chore(session-replay-react-native): bump Android SDK for SDKRN-69

[aliaksandr-kazarez]

Summary

• Bump @amplitude/session-replay-react-native to 1.0.2
• Bump Android session-replay-android dependency from [0.24.0,0.25.0) to [0.30.0,0.31.0) for MaskableCanvas drawGlyphs/drawRenderNode masking fix (SDKRN-69)

Blocked

Blocked on new session-replay-android version deployment — do not merge until Android SDK 0.30.0 (or later containing SDKRN-69) is published to Maven Central.

Published latest stable is 0.29.0; the SDKRN-69 fix is not yet released.

Test plan

• Verify Android build resolves session-replay-android once 0.30.0 is published
• Confirm MaskableCanvas glyph/render-node masking in RN sample app

[linear-code]

SDKRN-69

[github-actions]

size-limit report 📦

Path	Size
packages/analytics-browser/lib/scripts/amplitude-min.js.gz	64.31 KB (0%)
packages/session-replay-browser/lib/scripts/session-replay-browser-min.js.gz	135.32 KB (0%)
packages/unified/lib/scripts/amplitude-min.umd.js.gz	218.71 KB (0%)
@amplitude/element-selector (gzipped esm)	3.4 KB (0%)

[aliaksandr-kazarez]

SDKRN-69 investigation update (latest)

AOSP trace + API 36 instrumentation: Layout.draw() on TextView/StaticLayout uses drawText / drawTextRun only; drawGlyphs count = 0.

Unpatched 0.24.2 POC (Android 16 emulator): asterisks not readable PII — leak NOT reproduced via drawGlyphs.

Implication: The MaskableCanvas drawGlyphs gap is real but inactive for standard RN ReactTextView capture.

Bupa hypothesis (lead): AmpMaskView tag not reaching native views or iOS/Android plugin asymmetry — iOS amp-mask=block masks the entire view; Android uses bitmap asterisk masking, so the same RN code can behave differently.

Recommendation: HOLD on merge until we receive customer JSX/RN version and confirm root cause.

Repro matrix: ~/Projects/AmpSRMaskPOC/poc-evidence/sdkrn-69-repro-matrix/REPRO_MATRIX.md

RN dependency bumps here should wait for confirmed Android fix scope. Related defense-in-depth remains in session-replay-android PR #486.

[aliaksandr-kazarez]

Blocked on Android SDK deployment: do not merge until session-replay-android 0.30.0 is published.

[aliaksandr-kazarez]

Blocked — underlying Android fix repro unvalidated

Our POC does not reproduce the Bupa PII leak on unpatched Android SDK 0.24.2 (both unpatched/patched show asterisk masking). This bump PR should stay blocked until session-replay-android#486 is validated against the customer scenario.