Bump json to patched version, fixing CVE-2026-71847

json 2.21.1 and earlier ship a use-after-free in
JSON::ResumableParser#partial_value that can crash on truncated
duplicate-key streams (GHSA-9hj4-r449-hfvc). Bump the runtime
dependency floor to 2.21.2, which includes the fix.

Cherry-picked from fa380fa on master; version.rb is left unchanged
since next tracks the unreleased 3.0.0pre line.

Author: evolve75

CHANGELOG.md

@@ -6,6 +6,13 @@ Changes section to scan for breaking or behavioral changes.
 
 ## Release History
 
+### 3.0.0pre / 2026-08-09
+
+* Bump the `json` runtime dependency to `2.21.2`+, fixing a use-after-free in
+  `JSON::ResumableParser#partial_value` that could crash on truncated
+  duplicate-key streams
+  ([CVE-2026-71847](https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc)).
+
 ### 3.0.0pre / 2026-07-24
 
 * Bump the `json` runtime dependency to `2.19.9`+, fixing a heap buffer

Gemfile.lock

@@ -2,7 +2,7 @@ PATH
   remote: .
   specs:
     rubytree (3.0.0pre)
-      json (~> 2.19, >= 2.19.9)
+      json (~> 2.19, >= 2.21.2)
 
 GEM
   remote: https://rubygems.org/
@@ -22,7 +22,7 @@ GEM
     docile (1.4.1)
     erb (4.0.4.1)
       cgi (>= 0.3.3)
-    json (2.21.1)
+    json (2.21.2)
     kramdown (2.5.2)
       rexml (>= 3.4.4)
     kramdown-parser-gfm (1.1.0)

rubytree.gemspec

@@ -67,7 +67,7 @@ Gem::Specification.new do |s|
                             '--main', 'README.md',
                             '--quiet']
 
-  s.add_dependency 'json', '~> 2.19', '>= 2.19.9'
+  s.add_dependency 'json', '~> 2.19', '>= 2.21.2'
 
   # NOTE: Rake is added as a development and test dependency in the Gemfile.
   s.add_development_dependency 'bundler', '~> 2.6'