chore(deps): update Wizard to v6.13.0

[github-actions]

Bumps scripts/update-wizard.sh from v6.12.0 to v6.13.0.

Auto-generated by a dependency updater.

Changelog

6.13.0

Fixes

• fix(remix): Use npx sentry/remix --upload-sourcemaps instead of sentry-upload-sourcemaps to avoid global bin collisions
• fix(all): Update userInfo data collection to be opt-out by default — generated code now shows // dataCollection: { userInfo: false } commented out instead of dataCollection: { userInfo: true }
• fix(all): Update dataCollection opt-out hint to include httpBodies
• fix(all): Use an empty dataCollection object in generated snippets instead of fully commenting it out

Features

• feat(apple): Add Apple Snapshots wizard for SnapshotPreviews Xcode setup
• feat(react-router): Use the stabilized instrumentation API (createSentryServerInstrumentation + reactRouterTracingIntegration().clientInstrumentation) instead of the experimental useInstrumentationAPI flag
• feat(react-router): Use sentryOnError on HydratedRouter instead of mutating root.tsx ErrorBoundary

[semgrep-code-getsentry]

High severity vulnerability may affect your project—review required:
Line 1466 lists a dependency (axios) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal cookies.read() helper in lib/helpers/cookies.js builds a regular expression by concatenating the cookie name directly into the pattern without escaping regex metacharacters. When the cookie name flowing into the XSRF cookie read (e.g. via xsrfCookieName) contains a catastrophic-backtracking payload, evaluating the regex against document.cookie can freeze the JavaScript event loop, causing a denial of service in the browser tab or in Node.js/SSR applications. The affected code path is reached during ordinary axios request processing, so any importer of an affected version is exposed. Upgrade to a patched version (0.32.0 or 1.16.0), or set xsrfCookieName: null to disable XSRF cookie reading.

References: GHSA

To resolve this comment:
Check if you are using axios in browser with untrusted xsrfCookieName value.

• If you're affected, upgrade this dependency to at least version 1.16.0 at yarn.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-getsentry]

High severity vulnerability may affect your project—review required:
Line 1466 lists a dependency (axios) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads config.proxy via prototype-chain property access, so any Object.prototype pollution elsewhere in the dependency tree silently routes all HTTP requests through an attacker-controlled proxy, yielding a full man-in-the-middle. The vulnerability fires on ordinary axios usage with no specific API call or configuration required; upgrade to axios 1.16.0 or later.

References: GHSA, GHSA, CVE

To resolve this comment:
Check if you use axios to make HTTP requests.

• If you're affected, upgrade this dependency to at least version 1.16.0 at yarn.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}