chore(deps): bump brace-expansion resolutions to ^2.1.2 (dev-only advisory)

[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Bumps the three minimatch@npm:*/brace-expansion resolutions from ^2.0.3 to ^2.1.2.

This addresses GHSA / high-severity advisory: "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups" (affects brace-expansion >=2.0.0 <2.1.2). The vulnerable copy (2.0.3) was pulled transitively via minimatch@9.0.9. The sibling minimatch@5.1.9 / minimatch@8.0.7 resolutions are bumped for consistency.

💡 Motivation and Context

Dependabot flagged this transitive advisory. It affects dev/build tooling only — it is not part of the shipped @sentry/react-native runtime, whose production dependency tree audits clean.

💚 How did you test it?

• yarn install --immutable passes (lockfile in sync).
• yarn npm audit --recursive no longer reports the brace-expansion advisory.
• CI (build, test, lint, integrity, codegen) runs on this PR.

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
• No breaking changes.

🔮 Next steps

Companion PRs bump the other easy dev-only transitive advisories (js-yaml, cross-spawn, glob). The remaining sigstore / @octokit/* / uuid advisories are bundled deep in lerna and are best handled by a separate lerna upgrade.

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• chore(deps): bump brace-expansion resolutions to ^2.1.2 (dev-only advisory) by antonis in #6488

• chore(ios): Bump iOS binary size limit to 1650 KiB by antonis in #6485
• chore(deps): bump tar from 7.5.16 to 7.5.20 by dependabot in #6483
• chore(deps): bump shell-quote from 1.8.4 to 1.10.0 by dependabot in #6484
• chore(deps): bump the codeql-action group with 3 updates by dependabot in #6475
• chore(deps): bump brace-expansion from 1.1.13 to 1.1.16 by dependabot in #6482
• chore(deps): bump axios from 1.16.0 to 1.18.1 by dependabot in #6479
• chore(deps): bump actions/setup-java from 5.5.0 to 5.6.0 by dependabot in #6476

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 8347973