chore(deps): force brace-expansion to ^5.0.8 (fully resolve dev-only OOM DoS) by antonis · Pull Request #6532 · getsentry/sentry-react-native

antonis · 2026-07-28T11:59:56Z

📢 Type of change

Bugfix
New feature
Enhancement
Refactoring

📜 Description

Consolidates the scattered brace-expansion resolutions into a single global pin and forces every copy to 5.0.8:

-    "minimatch@npm:10.2.4/brace-expansion": "^5.0.8",
-    "brace-expansion@npm:^5.0.2": "^5.0.8",
-    "brace-expansion@npm:^5.0.5": "^5.0.8",
-    "brace-expansion@npm:5.0.6": "^5.0.8",
+    "brace-expansion": "^5.0.8",
...
-    "minimatch@npm:5.1.9/brace-expansion": "^2.1.2",
-    "minimatch@npm:8.0.7/brace-expansion": "^2.1.2",
-    "minimatch@npm:9.0.9/brace-expansion": "^2.1.2",

This pulls the remaining 1.1.16 (via minimatch@3.x) and 2.1.2 (via minimatch@9.x) copies up to 5.0.8, collapsing the tree to a single brace-expansion@5.0.8.

💡 Motivation and Context

Fully resolves GHSA-mh99-v99m-4gvg — brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash (High). The advisory affects <=5.0.7 and the only fix is 5.0.8 — there is no backported patch in the 1.x or 2.x lines, so those carriers must jump cross-major.

This completes #6521, which cleared only the 5.x copy. Once merged, the remaining brace-expansion Dependabot alert should close.

Scope: dev/build tooling only. brace-expansion is pulled via minimatch under @expo/*, @microsoft/api-extractor, @npmcli/*, @nx/devkit, and lerna. It is not part of the shipped @sentry/react-native runtime, whose production dependency tree audits clean.

brace-expansion 5.x keeps the stable expand() API, so it is a safe drop-in for the older minimatch versions here — confirmed by a full build + test run below.

💚 How did you test it?

Run locally on this branch:

yarn install --immutable — passes (lockfile in sync).
yarn npm audit --recursive — 0 real advisories (brace-expansion fully cleared; tree collapses to a single 5.0.8).
yarn build — ✅ all projects.
yarn test — ✅ 2071 tests passing (127 + 12 + 1 suites).

📝 Checklist

I added tests to verify changes.
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
I updated the docs if needed.
I updated the wizard if needed.
All tests passing.
Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
No breaking changes.

🔮 Next steps

… advisory Consolidates the scattered brace-expansion resolutions into a single global "brace-expansion": "^5.0.8", forcing every copy — including the 1.x/2.x carriers pulled via older minimatch (3.x/9.x) — up to 5.0.8. Fully resolves GHSA-mh99-v99m-4gvg (brace-expansion OOM DoS, affects <=5.0.7; only fix is 5.0.8, no 1.x/2.x backport). Completes the partial fix in #6521, which only covered the 5.x copy. Dev/build-tooling only (brace-expansion is pulled via minimatch under @expo/*, @microsoft/api-extractor, @npmcli/*, @nx/devkit, lerna); the shipped @sentry/react-native production tree is unaffected. Verified: yarn npm audit --recursive reports 0 advisories; yarn install --immutable passes; yarn build and yarn test (2071 tests) pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions · 2026-07-28T12:00:17Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

chore(deps): force brace-expansion to ^5.0.8 (fully resolve dev-only OOM DoS) by antonis in #6532

chore(deps): add sharp ^0.35.0 resolution (dev-only advisory) by antonis in #6525
chore(deps): add body-parser ^2.3.0 resolution (dev-only advisory) by antonis in #6524
chore(deps): add morgan ^1.11.0 resolution (dev-only advisory) by antonis in #6523
chore(deps): bump postcss to ^8.5.18 (dev-only advisory) by antonis in #6522
chore(deps): bump brace-expansion 5.x to ^5.0.8 (dev-only advisory) by antonis in #6521
ci: Disable yarn age gate when bumping first-party @sentry deps by antonis in #6513
feat(core): Attach TurboModule breakdown to active spans on spanEnd by alwx in #6478
feat(core): Export instrumentStateGraph and deprecate instrumentLangGraph by antonis in #6520
chore(deps): bump the codeql-action group across 1 directory with 3 updates by dependabot in #6517
chore(deps): bump ruby/setup-ruby from 1.319.0 to 1.321.0 by dependabot in #6518
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by dependabot in #6519
chore(deps): update JavaScript SDK to v10.68.0 by github-actions in #6516
chore(deps): bump tar from 7.5.20 to 7.5.21 by dependabot in #6515
chore(deps): bump lerna to ^9.0.7 to resolve remaining dev-tooling advisories by antonis in #6499
chore(deps): Migrate to @sentry/bundler-plugins by antonis in #6501
chore: update changelog warning with fix version by antonis in #6509
chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by dependabot in #6463
chore(deps): bump json from 2.17.1.2 to 2.19.9 in /performance-tests by dependabot in #6512
chore(deps): update CLI to v3.6.2 by github-actions in #6511
chore(deps): update Sentry Android Gradle Plugin to v6.16.0 by github-actions in #6508
chore(deps): update Android SDK to v8.50.1 by github-actions in #6503

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-07-28T12:12:15Z

Android (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	460.42 ms	501.12 ms	40.70 ms
Size	49.74 MiB	55.37 MiB	5.63 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`100ce80`+dirty	463.66 ms	539.56 ms	75.90 ms
`5c1e987`+dirty	423.52 ms	471.64 ms	48.12 ms
`b04af96`+dirty	496.48 ms	557.88 ms	61.40 ms
`6177334`+dirty	408.16 ms	441.14 ms	32.98 ms
`a2585ce`+dirty	426.36 ms	483.26 ms	56.90 ms
`5a21b51`+dirty	471.42 ms	524.22 ms	52.80 ms
`bbb8d67`+dirty	495.63 ms	525.50 ms	29.87 ms
`d7d54c6`+dirty	458.06 ms	479.94 ms	21.87 ms
`0a9e622`+dirty	420.73 ms	464.83 ms	44.10 ms
`b0d3373`+dirty	557.66 ms	579.42 ms	21.76 ms

App size

Revision	Plain	With Sentry	Diff
`100ce80`+dirty	48.30 MiB	53.46 MiB	5.15 MiB
`5c1e987`+dirty	43.75 MiB	48.08 MiB	4.33 MiB
`b04af96`+dirty	49.74 MiB	55.00 MiB	5.26 MiB
`6177334`+dirty	48.30 MiB	53.54 MiB	5.23 MiB
`a2585ce`+dirty	49.74 MiB	55.36 MiB	5.61 MiB
`5a21b51`+dirty	48.30 MiB	53.49 MiB	5.19 MiB
`bbb8d67`+dirty	49.74 MiB	55.36 MiB	5.62 MiB
`d7d54c6`+dirty	49.74 MiB	55.09 MiB	5.34 MiB
`0a9e622`+dirty	49.74 MiB	55.09 MiB	5.34 MiB
`b0d3373`+dirty	48.30 MiB	53.58 MiB	5.28 MiB

github-actions · 2026-07-28T12:14:27Z

iOS (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	3837.61 ms	1206.98 ms	-2630.63 ms
Size	4.98 MiB	6.55 MiB	1.57 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`7d8c8bd`+dirty	3837.24 ms	1215.51 ms	-2621.73 ms
`c823bb5`+dirty	3843.44 ms	1225.70 ms	-2617.74 ms
`37a2091`+dirty	3821.77 ms	1212.34 ms	-2609.43 ms
`a9df5ce`+dirty	3852.73 ms	1221.38 ms	-2631.35 ms
`23598c3`+dirty	1207.00 ms	1209.90 ms	2.90 ms
`26843eb`+dirty	3861.60 ms	1238.77 ms	-2622.82 ms
`5a23c47`+dirty	3855.46 ms	1221.95 ms	-2633.50 ms
`41d6254`+dirty	3845.71 ms	1224.51 ms	-2621.20 ms
`d2eadf8`+dirty	3842.42 ms	1228.91 ms	-2613.50 ms
`774257e`+dirty	3846.90 ms	1215.02 ms	-2631.88 ms

App size

Revision	Plain	With Sentry	Diff
`7d8c8bd`+dirty	5.15 MiB	6.68 MiB	1.53 MiB
`c823bb5`+dirty	5.15 MiB	6.69 MiB	1.53 MiB
`37a2091`+dirty	5.15 MiB	6.70 MiB	1.54 MiB
`a9df5ce`+dirty	4.98 MiB	6.55 MiB	1.57 MiB
`23598c3`+dirty	3.38 MiB	4.80 MiB	1.42 MiB
`26843eb`+dirty	4.98 MiB	6.53 MiB	1.55 MiB
`5a23c47`+dirty	4.98 MiB	6.46 MiB	1.49 MiB
`41d6254`+dirty	5.15 MiB	6.70 MiB	1.54 MiB
`d2eadf8`+dirty	5.15 MiB	6.67 MiB	1.51 MiB
`774257e`+dirty	5.15 MiB	6.70 MiB	1.54 MiB

github-actions · 2026-07-28T12:24:41Z

iOS (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	3853.11 ms	1237.04 ms	-2616.07 ms
Size	4.98 MiB	6.55 MiB	1.57 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`7d8c8bd`+dirty	3847.98 ms	1230.77 ms	-2617.21 ms
`7887847`+dirty	3844.89 ms	1221.67 ms	-2623.22 ms
`580fb5c`+dirty	3835.45 ms	1218.61 ms	-2616.84 ms
`f3215d3`+dirty	3846.08 ms	1231.85 ms	-2614.23 ms
`a9df5ce`+dirty	3856.02 ms	1225.22 ms	-2630.80 ms
`26843eb`+dirty	3827.68 ms	1216.27 ms	-2611.41 ms
`df5d108`+dirty	1207.34 ms	1210.50 ms	3.16 ms
`5b7e8a7`+dirty	3855.46 ms	1234.47 ms	-2620.99 ms
`e763471`+dirty	3826.10 ms	1221.52 ms	-2604.58 ms
`d038a14`+dirty	3831.11 ms	1216.30 ms	-2614.81 ms

App size

Revision	Plain	With Sentry	Diff
`7d8c8bd`+dirty	5.15 MiB	6.68 MiB	1.53 MiB
`7887847`+dirty	4.98 MiB	6.46 MiB	1.48 MiB
`580fb5c`+dirty	4.98 MiB	6.46 MiB	1.48 MiB
`f3215d3`+dirty	5.15 MiB	6.67 MiB	1.52 MiB
`a9df5ce`+dirty	4.98 MiB	6.55 MiB	1.57 MiB
`26843eb`+dirty	4.98 MiB	6.53 MiB	1.55 MiB
`df5d108`+dirty	3.38 MiB	4.73 MiB	1.35 MiB
`5b7e8a7`+dirty	5.15 MiB	6.70 MiB	1.54 MiB
`e763471`+dirty	4.98 MiB	6.51 MiB	1.53 MiB
`d038a14`+dirty	5.15 MiB	6.67 MiB	1.51 MiB

github-actions · 2026-07-28T12:25:25Z

Android (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	439.70 ms	509.27 ms	69.58 ms
Size	49.74 MiB	55.37 MiB	5.63 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`5b7e8a7`+dirty	601.58 ms	634.98 ms	33.40 ms
`88735e9`+dirty	427.04 ms	487.37 ms	60.33 ms
`038a6d7`+dirty	499.02 ms	527.68 ms	28.66 ms
`a0d8cf8`+dirty	533.71 ms	564.25 ms	30.54 ms
`a2585ce`+dirty	414.04 ms	456.83 ms	42.79 ms
`ef27341`+dirty	519.02 ms	553.42 ms	34.40 ms
`bbb8d67`+dirty	465.41 ms	502.40 ms	36.99 ms
`4966363`+dirty	415.67 ms	448.60 ms	32.93 ms
`d7d54c6`+dirty	423.54 ms	498.56 ms	75.02 ms
`0a9e622`+dirty	425.22 ms	457.00 ms	31.78 ms

App size

Revision	Plain	With Sentry	Diff
`5b7e8a7`+dirty	48.30 MiB	53.58 MiB	5.28 MiB
`88735e9`+dirty	49.74 MiB	54.82 MiB	5.07 MiB
`038a6d7`+dirty	48.30 MiB	53.60 MiB	5.30 MiB
`a0d8cf8`+dirty	48.30 MiB	53.49 MiB	5.19 MiB
`a2585ce`+dirty	49.74 MiB	55.36 MiB	5.61 MiB
`ef27341`+dirty	48.30 MiB	53.54 MiB	5.24 MiB
`bbb8d67`+dirty	49.74 MiB	55.36 MiB	5.62 MiB
`4966363`+dirty	48.30 MiB	53.54 MiB	5.24 MiB
`d7d54c6`+dirty	49.74 MiB	55.09 MiB	5.34 MiB
`0a9e622`+dirty	49.74 MiB	55.09 MiB	5.34 MiB

antonis · 2026-07-28T12:44:54Z

Closing — this approach breaks the build. Forcing brace-expansion to 5.0.8 for the old minimatch consumers fails the macOS RN codegen with TypeError: expand is not a function: brace-expansion 5.x changed its export from a callable (module.exports = expand) to an object ({ expand }), which the old minimatch (used by RN codegen) calls as a function.

The advisory's only fix (5.0.8) is API-incompatible with the 1.x/2.x carriers, and there is no patched 1.x/2.x release, so these copies can't be bumped without breaking the toolchain. The safe 5.x portion is already handled by #6521. Dismissing alert #609 as tolerable_risk (dev-only, upstream-blocked).

antonis added the ready-to-merge Triggers the full CI test suite label Jul 28, 2026

antonis closed this Jul 28, 2026

Uh oh!

Uh oh!

Conversation

antonis commented Jul 28, 2026

📢 Type of change

📜 Description

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

github-actions Bot commented Jul 28, 2026

Semver Impact of This PR

Uh oh!

github-actions Bot commented Jul 28, 2026

Android (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions Bot commented Jul 28, 2026

iOS (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions Bot commented Jul 28, 2026

iOS (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions Bot commented Jul 28, 2026

Android (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

antonis commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant