chore(plugin-session-replay-react-native): bump Android SDK for SDKRN-69

[aliaksandr-kazarez]

Summary

• Bump @amplitude/plugin-session-replay-react-native to 0.5.2
• Bump session-replay-android dependency to [0.30.0,0.31.0) to pick up the MaskableCanvas drawGlyphs / drawRenderNode masking fix (SDKRN-69)

Blocked on

Blocked on session-replay-android deployment — do not merge until Android SDK 0.30.0 (or whichever release includes the fix) is published.

Test plan

• Verify Android build after session-replay-android fix is released
• Confirm nested Text under AmpMaskView masks correctly in replay

[linear-code]

SDKRN-69

[github-actions]

size-limit report 📦

Path	Size
packages/analytics-browser/lib/scripts/amplitude-min.js.gz	64.31 KB (0%)
packages/session-replay-browser/lib/scripts/session-replay-browser-min.js.gz	135.32 KB (0%)
packages/unified/lib/scripts/amplitude-min.umd.js.gz	218.71 KB (0%)
@amplitude/element-selector (gzipped esm)	3.4 KB (0%)

[aliaksandr-kazarez]

SDKRN-69 investigation update (latest)

AOSP trace + API 36 instrumentation: Layout.draw() on TextView/StaticLayout uses drawText / drawTextRun only; drawGlyphs count = 0.

Unpatched 0.24.2 POC (Android 16 emulator): asterisks not readable PII — leak NOT reproduced via drawGlyphs.

Implication: The MaskableCanvas drawGlyphs gap is real but inactive for standard RN ReactTextView capture.

Bupa hypothesis (lead): AmpMaskView tag not reaching native views or iOS/Android plugin asymmetry — iOS amp-mask=block masks the entire view; Android uses bitmap asterisk masking, so the same RN code can behave differently.

Recommendation: HOLD on merge until we receive customer JSX/RN version and confirm root cause.

Repro matrix: ~/Projects/AmpSRMaskPOC/poc-evidence/sdkrn-69-repro-matrix/REPRO_MATRIX.md

RN dependency bumps here should wait for confirmed Android fix scope. Related defense-in-depth remains in session-replay-android PR #486.

[aliaksandr-kazarez]

Blocked — underlying Android fix repro unvalidated

Our POC does not reproduce the Bupa PII leak on unpatched Android SDK 0.24.2 (both unpatched/patched show asterisk masking). This bump PR should stay blocked until session-replay-android#486 is validated against the customer scenario.

[aliaksandr-kazarez]

Blocked on Android SDK deployment: do not merge until session-replay-android 0.30.0 (or later with SDKRN-69) is published to Maven Central.