chore(deps): pin glob 10.x to ^10.5.0 (dev-only advisory)

[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Pins the shared glob 10.x instance to ^10.5.0 (it was resolving to 10.4.5), and updates the companion glob/minimatch resolution selector from glob@npm:10.4.5 to glob@npm:10.5.0 accordingly. Only the glob 10.x line moves — glob v7/v8/v9/v13 are untouched.

This addresses GHSA / high-severity advisory: "glob CLI: Command injection via -c/--cmd executes matches with shell:true" (affects glob >=10.2.0 <10.5.0), pulled transitively via @npmcli/package-json@5.2.0 (and other dev tooling).

Note: the advisory concerns the glob CLI invoked with -c/--cmd. As a transitive library dependency it is not actually reachable/exploitable here — this bump clears the advisory defensively.

💡 Motivation and Context

Dependabot flagged this transitive advisory. It affects dev/build tooling only — it is not part of the shipped @sentry/react-native runtime, whose production dependency tree audits clean.

💚 How did you test it?

• yarn install --immutable passes (lockfile in sync, no unused-resolution warnings).
• yarn npm audit --recursive no longer reports the glob advisory; the glob 10.x tree collapses to a single glob@10.5.0 whose minimatch stays pinned to a safe ^9.0.7.
• CI (build, test, lint, integrity, codegen) runs on this PR.

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
• No breaking changes.

🔮 Next steps

Companion PRs bump the other easy dev-only transitive advisories (js-yaml, cross-spawn, brace-expansion). The remaining sigstore / @octokit/* / uuid advisories are bundled deep in lerna and are best handled by a separate lerna upgrade.

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• chore(deps): pin glob 10.x to ^10.5.0 (dev-only advisory) by antonis in #6489

• chore(ios): Bump iOS binary size limit to 1650 KiB by antonis in #6485
• chore(deps): bump tar from 7.5.16 to 7.5.20 by dependabot in #6483
• chore(deps): bump shell-quote from 1.8.4 to 1.10.0 by dependabot in #6484
• chore(deps): bump the codeql-action group with 3 updates by dependabot in #6475
• chore(deps): bump brace-expansion from 1.1.13 to 1.1.16 by dependabot in #6482
• chore(deps): bump axios from 1.16.0 to 1.18.1 by dependabot in #6479
• chore(deps): bump actions/setup-java from 5.5.0 to 5.6.0 by dependabot in #6476

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against ea3f335