Fix Dependabot alerts

[antonis]

Fix current Dependabot alerts https://github.com/getsentry/sentry-react-native/security/dependabot

[linear]

RN-514

[antonis]

PR: #5701 fast-xml-parser
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/422 Entity encoding bypass via regex injection · https://github.com/getsentry/sentry-react-native/security/dependabot/418 DoS via entity expansion
Why dev-only: @react-native-community/cli — CLI tooling only
────────────────────────────────────────
PR: #5702 lodash
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/396 Prototype pollution in .unset/.omit
Why dev-only: Transitive via build/test tools; not a dependency of any @sentry/* package
────────────────────────────────────────
PR: #5703 tar
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/419 Arbitrary file read/write via hardlink/symlink
Why dev-only: Archive extraction in Appium and build scripts
────────────────────────────────────────
PR: #5704 on-headers
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/358 HTTP response header manipulation
Why dev-only: Express middleware → Metro dev server
────────────────────────────────────────
PR: #5705 diff
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/405 · https://github.com/getsentry/sentry-react-native/security/dependabot/393 DoS in parsePatch/applyPatch
Why dev-only: ts-node and jest-diff — test/build tooling only
────────────────────────────────────────
PR: #5706 path-to-regexp
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/336 ReDoS
Why dev-only: Express router → Metro dev server
────────────────────────────────────────
PR: #5707 qs
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/388 · https://github.com/getsentry/sentry-react-native/security/dependabot/416 DoS via arrayLimit bypass
Why dev-only: Express and CLI tools; not bundled in the SDK
────────────────────────────────────────
PR: #5708 axios
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/351 SSRF/credential leakage · https://github.com/getsentry/sentry-react-native/security/dependabot/365 ·
https://github.com/getsentry/sentry-react-native/security/dependabot/420 DoS
Why dev-only: Appium and @sentry/cli sourcemap uploads
────────────────────────────────────────
PR: #5709 js-yaml
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/376 · https://github.com/getsentry/sentry-react-native/security/dependabot/377 Prototype pollution in merge
Why dev-only: eslint, jest config loaders, yarn internals
────────────────────────────────────────
PR: #5710 ajv
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/423 · https://github.com/getsentry/sentry-react-native/security/dependabot/424 ReDoS via $data option
Why dev-only: eslint schema validation and Appium
────────────────────────────────────────
PR: #5711 tmp
Vulnerability: https://github.com/getsentry/sentry-react-native/security/dependabot/360 Arbitrary temp file write via symlink
Why dev-only: patch-package, @expo/devcert, external-editor

Could not fix:

• minimatch https://github.com/getsentry/sentry-react-native/security/dependabot/421 — fix requires 3.x→10.x jump; lerna uses the 3.x API and breaks. Needs upstream lerna update.
• glob https://github.com/getsentry/sentry-react-native/security/dependabot/380 — CLI-only vulnerability (-c/--cmd flag); not exploitable via programmatic API use.
• validate.js https://github.com/getsentry/sentry-react-native/security/dependabot/330 — no upstream patch; alert dismissed.