[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Refreshes yarn.lock to move two transitive dependencies onto their patched versions. All bumps stay within the existing semver ranges — no package.json or resolutions changes.

Package	Before → After
brace-expansion	1.1.18 → 1.1.21
brace-expansion	2.1.4 → 2.1.7
brace-expansion	5.0.9 → 5.0.12
moment	2.30.1 → 2.31.0

💡 Motivation and Context

Resolves the 8 open high/moderate Dependabot alerts in yarn.lock:

• brace-expansion (@ sentry/react-native modal message "could not connect to Sentry native SDK" #662, Native crash not reported on ejected expo app #663, RNSentryModule.java don't support react native 0.6.0 version #665, NPM: react-native-sentry vs @sentry/react-native #666, Running yarn test fails when integrating Sentry - SyntaxError: Unexpected token export at import * #668, 1.X.X missing sampleRate option #669, Could not connect to Sentry native SDK. #670) — DoS via uncontrolled recursion / quadratic-time expansion. Three copies exist in the tree (via minimatch/glob across tooling); each is bumped to the patched release on its major line.
• moment ( :app:bundleReleaseJsAndAssets_SentryUpload FAILED #671) — path traversal via crafted non-string locale name. Transitive-only, pulled in via Appium E2E drivers + bunyan logging.

None of these are dependencies of the shipped @sentry/react-native package (packages/core) — they are build/test tooling only.

💚 How did you test it?

yarn up -R brace-expansion moment; verified the lockfile resolves to the patched versions listed above and that only yarn.lock changed.

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
• No breaking changes.

🔮 Next steps

Nothing shipped to SDK users changes — this is a lockfile-only refresh of tooling dependencies.

🤖 Generated with Claude Code

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• build(deps): Bump brace-expansion and moment to patched versions by antonis in #6807

• chore(deps): bump undici from 6.28.0 to 6.29.0 by dependabot in #6806
• chore(deps): update Maestro to v2.11.0 by github-actions in #6804
• fix(ios): Preserve quoted Expo bundle script invocations by eliotgevers in #6796
• chore(deps): bump ip-address from 10.4.0 to 10.7.2 by dependabot in #6799
• chore(deps): bump fast-uri from 3.1.6 to 3.1.8 by dependabot in #6797
• chore(deps): update Sentry Android Gradle Plugin to v6.23.0 by github-actions in #6798
• build(deps): Bump fastlane to 2.240.1 to resolve rubyzip advisory by antonis in #6788
• chore(deps): bump getsentry/craft from 2.31.0 to 2.31.2 by dependabot in #6793
• chore(deps): bump the codeql-action group with 3 updates by dependabot in #6789
• chore(deps): bump ruby/setup-ruby from 1.324.0 to 1.327.0 by dependabot in #6790
• chore(deps): bump getsentry/github-workflows/updater from 3.4.0 to 3.4.1 by dependabot in #6792
• chore(deps): bump getsentry/github-workflows/danger from 4013fc6e1aeb1be1f9d3b4d232624f0ec1afa613 to 36c729264d2edc29ebae61950c50e1e9f043ad7e by dependabot in #6791
• chore(deps): update Cocoa SDK to v9.29.2 by github-actions in #6787
• feat(replay): Populate trace_ids in mobile replay events by antonis in #6786
• chore(deps): update Cocoa SDK to v9.29.1 by github-actions in #6785
• chore(deps): update Android SDK to v8.58.0 by github-actions in #6778
• fix(build): Prevent update-android.sh from failing on SIGPIPE by antonis in #6777
• chore(deps): update Wizard to v8.0.0 by github-actions in #6775

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 63e871b

[antonis]

Closing in favour of #6809 and #6808