chore(deps): bump axios to ^1.13.5 by antonis · Pull Request #5708 · getsentry/sentry-react-native

antonis · 2026-02-24T10:35:43Z

Summary

Adds a resolutions entry to force axios to >=1.13.5
Fixes three vulnerabilities: SSRF and credential leakage via absolute URL, DoS via missing data size check, and DoS via __proto__ key in mergeConfig
Consolidates multiple installed versions (1.6.3, 1.7.2, 1.7.3, 1.8.4, 1.9.0, 1.12.0) onto 1.13.5

Dependabot alerts

Test plan

yarn install resolves all axios consumers to 1.13.5
yarn build passes
yarn test passes

🤖 Generated with Claude Code

Adds a yarn resolution to force axios to >=1.13.5, patching three vulnerabilities: SSRF and credential leakage via absolute URL (< 1.8.2), DoS via no data size check (< 1.12.0), and DoS via __proto__ key in mergeConfig (<= 1.13.4). Consolidates multiple axios versions onto 1.13.5. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-02-24T10:36:02Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

chore(deps): bump axios to ^1.13.5 by antonis in #5708

chore(deps): bump qs to ^6.14.2 by antonis in #5707
chore(deps): bump lodash to ^4.17.23 by antonis in #5702
chore(deps): bump getsentry/craft from 2.21.4 to 2.21.7 by dependabot in #5694
chore(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml from 2.21.4 to 2.21.7 by dependabot in #5695
chore(deps): update CLI to v3.2.2 by github-actions in #5692
chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by dependabot in #5693
chore(deps): update Maestro to v2.2.0 by github-actions in #5691
chore(deps): update Cocoa SDK to v9.5.0 by github-actions in #5685
chore(deps): update Android SDK Stubs to v8.33.0 by github-actions in #5697
chore(deps): update Android SDK to v8.33.0 by github-actions in #5684
chore(deps): update Sentry Android Gradle Plugin to v6.1.0 by github-actions in #5687
Ref(CI): Add android sdk version check by lucas-zimerman in #5686

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-02-24T12:00:41Z

Android (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	410.17 ms	444.56 ms	34.39 ms
Size	43.75 MiB	48.46 MiB	4.71 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`eeebd10`+dirty	493.12 ms	545.91 ms	52.79 ms
`664c66f`+dirty	434.82 ms	471.38 ms	36.56 ms
`d73150f`+dirty	411.21 ms	465.86 ms	54.65 ms
`4a17c8f`+dirty	406.62 ms	400.58 ms	-6.04 ms
`2adbd1e`+dirty	433.98 ms	427.96 ms	-6.02 ms
`98f632c`	424.25 ms	435.48 ms	11.23 ms
`9ced351`+dirty	405.40 ms	419.39 ms	13.98 ms
`64cd15c`	439.02 ms	427.63 ms	-11.39 ms
`8490686`+dirty	365.59 ms	400.24 ms	34.65 ms
`1853710`	555.47 ms	556.59 ms	1.12 ms

App size

Revision	Plain	With Sentry	Diff
`eeebd10`+dirty	43.75 MiB	48.41 MiB	4.66 MiB
`664c66f`+dirty	43.75 MiB	48.55 MiB	4.80 MiB
`d73150f`+dirty	43.75 MiB	48.55 MiB	4.80 MiB
`4a17c8f`+dirty	43.75 MiB	47.99 MiB	4.24 MiB
`2adbd1e`+dirty	17.75 MiB	19.70 MiB	1.96 MiB
`98f632c`	17.75 MiB	20.15 MiB	2.41 MiB
`9ced351`+dirty	43.75 MiB	48.41 MiB	4.66 MiB
`64cd15c`	17.75 MiB	20.15 MiB	2.41 MiB
`8490686`+dirty	17.75 MiB	19.70 MiB	1.96 MiB
`1853710`	17.75 MiB	19.68 MiB	1.94 MiB

github-actions · 2026-02-24T12:23:33Z

iOS (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	1217.52 ms	1221.90 ms	4.38 ms
Size	3.38 MiB	4.78 MiB	1.40 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`90e7cb3`+dirty	1206.61 ms	1209.46 ms	2.84 ms
`60cd796`+dirty	1204.87 ms	1202.71 ms	-2.17 ms
`8e653ac`+dirty	1218.63 ms	1223.88 ms	5.24 ms
`f70acbf`+dirty	1235.71 ms	1243.14 ms	7.43 ms
`ad27f6e`+dirty	1223.41 ms	1246.29 ms	22.88 ms
`6c11c6a`+dirty	1202.43 ms	1212.70 ms	10.27 ms
`664c66f`+dirty	1215.37 ms	1221.30 ms	5.92 ms
`d916aa3`+dirty	1221.02 ms	1228.98 ms	7.96 ms
`36841a6`+dirty	1221.32 ms	1222.17 ms	0.85 ms
`bca62c0`+dirty	1183.61 ms	1183.76 ms	0.14 ms

App size

Revision	Plain	With Sentry	Diff
`90e7cb3`+dirty	3.41 MiB	4.58 MiB	1.17 MiB
`60cd796`+dirty	3.44 MiB	4.67 MiB	1.23 MiB
`8e653ac`+dirty	2.63 MiB	4.01 MiB	1.38 MiB
`f70acbf`+dirty	2.63 MiB	3.98 MiB	1.34 MiB
`ad27f6e`+dirty	3.41 MiB	4.67 MiB	1.25 MiB
`6c11c6a`+dirty	3.44 MiB	4.60 MiB	1.16 MiB
`664c66f`+dirty	3.38 MiB	4.60 MiB	1.22 MiB
`d916aa3`+dirty	2.63 MiB	3.81 MiB	1.18 MiB
`36841a6`+dirty	3.41 MiB	4.67 MiB	1.25 MiB
`bca62c0`+dirty	3.38 MiB	4.60 MiB	1.22 MiB

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

cursor · 2026-02-24T13:10:08Z

package.json

  },
  "resolutions": {
    "appium-chromedriver@npm:5.6.73/@xmldom/xmldom": "0.8.10",
+    "axios": "^1.13.5",


Stale form-data resolution conflicts with new axios dependency

Medium Severity

The resolutions field pins form-data to 4.0.4, but axios 1.13.5 declares a dependency on form-data: ^4.0.5 (visible in the lockfile). Since 4.0.4 is below the ^4.0.5 minimum, axios is running with an unsatisfied dependency. Yarn resolutions silently override the requirement, so no install error occurs, but axios may be missing bug fixes or features it expects from form-data 4.0.5+. The form-data resolution needs to be bumped to at least 4.0.5.

Additional Locations (1)

yarn.lock#L14640-L14641

github-actions · 2026-02-24T14:08:05Z

Android (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	452.29 ms	494.42 ms	42.12 ms
Size	43.94 MiB	49.33 MiB	5.39 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`df1f7df`+dirty	374.68 ms	384.96 ms	10.28 ms
`a483f9f`+dirty	428.57 ms	475.98 ms	47.41 ms
`7091004`+dirty	377.76 ms	402.11 ms	24.35 ms
`5526494`+dirty	380.79 ms	432.70 ms	51.91 ms
`98f632c`+dirty	323.98 ms	375.39 ms	51.41 ms
`5c16cdc`+dirty	375.45 ms	426.62 ms	51.17 ms
`8ece263`+dirty	369.44 ms	414.65 ms	45.21 ms
`a2bb688`+dirty	371.19 ms	389.18 ms	17.99 ms
`526494a`+dirty	361.10 ms	410.84 ms	49.74 ms
`60cd796`+dirty	410.56 ms	439.00 ms	28.44 ms

App size

Revision	Plain	With Sentry	Diff
`df1f7df`+dirty	43.94 MiB	48.91 MiB	4.97 MiB
`a483f9f`+dirty	43.94 MiB	49.27 MiB	5.33 MiB
`7091004`+dirty	43.94 MiB	48.81 MiB	4.88 MiB
`5526494`+dirty	7.15 MiB	8.41 MiB	1.26 MiB
`98f632c`+dirty	7.15 MiB	8.42 MiB	1.27 MiB
`5c16cdc`+dirty	7.15 MiB	8.41 MiB	1.26 MiB
`8ece263`+dirty	7.15 MiB	8.41 MiB	1.26 MiB
`a2bb688`+dirty	7.15 MiB	8.43 MiB	1.28 MiB
`526494a`+dirty	43.94 MiB	48.82 MiB	4.88 MiB
`60cd796`+dirty	43.94 MiB	48.90 MiB	4.96 MiB

github-actions · 2026-02-24T18:07:46Z

iOS (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	1215.75 ms	1212.65 ms	-3.10 ms
Size	3.38 MiB	4.78 MiB	1.40 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`90e7cb3`+dirty	1212.61 ms	1213.80 ms	1.19 ms
`60cd796`+dirty	1206.08 ms	1213.36 ms	7.28 ms
`8e653ac`+dirty	1215.46 ms	1220.20 ms	4.75 ms
`f70acbf`+dirty	1239.00 ms	1242.53 ms	3.53 ms
`ad27f6e`+dirty	1214.28 ms	1203.67 ms	-10.62 ms
`6c11c6a`+dirty	1217.55 ms	1221.49 ms	3.94 ms
`664c66f`+dirty	1195.94 ms	1194.80 ms	-1.14 ms
`d916aa3`+dirty	1211.02 ms	1221.33 ms	10.31 ms
`36841a6`+dirty	1215.87 ms	1217.27 ms	1.40 ms
`bca62c0`+dirty	1219.65 ms	1226.14 ms	6.50 ms

App size

Revision	Plain	With Sentry	Diff
`90e7cb3`+dirty	3.41 MiB	4.58 MiB	1.17 MiB
`60cd796`+dirty	3.44 MiB	4.67 MiB	1.23 MiB
`8e653ac`+dirty	3.19 MiB	4.58 MiB	1.39 MiB
`f70acbf`+dirty	3.19 MiB	4.54 MiB	1.36 MiB
`ad27f6e`+dirty	3.41 MiB	4.67 MiB	1.25 MiB
`6c11c6a`+dirty	3.44 MiB	4.60 MiB	1.16 MiB
`664c66f`+dirty	3.38 MiB	4.60 MiB	1.22 MiB
`d916aa3`+dirty	3.19 MiB	4.38 MiB	1.19 MiB
`36841a6`+dirty	3.41 MiB	4.67 MiB	1.25 MiB
`bca62c0`+dirty	3.38 MiB	4.60 MiB	1.22 MiB

antonis added the ready-to-merge Triggers the full CI test suite label Feb 24, 2026

antonis mentioned this pull request Feb 24, 2026

Fix Dependabot alerts #5712

Open

antonis marked this pull request as ready for review February 24, 2026 13:07

antonis requested review from alwx and lucas-zimerman as code owners February 24, 2026 13:07

cursor bot reviewed Feb 24, 2026

View reviewed changes

Merge branch 'main' into antonis/bump-axios

1a6e43a

Uh oh!

Conversation

antonis commented Feb 24, 2026

Summary

Dependabot alerts

Test plan

Uh oh!

github-actions bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

Uh oh!

github-actions bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

iOS (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 24, 2026

Choose a reason for hiding this comment

Stale form-data resolution conflicts with new axios dependency

Uh oh!

github-actions bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 24, 2026

iOS (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Feb 24, 2026 •

edited

Loading

github-actions bot commented Feb 24, 2026 •

edited

Loading

github-actions bot commented Feb 24, 2026 •

edited

Loading

Stale `form-data` resolution conflicts with new axios dependency

github-actions bot commented Feb 24, 2026 •

edited

Loading