security: fix remaining high-severity dependency vulnerabilities

[Bulzan Sergiu (busec0)]

Summary

• Update fast-xml-parser 4.5.4 → 5.5.6 in react-native yarn resolutions and react-native-expo overrides/resolutions (CVE-2026-26278)
• Update flatted 3.3.3 → 3.4.2 in react-native yarn resolutions (unbounded recursion DoS + prototype pollution)
• Update json gem 2.16.0 → 2.19.2 in react-native Gemfile (high severity)

Resolves Dependabot alerts: #264, #265, #266, #267, #268

Linear Tickets

Small Peer - Security

Closes

• SPO-232 — flatted unbounded recursion DoS (react-native/yarn.lock, dependabot #264)
• SPO-256 — fast-xml-parser CVE-2026-26278 (react-native-expo/package-lock.json, dependabot #265)
• SPO-258 — fast-xml-parser CVE-2026-26278 (react-native/yarn.lock, dependabot #266)
• SPO-257 — fast-xml-parser CVE-2026-26278 (react-native-expo/yarn.lock, dependabot #267)
• SPO-275 — Ruby JSON format string injection (react-native/Gemfile.lock, dependabot #268)

Likely also resolved (verify before closing)

• SPO-72, SPO-73, SPO-74 — older fast-xml-parser entity encoding bypass (dependabot feat(kotlin-multiplatform): replace XCUITest with Appium for iOS testing #176-Bump Ditto dependency to 4.12.2 #178, may be in other quickstart app lockfiles)

Update

• SPO-298 — react-native-expo dependency vulnerability tracking issue

Test plan

• Verify yarn.lock files resolve updated package versions
• Verify package-lock.json in react-native-expo has fast-xml-parser 5.5.6
• Verify bundle exec works with updated json gem
• CI passes

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates dependency pins/lockfiles in the React Native sample apps to remediate high-severity vulnerability alerts (Dependabot #264–#268), including JS package overrides and a Ruby gem bump.

Changes:

• Bump fast-xml-parser to 5.5.6 via Yarn resolutions / npm overrides and update associated lockfiles.
• Bump flatted to 3.4.2 (react-native resolutions + lockfile).
• Bump Ruby json gem to 2.19.2 and add a minimum constraint in Gemfile.

Reviewed changes

Copilot reviewed 3 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
react-native/yarn.lock	Locks fast-xml-parser@5.5.6 (+ new transitive deps) and flatted@3.4.2.
react-native/package.json	Forces fast-xml-parser@5.5.6 and flatted@3.4.2 via resolutions.
react-native/Gemfile	Adds json (>= 2.17.2) to address gem vulnerability.
react-native/Gemfile.lock	Updates locked json version and bundler version.
react-native-expo/yarn.lock	Updates fast-xml-parser lock entry and adds new transitive deps.
react-native-expo/package.json	Forces fast-xml-parser@5.5.6 via resolutions + overrides.
react-native-expo/package-lock.json	Locks fast-xml-parser@5.5.6 and adds new transitive deps.

Files not reviewed (1)

• react-native-expo/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Bulzan Sergiu (busec0)]

React Native Expo CI / Test Android - BrowserStack Maestro (pull_request) -> Failing, but a flake on browser stack. The Automation just scrolls past the element it fails to find 🙃 . Merging without it, it works on 1 out of 2 devices anyway.