chore(deps): bump js-yaml resolution to ^4.3.0 (dev-only advisory)

[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Bumps the js-yaml resolution from ^4.2.0 to ^4.3.0, resolving js-yaml to 4.3.0 in the lockfile.

This addresses GHSA / high-severity advisory: "YAML merge-key chains can force quadratic CPU consumption" (affects js-yaml >=4.0.0 <4.3.0). The vulnerable copy (4.2.0) was pulled transitively via lerna@8.1.8.

💡 Motivation and Context

Dependabot flagged this transitive advisory. The affected package is dev/build tooling only (lerna, used for releases) — it is not part of the shipped @sentry/react-native runtime, whose production dependency tree audits clean. This is a defensive bump to keep the dev toolchain free of known advisories.

💚 How did you test it?

• yarn install --immutable passes (lockfile in sync).
• yarn npm audit --recursive no longer reports the js-yaml advisory.
• CI (build, test, lint, integrity, codegen) runs on this PR.

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
• No breaking changes.

🔮 Next steps

Companion PRs bump the other easy dev-only transitive advisories (brace-expansion, cross-spawn, glob). The remaining sigstore / @octokit/* / uuid advisories are bundled deep in lerna and are best handled by a separate lerna upgrade.

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• chore(deps): bump js-yaml resolution to ^4.3.0 (dev-only advisory) by antonis in #6486

• chore(ios): Bump iOS binary size limit to 1650 KiB by antonis in #6485
• chore(deps): bump tar from 7.5.16 to 7.5.20 by dependabot in #6483
• chore(deps): bump shell-quote from 1.8.4 to 1.10.0 by dependabot in #6484
• chore(deps): bump the codeql-action group with 3 updates by dependabot in #6475
• chore(deps): bump brace-expansion from 1.1.13 to 1.1.16 by dependabot in #6482
• chore(deps): bump axios from 1.16.0 to 1.18.1 by dependabot in #6479
• chore(deps): bump actions/setup-java from 5.5.0 to 5.6.0 by dependabot in #6476

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against fe2cef3