chore(deps): update json requirement from >= 2.6.3, < 2.21.0 to >= 2.6.3, < 2.22.0

[dependabot]

Updates the requirements on json to permit the latest version.

Release notes

Sourced from json's releases.

v2.21.0

What's Changed

• JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
• Added #empty? and #partial_value? methods on JSON::ResumableParser.
• Numerous correctness and performance fixes for JSON::ResumableParser.
• Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
• Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.

Full Changelog: ruby/json@v2.20.0...v2.21.0

Changelog

Sourced from json's changelog.

2026-07-12 (2.21.0)

• JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
• Added #empty? and #partial_value? methods on JSON::ResumableParser.
• Numerous correctness and performance fixes for JSON::ResumableParser.
• Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
• Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.

2026-06-23 (2.20.0)

• Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
  • The :max_nesting option still defaults to 100.
• Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
• Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
• Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
• Integrate with Ruby 4.1 ruby_sized_xfree.

2026-06-11 (2.19.9)

• Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

2026-06-03 (2.19.8)

• Fix 1-byte buffer overread on EOS errors.
• Handle invalid types passed as max_nesting option.

2026-05-28 (2.19.7)

• Fix some more edge cases with out of range floats.
• Ensure the string provided to JSON.parse can't be mutated during parsing.
• Add missing write barriers in State#dup.
• Further validate generator depth config.

2026-05-28 (2.19.6)

• Cleanly handle overly large depth generator argument.
• Add missing write barrier in ParserConfig.

2026-05-04 (2.19.5)

• Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.

2026-04-19 (2.19.4)

• Fix parsing of out of range floats (very large exponents that lead to either 0.0 or Inf).

2026-03-25 (2.19.3)

... (truncated)

Commits

• 9be0e8e Release 2.21.0
• d1299d4 Avoid re-decoding an incomplete number on every ResumableParser chunk
• cc010c4 Fix ResumableParser losing tokens before a feed-boundary suspension
• 0864e83 Add JSON::ResumableParser#partial_value? and #empty?
• 9dbfeb8 Fix ResumableParser treating unterminated line comments as complete
• ea008e8 Add a sort_keys option to the generator.
• 94c1af2 Fix ResumableParser#partial_value SEGV on incomplete nested containers
• faa5572 Fix a few inconsistencies in readme
• 724edda Avoid Float out of range warning for clearly underflowing numbers
• 168095c Fix unused-but-set-global warnings in clang-23
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud