Update dependencies; lock json 3, keep json 2 covered in CI

.github/workflows/fuzz.yml

@@ -26,7 +26,7 @@ jobs:
       run:
         working-directory: ext/nosj
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: "3.4"

.github/workflows/lint.yml

@@ -15,7 +15,7 @@ jobs:
   standardrb:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ruby/setup-ruby@v1
         with:
@@ -27,7 +27,7 @@ jobs:
   rbs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ruby/setup-ruby@v1
         with:

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
       tag: ${{ steps.version.outputs.tag }}
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Read version
         id: version
@@ -52,7 +52,7 @@ jobs:
     needs: version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
 
@@ -103,7 +103,7 @@ jobs:
     env:
       SKIP_PGO: ${{ matrix.skip_pgo || '' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
 
@@ -163,7 +163,7 @@ jobs:
           - { platform: aarch64-linux-musl, os: ubuntu-24.04-arm }
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
 
@@ -219,7 +219,7 @@ jobs:
             }
     runs-on: ${{ matrix.runs_on }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
           sparse-checkout: script/ci/smoke.rb
@@ -258,7 +258,7 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
 

.github/workflows/test.yml

@@ -25,7 +25,7 @@ jobs:
         ruby: ["3.3", "3.4", "4.0"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Ruby & Rust
         uses: oxidize-rb/actions/setup-ruby-and-rust@v1
@@ -65,7 +65,7 @@ jobs:
       NOSJ_JSON_VERSION: ${{ matrix.json }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Ruby & Rust
         uses: oxidize-rb/actions/setup-ruby-and-rust@v1
@@ -86,8 +86,8 @@ jobs:
       - name: Run the Rails-facing specs
         run: bundle exec rspec spec/rails_spec.rb spec/rails_integration_spec.rb spec/json_dropin_spec.rb
 
-  # The whole suite against json 3 (the main matrix runs the locked json
-  # 2.x): the drop-in follows whichever is installed, and the parity
+  # The whole suite against json 2 (the main matrix runs the locked json
+  # 3.x): the drop-in follows whichever is installed, and the parity
   # specs compare against it.
   json-compat:
     name: json ${{ matrix.json }} on Ruby ${{ matrix.ruby }}
@@ -96,21 +96,21 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { json: "~> 3.0", ruby: "3.3" }
-          - { json: "~> 3.0", ruby: "4.0" }
+          - { json: "< 3", ruby: "3.3" }
+          - { json: "< 3", ruby: "4.0" }
     env:
       NOSJ_JSON_VERSION: ${{ matrix.json }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Ruby & Rust
         uses: oxidize-rb/actions/setup-ruby-and-rust@v1
         with:
           ruby-version: ${{ matrix.ruby }}
           cargo-cache: true
 
-      # The committed lockfile pins json 2.x; the pin needs a fresh
+      # The committed lockfile pins json 3.x; the pin needs a fresh
       # resolution.
       - name: Bundle with the pinned json
         run: |

Gemfile

@@ -27,14 +27,14 @@ group :test do
   gem "actionpack", *[rails_pin].compact
 end
 
-# Pinnable for CI's json-compat matrix (e.g. "~> 3.0"): the drop-in
-# follows whichever json is installed. A pinned run leaves out standard,
-# whose rubocop requires json 2.x.
+# Pinnable for CI's json-compat and rails-compat matrices (e.g. "< 3"):
+# the drop-in follows whichever json is installed.
 json_pin = ENV.fetch("NOSJ_JSON_VERSION", nil)
 gem "json", json_pin if json_pin
 
 group :development do
-  gem "standard", "~> 1.3" unless json_pin
+  # 1.57 is the first standard whose rubocop accepts json 3.
+  gem "standard", "~> 1.57"
   gem "rbs", "~> 4.0"
   gem "yard", "~> 0.9"
   gem "lefthook", "~> 2.1"