Repository navigation
Fix Dependabot alerts #5712
Description
Fix current Dependabot alerts https://github.com/getsentry/sentry-react-native/security/dependabot
{{ message }}
Fix current Dependabot alerts https://github.com/getsentry/sentry-react-native/security/dependabot
Activity
linear commentedon Feb 24, 2026
RN-514
antonis commentedon Feb 24, 2026
PR: #5701 fast-xml-parser
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/422 Entity encoding bypass via regex injection · https://github.com/getsentry/sentry-react-native/security/dependabot/418 DoS via entity expansion
Why dev-only: @react-native-community/cli — CLI tooling only
────────────────────────────────────────
PR: #5702 lodash
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/396 Prototype pollution in .unset/.omit
Why dev-only: Transitive via build/test tools; not a dependency of any @sentry/* package
────────────────────────────────────────
PR: #5703 tar
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/419 Arbitrary file read/write via hardlink/symlink
Why dev-only: Archive extraction in Appium and build scripts
────────────────────────────────────────
PR: #5704 on-headers
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/358 HTTP response header manipulation
Why dev-only: Express middleware → Metro dev server
────────────────────────────────────────
PR: #5705 diff
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/405 · https://github.com/getsentry/sentry-react-native/security/dependabot/393 DoS in parsePatch/applyPatch
Why dev-only: ts-node and jest-diff — test/build tooling only
────────────────────────────────────────
PR: #5706 path-to-regexp
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/336 ReDoS
Why dev-only: Express router → Metro dev server
────────────────────────────────────────
PR: #5707 qs
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/388 · https://github.com/getsentry/sentry-react-native/security/dependabot/416 DoS via arrayLimit bypass
Why dev-only: Express and CLI tools; not bundled in the SDK
────────────────────────────────────────
PR: #5708 axios
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/351 SSRF/credential leakage · https://github.com/getsentry/sentry-react-native/security/dependabot/365 ·
https://github.com/getsentry/sentry-react-native/security/dependabot/420 DoS
Why dev-only: Appium and @sentry/cli sourcemap uploads
────────────────────────────────────────
PR: #5709 js-yaml
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/376 · https://github.com/getsentry/sentry-react-native/security/dependabot/377 Prototype pollution in merge
Why dev-only: eslint, jest config loaders, yarn internals
────────────────────────────────────────
PR: #5710 ajv
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/423 · https://github.com/getsentry/sentry-react-native/security/dependabot/424 ReDoS via $data option
Why dev-only: eslint schema validation and Appium
────────────────────────────────────────
PR: #5711 tmp
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/360 Arbitrary temp file write via symlink
Why dev-only: patch-package, @expo/devcert, external-editor
Could not fix:
antonis commentedon Mar 3, 2026
Also opened #5749
antonis commentedon Mar 3, 2026
Closing as all alerts are currently fixed 🎉