[Aikido] Fix 5 security issues in json, sinatra

[aikido-autofix]

Upgrade JSON and Sinatra to fix heap use-after-free vulnerabilities in resumable parser and DoS/open redirect issues in header parsing.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-769167	LOW	[json] A heap use-after-free vulnerability in the resumable parser allows attackers to crash the Ruby process by feeding crafted truncated JSON with duplicate keys and calling partial_value, which reads freed memory through stale state pointers.
CVE-2026-71847	LOW	[json] A heap-use-after-free vulnerability in the native C extension allows attackers to cause process termination (DoS) by supplying malicious JSON stream data with duplicate keys to applications using JSON::ResumableParser's partial_value method.
CVE-2024-21510	LOW	[sinatra] Open Redirect vulnerability via X-Forwarded-Host header allows attackers to redirect users to arbitrary addresses. This can enable Cache Poisoning or Routing-based SSRF attacks when used with reverse proxies or caching servers.
CVE-2025-61921	LOW	[sinatra] Denial of service vulnerability in If-Match and If-None-Match header parsing when using the etag method, where crafted input causes excessive processing time. Applications using the etag method for response generation are vulnerable to DoS attacks.
AIKIDO-2025-10702	LOW	[sinatra] A Regular Expression Denial of Service (ReDoS) vulnerability exists in ETag header parsing via the split(/s*,s*/) operation. An attacker can send a specially crafted ETag header with excessive whitespace and commas to cause catastrophic regex backtracking, consuming CPU resources and causing denial of service.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-18252

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!