[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Adds a resolutions override pinning decode-uri-component to the patched 0.5.1 to clear a quadratic-time DoS advisory.

query-string@7.1.3 pins decode-uri-component@^0.2.2, so Dependabot refuses to update it (0.5.1 is outside that range). A yarn resolutions override bypasses the range, and it is a safe drop-in: the package has zero dependencies and the same single-function API across 0.2 → 0.5 — only the internal decoder was rewritten.

Package	Before → After	Advisory	Alert
decode-uri-component	0.2.2 → 0.5.1	Quadratic-time DoS via percent-encoded runs on malformed input	#723 (high)

💡 Motivation and Context

Resolves one open Dependabot alert that Dependabot itself cannot auto-fix. decode-uri-component is a transitive sample-app dependency (query-string ← @react-navigation/core, used by the RN and macOS sample apps) — not a dependency of the shipped @sentry/react-native package (packages/core), so nothing reaches end-user apps.

💚 How did you test it?

Added "decode-uri-component": "^0.5.1" to root resolutions, ran yarn install (resolves to 0.5.1), and verified only package.json and yarn.lock changed.

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
• No breaking changes.

🔮 Next steps

Remove the decode-uri-component resolutions override once query-string (via @react-navigation) widens its range to a patched release.

🤖 Generated with Claude Code

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• build(deps): Pin decode-uri-component to patched 0.5.1 to resolve DoS advisory by antonis and claude in #6975

• fix(android): Restore enableLogs option mapping by antonis and claude in #6967
• chore(deps): update Wizard to v9.1.0 by github-actions in #6972
• chore(deps): update Sentry Android Gradle Plugin to v6.25.0 by github-actions in #6971

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 467b314

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 467b314. Configure here.}

[cursor]

ESM override breaks query-string

High Severity

The decode-uri-component resolution jumps to 0.5.1, but that release is ESM-only with a default export. query-string@7.1.3 still requires a CommonJS callable, so the override yields a module namespace and TypeError: decodeComponent is not a function when React Navigation or expo-router parse query strings in the sample apps.

Additional Locations (1)

• yarn.lock#L12339-L12343

 

^{Triggered by project rule: PR Review Guidelines for Cursor Bot}

^{Reviewed by Cursor Bugbot for commit 467b314. Configure here.}

[antonis]

Good catch — confirmed. decode-uri-component went ESM-only in 0.4.0, and query-string@7.1.3 loads it via a CommonJS require(), so forcing 0.5.1 yields a non-callable module namespace and decodeComponent is not a function when the sample apps parse query strings.

There's no CJS-compatible patched release — 0.2.2 is the last CommonJS version, and every fixed release (0.4+/0.5) is ESM-only. Since this is sample-app-only (query-string ← @react-navigation), DoS-only, and not part of the shipped @sentry/react-native, we're dismissing the Dependabot alert as tolerable risk and closing this PR rather than shipping a broken override.