[dependabot]

Updates the requirements on json to permit the latest version.

Changelog

Sourced from json's changelog.

2026-09-09 (3.0.2)

• Fix JSON.load_file and JSON.load_file! to load on Ruby 2.7.0 through 2.7.2, which cannot parse a leading parameter before ....

2026-09-08 (3.0.1)

• Restore the limit positional argument of JSON.dump.

2026-09-07 (3.0.0)

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.

2026-08-11 (3.0.0.rc1)

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.
• Removed JSON.load_default_options.
• Removed JSON.unsafe_load_default_options.
• Removed JSON.dump_default_options.
• Removed JSON::State#[] and JSON::State#[]=.
• Removed JSON.unparse.
• Removed JSON.fast_generate.
• Removed JSON.fast_unparse.
• Removed JSON.pretty_unparse.
• Removed JSON.restore.

... (truncated)

Commits

• 7b2a23d Release 3.0.2
• effca27 Fix the JSON::Coder.new call-seq
• 8bdd517 Update documentation to match json 3.0 API
• 29dad14 Fix JSON.load_file and JSON.load_file! to load on Ruby 2.7.0 through 2.7.2
• 73edd53 Centralize requires in the test suite
• c557a62 Release 3.0.1
• 566bd7c Restore the limit positional argument of JSON.dump
• 9427d36 Release 3.0.0
• 82bf6be Fix parser silently accepting a lone trailing surrogate in string values
• 1d37403 Stop installing ragel on CI
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[snaka]

The failure is caused by lifting the json < 3 pin, which is intentional (see the comment right above it in the Gemfile).

json 3.0 removed the quirks_mode option, but ActiveSupport's JSONGemEncoder still passes it:

# activesupport/lib/active_support/json/encoding.rb:110 (7.2.3.2 and 8.0.4)
::JSON.generate(jsonified, quirks_mode: true, max_nesting: false)

So every to_json call (e.g. lib/split/experiment.rb:461) raises ArgumentError: unknown keyword: quirks_mode, resulting in 522 examples, 145 failures on test (4.0, 7.2). The other jobs were cancelled by fail-fast, but the Rails 8.0 jobs would fail for the same reason. ActiveSupport 8.1 no longer passes quirks_mode, so the pin can be dropped once Rails < 8.1 support is removed from the CI matrix.

Suggestion:

• Close this PR.

• To keep Dependabot from reopening it, add an ignore rule to .github/dependabot.yml:

    ignore:
      - dependency-name: "json"
        versions: [">= 3"]

(Side note: the Gemfile comment says "7.2.3.x", but 8.0.x is affected too.)

[andrehjr]

@dependabot ignore this major version

[dependabot]

OK, I won't notify you about version 3.x.x again, unless you re-open this PR.