Update json requirement from 2.9.1 to 2.21.2

[dependabot]

Updates the requirements on json to permit the latest version.

Release notes

Sourced from json's releases.

v2.21.2

What's Changed

• Fix a use-after-free bug in JSON::ResumableParser. [GHSA-9hj4-r449-hfvc].

Full Changelog: ruby/json@v2.21.1...v2.21.2

Changelog

Sourced from json's changelog.

2026-07-31 (2.21.2)

• Fix a use-after-free bug in JSON::ResumableParser. [GHSA-9hj4-r449-hfvc][CVE-2026-71847].

2026-07-13 (2.21.1)

• Fix a compilation issue on Window and Microsoft Visual C++.

2026-07-12 (2.21.0)

• JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
• Added #empty? and #partial_value? methods on JSON::ResumableParser.
• Numerous correctness and performance fixes for JSON::ResumableParser.
• Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
• Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.

2026-06-23 (2.20.0)

• Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
  • The :max_nesting option still defaults to 100.
• Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
• Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
• Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
• Integrate with Ruby 4.1 ruby_sized_xfree.

2026-06-11 (2.19.9)

• Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

2026-06-03 (2.19.8)

• Fix 1-byte buffer overread on EOS errors.
• Handle invalid types passed as max_nesting option.

2026-05-28 (2.19.7)

• Fix some more edge cases with out of range floats.
• Ensure the string provided to JSON.parse can't be mutated during parsing.
• Add missing write barriers in State#dup.
• Further validate generator depth config.

2026-05-28 (2.19.6)

• Cleanly handle overly large depth generator argument.
• Add missing write barrier in ParserConfig.

2026-05-04 (2.19.5)

... (truncated)

Commits

• 5a32e43 Release 2.21.2
• 2c332bf Also don't compute ResumableParser cursor position for warning
• 5499aa5 Improve max_nesting documentation
• 499d9bc Fix the parser benchmark bytes report
• f5fc245 Pass '-mno-outline' to the compiler (if supported) to prevent function outlin...
• fd61def Release 2.21.1
• db70b14 Rely on Ruby's HAVE_BUILTIN___BUILTIN_CLZLL
• 9be0e8e Release 2.21.0
• d1299d4 Avoid re-decoding an incomplete number on every ResumableParser chunk
• cc010c4 Fix ResumableParser losing tokens before a feed-boundary suspension
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sergiocabral]

Fechando por ora, com uma ressalva: este repositório é mantido como espelho estrutural e de código do progit/progit2 (inglês), com o objetivo de que a única divergência intencional entre os dois seja o conteúdo traduzido — não a árvore de dependências. Diferente dos demais bumps de rotina, este está associado a um alerta de segurança aberto (severidade baixa) na versão atualmente fixada do json. Estamos cientes disso e escolhendo, por ora, manter a paridade de Gemfile com o repositório em inglês (que está na mesma versão) em vez de divergir unilateralmente aqui. Fica registrado para revisão futura, não é um descarte por desatenção.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.