[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Lockfile-only refresh moving fast-xml-parser onto its patched release. Stays within the existing ^5.7.0 range — no package.json changes.

Package	Before → After	Advisory	Alert
fast-xml-parser	5.7.2 → 5.12.0	Quadratic CPU consumption scanning unterminated stop-node tags (ReDoS)	#743 (low)

💡 Motivation and Context

Resolves one open Dependabot alert. fast-xml-parser is a transitive dev/CI-tooling dependency (via Appium / aws-sdk) — not a dependency of the shipped @sentry/react-native package (packages/core), so nothing reaches end-user apps. The patched release is within the range its consumers already declare, so this is a clean yarn up -R refresh.

The other currently-open advisories (activesupport #739–742) are handled separately — they are dev-only Ruby tooling (activesupport via cocoapods) with no installable fix (the only patch is activesupport >= 8.0.5.2, but cocoapods-core pins activesupport < 8), and have been dismissed as tolerable risk.

💚 How did you test it?

yarn up -R fast-xml-parser; verified the lockfile resolves to 5.12.0 and that only yarn.lock changed.

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
• No breaking changes.

🔮 Next steps

Nothing shipped to SDK users changes — lockfile-only refresh of a tooling dependency.

🤖 Generated with Claude Code

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• build(deps): Bump fast-xml-parser to 5.12.0 to resolve ReDoS advisory by antonis and claude in #7022

• docs(android): Note Sentry Android module version alignment in changelog by antonis and claude in #7021
• chore(deps): update Cocoa SDK to v9.34.0 by github-actions in #7020
• chore(deps): update Android SDK to v8.64.0 by github-actions in #7019
• fix(core): Restore touch breadcrumbs on New Architecture from RN 0.88 by antonis and claude in #7013
• fix(android): Mask prepared text layout views in replay and screenshots by antonis and claude in #7011
• chore: Restore individual maintainers as default code owners by christophaigner with sentry-junior in #7017
• feat(android): Add enableUserInteractionBreadcrumbs option by GersonRocha9 in #7016
• fix(ios): Register replay mask classes when sample rates are 0 by alwx in #7008
• feat(ios): Forward experimental enableWatchdogTerminationsV2 to sentry-cocoa by alwx in #7012
• docs: Update Warden skills mentioned in the review skill by antonis and claude in #7004
• ci: Skip CI for warden.toml-only changes by antonis and claude in #7005
• build(deps): Bump joi to 17.13.9 to resolve ReDoS advisory by antonis and claude in #7003
• chore(deps): bump getsentry/craft from 3.9.0 to 3.11.1 by dependabot in #7001
• chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 3.9.0 to 3.11.1 by dependabot in #6999
• chore(deps): bump actions/setup-java from 6.1.0 to 6.2.0 by dependabot in #7002
• chore(deps): bump ruby/setup-ruby from 1.336.0 to 1.338.0 by dependabot in #7000
• chore(deps): bump the codeql-action group with 3 updates by dependabot in #6998
• chore(warden): Remove find-bugs, already covered by code-review by dcramer with sentry-junior in #6997
• chore(deps): update Sentry Android Gradle Plugin to v6.26.0 by github-actions in #6995
• chore(warden): Enable incremental review by Jeffreyhung with sentry-junior in #6994
• chore(deps): update Android SDK to v8.63.0 by github-actions in #6990

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 9b600b0

[lucas-zimerman]

LGTM!