[dependabot]

Bumps json from 2.21.2 to 3.1.0.

Release notes

Sourced from json's releases.

v3.0.0

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.
• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.
• Removed JSON.load_default_options.
• Removed JSON.unsafe_load_default_options.
• Removed JSON.dump_default_options.
• Removed JSON::State#[] and JSON::State#[]=.
• Removed JSON.unparse.
• Removed JSON.fast_generate.
• Removed JSON.fast_unparse.
• Removed JSON.pretty_unparse.
• Removed JSON.restore.
• Removed JSON::PRETTY_STATE_PROTOTYPE.
• Removed the insecure create_additions option.
• Removed JSON::GenericObject.

Full Changelog: ruby/json@v2.21.2...v3.0.0

v3.0.0.rc1

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

... (truncated)

Changelog

Sourced from json's changelog.

2026-10-13 (3.1.0)

• Added rfc8785 generator option to canonicalize the output. Replaces the json-canonicalization with numerous correctness fixes.
• Use the rb_len_t type introduced in Ruby 4.1 to allow for proper 64bit support on LP64 platforms (Windows).
• JRuby: parser errors now include the position (line, column and the message suffix) as well as json_path, matching the C extension.
• Improved the accuracy of parser error's line, column and snipets in presence of multibyte characters.
• Fix JSON.load to work correctly when provided a Zlib::GzipReader as IO source.
• Reject non-ASCII BINARY strings during JSON generation. This was deprecated since a long time and scheduled to be removed for 3.0.

2026-09-09 (3.0.2)

• Fix JSON.load_file and JSON.load_file! to load on Ruby 2.7.0 through 2.7.2, which cannot parse a leading parameter before ....

2026-09-08 (3.0.1)

• Restore the limit positional argument of JSON.dump.

2026-09-07 (3.0.0)

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.

2026-08-11 (3.0.0.rc1)

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.

... (truncated)

Commits

• a15b2ba Release 3.1.0
• d09e383 Refactor rfc8785_sort_keys_proc
• e19f7d7 Handle invalid encoding in JSON path keys
• 78d6a83 parser.c: only update the stack once fully spilled
• 6ea6201 Fix parsing of number with out of range negative exponents
• 1b67eb3 Fix parsing of unescaped NULL bytes in strings
• c1a4372 ResumableParser: fix handling of incomplete unicode escape
• 429c109 More hardening against adversarial encode methods
• 8df32ab Index the generated JSON array by rb_len_t
• 21193d0 Match rb_hash_bulk_insert fallback to Ruby's declaration
• Additional commits viewable in compare view

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head 1d10b5826fea268504f3983aa1552a4fb5ab590c) · Confidence: High

json 2.21.2 → 3.1.0 is now safe to merge: this head is rebased onto a base containing the rails 8.1.4 bump (#3052), whose ActiveSupport calls ::JSON.parse with keyword arguments, removing the previously fatal positional-call break; empirical checks at the exact head and lockfile (json 3.1.0 + activesupport 8.1.4) confirm cookie round-trips and body decoding, and all three given checks plus my own full local suite run (1746 examples, 0 failures) are green. The only residue is the now-stale Gemfile pin comment above the new constraint, worth removing in a follow-up.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
Session-cookie JSON decode round trip under ActiveSupport	Verified	Empirical cookie dump/load through SerializerWithFallback[:json] at the pinned gems, plus given probe pass and local full-suite run.
JSON request bodies parse via ActionDispatch params	Verified	Line-traced activesupport 8.1.4 decoding.rb call and decode of a JSON body under json 3.1.0 at the head.
OmniAuth codebar strategy parses provider responses with argless JSON.parse	Verified	auth-suite (given pass) exercises all three call sites.
Probe round-trip for github-linked and magic-link-only session classes	Verified	Given probe pass for both named session classes, corroborated by the passing local full-suite run of the same session paths.

Compatibility analysis — 1 package

• json 2.21.2 → 3.1.0: Json 3.0 changes hits the one break (ActivationSupport's positional parse call) is gone: activesupport 8.1.4 in the base calls parse keyword-style. Remaining stricter defaults (duplicate-key rejection, lone-surrogate rejection, binary-string generation rejection) touch no used path. Stale Gemfile pin comment (lines 38-41) still claims the pin is needed — hygiene only.

Usage of 1 dependency

• json: Direct: lib/omniauth/strategies/codebar.rb — three argless JSON.parse(response.body) calls (lines 171, 193, 255). Indirect: activesupport, faraday, pagy, rubocop lock dependencies; no JSON.load/create_additions/GenericObject usage in app, lib, config, or spec.

Test coverage

• Strong: entire suite re-run locally at the exact head and lockfile (parallel_rspec, 3 processes, 1746 examples, 0 failures), covering session-cookie reads, JSON body parsing, and the previously implicated flows.
• Strong: all three given checks (planner-suite, auth-suite, probe) pass, matching prior local diagnosis that the old failure was an activesupport/version interaction fixed by rails 8.1.4.
• Thin: no test covers json 3.1.0's stricter defaults on edge payloads (duplicate keys, lone UTF-16 surrogates, non-ASCII binary strings) — none are used by the repo.
• Gap: none remaining for the upgrade itself.

Calibration and confidence

Confidence: High — Every contract was verified at the rigor required: line-traced and empirically reproduced at the pinned gem versions at this head, with the full local suite re-run green and all harness checks passing.

1. Weakest claim: The untested assumption about payload shapes noted above; it would be shored up by fuzzing session/provider payloads against json 3.1.0, though the argless, plain-string usage makes edge failure unlikely.
2. Relied on but unverified: That provider responses and session payloads never exercise the stricter 3.1.0 defaults (duplicate keys, lone surrogates, binary strings) — no test covers those edge shapes.
3. Falsifier: Production traffic carrying duplicate keys, lone UTF-16 surrogates, or non-ASCII binary strings through JSON parse/generate paths (e.g. a provider response or session payload) would prove this verdict wrong.

Failure diagnosis

Failing tests: none named
Likely cause: No failing checks at this head: planner-suite, auth-suite, and probe all pass, and the full suite reproduces green locally (1746 examples, 0 failures) with the PR's lockfile.
Location: n/a — upgrade diff is Gemfile lines 38-42 and the corresponding Gemfile.lock entries

Previous verdicts

• 2026-10-22T14:35:00.657Z head 2c45a2eaecbbc546c4f1a3f3f50bddf0dcebbaed: Incompatible (High)

[mroderick]

Rails 8.1.4 (in #3052) contains the ActiveSupport::JSON.decode fix for json 3.x. Rebasing this onto the new master should go green — the Gemfile pin flip in this branch stays valid.

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with master! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.