Allow json 3.x

[dduugg]

What

Widens the json runtime dependency from ~> 2.1, >= 2.1.0 to >= 2.1.0, < 4, so the gem can be installed in bundles that resolve json 3.x.

-  s.add_runtime_dependency 'json', '~> 2.1', '>= 2.1.0'
+  s.add_runtime_dependency 'json', '>= 2.1.0', '< 4'

Gemfile.lock is updated to match the new constraint. The resolved json version in the lock is left at 2.7.2 to keep the diff minimal.

Why

json 3.0.0.rc1 was released on 2026-08-11. Because ~> 2.1 means >= 2.1, < 3.0, this gem currently blocks any application in the same bundle from upgrading, even though the SDK itself is unaffected by the 3.0 changes. We hit this while testing json 3.0.0.rc1 in a large Rails application.

Why this is safe

lib/xero-ruby/api_client.rb is the only place the SDK touches the json API, and each call site is compatible with 3.0:

Call site	json 3.0 status
JSON.parse(response.body) (×3)	Default options; unchanged
JSON.parse("[#{body}]", :symbolize_names => true)	symbolize_names is still a supported option, and it is passed as inline keyword arguments, so the stricter keyword handling in 3.0 does not affect it
rescue JSON::ParserError	Still raised by 3.0
body.to_json (×2)	Unchanged
JSON::JWK::Set / JSON::JWT	These come from json-jwt, not json. json-jwt 1.17.2 resolves cleanly alongside json 3.0.0.rc1

None of the removed 3.0 APIs (create_additions, JSON::GenericObject, Kernel#j/#jj, JSON.unparse, JSON.fast_generate, JSON.restore, JSON::State#[]) are used anywhere in lib/.

Verification

Full spec suite on Ruby 3.4.10 with json 3.0.0.rc1 resolved:

3197 examples, 0 failures

(One pre-existing rspec deprecation warning about implicit block expectation syntax, unrelated to this change.)

The upper bound < 4 is retained so a future json 4.0 does not silently become eligible. required_ruby_version is left at >= 2.3 — bundler will still resolve json 2.x on rubies too old for json 3.

Note on codegen

I see from CONTRIBUTING.md that this SDK is generated via OpenAPI Generator, so this gemspec change likely needs to be made in the corresponding mustache template as well for it to survive the next regeneration. Happy to point at the template or close this in favour of an issue if that is the preferred path.