build(deps-dev): bump @sentry/wizard from 6.12.0 to 6.13.0

[dependabot]

Bumps @sentry/wizard from 6.12.0 to 6.13.0.

Release notes

Sourced from @​sentry/wizard's releases.

6.13.0

Fixes

• fix(remix): Use npx @sentry/remix --upload-sourcemaps instead of sentry-upload-sourcemaps to avoid global bin collisions
• fix(all): Update userInfo data collection to be opt-out by default — generated code now shows // dataCollection: { userInfo: false } commented out instead of dataCollection: { userInfo: true }
• fix(all): Update dataCollection opt-out hint to include httpBodies
• fix(all): Use an empty dataCollection object in generated snippets instead of fully commenting it out

Features

• feat(apple): Add Apple Snapshots wizard for SnapshotPreviews Xcode setup
• feat(react-router): Use the stabilized instrumentation API (createSentryServerInstrumentation + reactRouterTracingIntegration().clientInstrumentation) instead of the experimental useInstrumentationAPI flag
• feat(react-router): Use sentryOnError on HydratedRouter instead of mutating root.tsx ErrorBoundary

Changelog

Sourced from @​sentry/wizard's changelog.

6.13.0

Fixes

• fix(remix): Use npx @sentry/remix --upload-sourcemaps instead of sentry-upload-sourcemaps to avoid global bin collisions
• fix(all): Update userInfo data collection to be opt-out by default — generated code now shows // dataCollection: { userInfo: false } commented out instead of dataCollection: { userInfo: true }
• fix(all): Update dataCollection opt-out hint to include httpBodies
• fix(all): Use an empty dataCollection object in generated snippets instead of fully commenting it out

Features

• feat(apple): Add Apple Snapshots wizard for SnapshotPreviews Xcode setup
• feat(react-router): Use the stabilized instrumentation API (createSentryServerInstrumentation + reactRouterTracingIntegration().clientInstrumentation) instead of the experimental useInstrumentationAPI flag
• feat(react-router): Use sentryOnError on HydratedRouter instead of mutating root.tsx ErrorBoundary

Commits

• db993cc release: 6.13.0
• 3fd04f8 feat(apple): Add non-interactive Apple Snapshots mode (#1297)
• ae8e925 feat(apple): Add interactive Apple Snapshots wizard (#1296)
• ba4e194 feat(apple): Refactor Xcode project primitives for snapshots (#1295)
• 4c43586 build(deps): bump vite (#1300)
• e559ba7 ref (#1288)
• 628c230 feat(react-router): Use the stabilized instrumentation API (#1287)
• 85fa3fa fix(all): Update dataCollection opt-out hint to include httpBodies (#1286)
• 91e3641 feat: Replace deprecated sendDefaultPii with dataCollection (#1282)
• 68b56bc build(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#1260)
• Additional commits viewable in compare view

[semgrep-code-getsentry]

Risk: Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal cookies.read() helper in lib/helpers/cookies.js builds a regular expression by concatenating the cookie name directly into the pattern without escaping regex metacharacters. When the cookie name flowing into the XSRF cookie read (e.g. via xsrfCookieName) contains a catastrophic-backtracking payload, evaluating the regex against document.cookie can freeze the JavaScript event loop, causing a denial of service in the browser tab or in Node.js/SSR applications. The affected code path is reached during ordinary axios request processing, so any importer of an affected version is exposed. Upgrade to a patched version (0.32.0 or 1.16.0), or set xsrfCookieName: null to disable XSRF cookie reading.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using axios in browser with untrusted xsrfCookieName value

Fix: Upgrade this library to at least version 1.16.0 at sentry-capacitor/yarn.lock:1466.

Reference(s): GHSA-hfxv-24rg-xrqf

⭐ Fixed in commit 08b1c1a ⭐

[semgrep-code-getsentry]

Risk: Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads config.proxy via prototype-chain property access, so any Object.prototype pollution elsewhere in the dependency tree silently routes all HTTP requests through an attacker-controlled proxy, yielding a full man-in-the-middle. The vulnerability fires on ordinary axios usage with no specific API call or configuration required; upgrade to axios 1.16.0 or later.

Manual Review Advice: A vulnerability from this advisory is reachable if you use axios to make HTTP requests

Fix: Upgrade this library to at least version 1.16.0 at sentry-capacitor/yarn.lock:1466.

Reference(s): GHSA-35jp-ww65-95wh, GHSA-fvcv-3m26-pcqx, CVE-2026-44494

🌟 Fixed in commit 08b1c1a 🌟