirty	49.74 MiB	55.37 MiB	5.63 MiB
`a216cb9`+dirty	49.74 MiB	55.08 MiB	5.34 MiB
`0307fa4`+dirty	49.74 MiB	54.81 MiB	5.07 MiB
`5569641`+dirty	48.30 MiB	53.48 MiB	5.18 MiB
`53a3f8e`+dirty	50.56 MiB	56.46 MiB	5.90 MiB
`6a3eb4c`+dirty	49.74 MiB	55.44 MiB	5.70 MiB
`5fe1c6c`+dirty	43.75 MiB	48.14 MiB	4.39 MiB
`a636fa4`+dirty	49.74 MiB	55.36 MiB	5.62 MiB
`15d4514`+dirty	48.30 MiB	53.60 MiB	5.30 MiB

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	428.87 ms	443.02 ms	14.15 ms

App size

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	50.56 MiB	56.51 MiB	5.95 MiB

github-actions · 2026-09-28T07:43:01Z

iOS (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	3867.50 ms	1227.46 ms	-2640.04 ms
Size	5.15 MiB	6.93 MiB	1.78 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`3b6e9f9`+dirty	3851.90 ms	1233.33 ms	-2618.57 ms
`4e0b819`+dirty	3839.05 ms	1210.75 ms	-2628.30 ms
`1e5d96d`+dirty	3851.45 ms	1212.05 ms	-2639.41 ms
`0a9e622`+dirty	3835.87 ms	1221.07 ms	-2614.80 ms
`7ac3378`+dirty	1213.37 ms	1218.15 ms	4.78 ms
`9ad4522`+dirty	3850.40 ms	1222.40 ms	-2628.00 ms
`20fbd51`+dirty	3827.47 ms	1213.32 ms	-2614.15 ms
`d0e3b3e`+dirty	3854.77 ms	1218.58 ms	-2636.19 ms
`570d7be`+dirty	3822.74 ms	1203.63 ms	-2619.11 ms
`822d35b`+dirty	3830.64 ms	1209.20 ms	-2621.44 ms

App size

Revision	Plain	With Sentry	Diff
`3b6e9f9`+dirty	5.15 MiB	6.68 MiB	1.53 MiB
`4e0b819`+dirty	4.98 MiB	6.46 MiB	1.49 MiB
`1e5d96d`+dirty	4.98 MiB	6.46 MiB	1.49 MiB
`0a9e622`+dirty	4.98 MiB	6.51 MiB	1.53 MiB
`7ac3378`+dirty	3.38 MiB	4.76 MiB	1.38 MiB
`9ad4522`+dirty	4.98 MiB	6.56 MiB	1.58 MiB
`20fbd51`+dirty	4.98 MiB	6.46 MiB	1.49 MiB
`d0e3b3e`+dirty	4.98 MiB	6.51 MiB	1.53 MiB
`570d7be`+dirty	5.15 MiB	6.92 MiB	1.77 MiB
`822d35b`+dirty	4.98 MiB	6.50 MiB	1.53 MiB

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	3854.30 ms	1227.84 ms	-2626.46 ms

App size

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	5.15 MiB	6.92 MiB	1.77 MiB

github-actions · 2026-09-28T07:54:26Z

iOS (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	3855.56 ms	1234.36 ms	-2621.20 ms
Size	5.15 MiB	6.93 MiB	1.78 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`1a5721e`+dirty	3848.15 ms	1214.80 ms	-2633.36 ms
`ecf47a2`+dirty	3844.68 ms	1223.98 ms	-2620.70 ms
`3817909`+dirty	1210.76 ms	1215.64 ms	4.89 ms
`5ee78d6`+dirty	3815.71 ms	1217.04 ms	-2598.67 ms
`890d145`+dirty	1212.98 ms	1220.10 ms	7.12 ms
`f9c1ed4`+dirty	3842.09 ms	1220.70 ms	-2621.40 ms
`bbb8d67`+dirty	3847.47 ms	1225.13 ms	-2622.34 ms
`44abcc2`+dirty	3841.42 ms	1214.77 ms	-2626.65 ms
`9210ae6`+dirty	3834.11 ms	1216.64 ms	-2617.47 ms
`fa21fca`+dirty	3845.12 ms	1215.89 ms	-2629.24 ms

App size

Revision	Plain	With Sentry	Diff
`1a5721e`+dirty	4.98 MiB	6.51 MiB	1.53 MiB
`ecf47a2`+dirty	4.98 MiB	6.46 MiB	1.49 MiB
`3817909`+dirty	3.38 MiB	4.73 MiB	1.35 MiB
`5ee78d6`+dirty	5.15 MiB	6.69 MiB	1.53 MiB
`890d145`+dirty	3.38 MiB	4.77 MiB	1.38 MiB
`f9c1ed4`+dirty	4.98 MiB	6.50 MiB	1.53 MiB
`bbb8d67`+dirty	4.98 MiB	6.55 MiB	1.57 MiB
`44abcc2`+dirty	4.98 MiB	6.55 MiB	1.57 MiB
`9210ae6`+dirty	5.15 MiB	6.68 MiB	1.53 MiB
`fa21fca`+dirty	4.98 MiB	6.55 MiB	1.57 MiB

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	3865.56 ms	1234.43 ms	-2631.13 ms

App size

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	5.15 MiB	6.92 MiB	1.77 MiB

github-actions · 2026-09-28T08:05:20Z

Android (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	541.35 ms	586.67 ms	45.33 ms
Size	50.56 MiB	56.51 MiB	5.95 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`68ae91b`+dirty	515.04 ms	578.08 ms	63.04 ms
`eb55864`+dirty	480.44 ms	514.26 ms	33.82 ms
`23598c3`+dirty	371.92 ms	420.65 ms	48.74 ms
`4b87b12`+dirty	356.23 ms	399.86 ms	43.63 ms
`d771cd5`+dirty	432.29 ms	464.38 ms	32.09 ms
`b3e4a5c`+dirty	429.98 ms	459.56 ms	29.58 ms
`ef27341`+dirty	519.02 ms	553.42 ms	34.40 ms
`5b7e8a7`+dirty	601.58 ms	634.98 ms	33.40 ms
`7c6200e`+dirty	484.08 ms	511.80 ms	27.71 ms
`ce7b368`+dirty	421.64 ms	443.25 ms	21.61 ms

App size

Revision	Plain	With Sentry	Diff
`68ae91b`+dirty	49.74 MiB	54.79 MiB	5.05 MiB
`eb55864`+dirty	50.56 MiB	56.46 MiB	5.90 MiB
`23598c3`+dirty	43.94 MiB	49.02 MiB	5.08 MiB
`4b87b12`+dirty	43.94 MiB	49.00 MiB	5.06 MiB
`d771cd5`+dirty	49.74 MiB	55.36 MiB	5.62 MiB
`b3e4a5c`+dirty	50.56 MiB	56.51 MiB	5.95 MiB
`ef27341`+dirty	48.30 MiB	53.54 MiB	5.24 MiB
`5b7e8a7`+dirty	48.30 MiB	53.58 MiB	5.28 MiB
`7c6200e`+dirty	49.74 MiB	55.44 MiB	5.70 MiB
`ce7b368`+dirty	49.74 MiB	55.08 MiB	5.34 MiB

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	412.52 ms	440.68 ms	28.16 ms

App size

Revision	Plain	With Sentry	Diff
`12ff2a2`+dirty	50.56 MiB	56.51 MiB	5.95 MiB

…ubyzip

lucas-zimerman

LGTM!

antonis added the ready-to-merge Triggers the full CI test suite label Sep 28, 2026

Merge remote-tracking branch 'origin/main' into chore/bump-fastlane-r…

e8fd7c7

…ubyzip

antonis marked this pull request as ready for review September 28, 2026 08:49

antonis requested review from alwx and lucas-zimerman as code owners September 28, 2026 08:49

lucas-zimerman approved these changes Sep 29, 2026

View reviewed changes

antonis merged commit fdc11ab into main Sep 29, 2026
102 of 103 checks passed

antonis deleted the chore/bump-fastlane-rubyzip branch September 29, 2026 06:48

Conversation

antonis commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📢 Type of change

📜 Description

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

Uh oh!

sentry Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📲 Install Builds

Android

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

App size

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

iOS (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

App size

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

iOS (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

App size

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Previous results on branch: chore/bump-fastlane-rubyzip

Startup times

App size

Uh oh!

lucas-zimerman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

antonis commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

sentry Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading