You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This release contains a security fix, we recommend all users to upgrade as soon as possible.
A Security Advisory with more details will be posted shortly.
This release contains a security fix, we recommend all users to upgrade as soon as possible.
A Security Advisory with more details will be posted shortly.
Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer
result in SystemStackError stack level too deep errors.
The :max_nesting option still defaults to 100.
Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
Fix a compilation issue on Window and Microsoft Visual C++.
2026-07-12 (2.21.0)
JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
Added #empty? and #partial_value? methods on JSON::ResumableParser.
Numerous correctness and performance fixes for JSON::ResumableParser.
Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.
2026-06-23 (2.20.0)
Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer
result in SystemStackError stack level too deep errors.
The :max_nesting option still defaults to 100.
Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
Integrate with Ruby 4.1 ruby_sized_xfree.
2026-06-11 (2.19.9)
Fix buffer overflow that could lead to a crash when writing JSON directly into an IO
with JSON.generate(object, io). [CVE-2026-54696].
2026-06-03 (2.19.8)
Fix 1-byte buffer overread on EOS errors.
Handle invalid types passed as max_nesting option.
2026-05-28 (2.19.7)
Fix some more edge cases with out of range floats.
Ensure the string provided to JSON.parse can't be mutated during parsing.
Add missing write barriers in State#dup.
Further validate generator depth config.
2026-05-28 (2.19.6)
Cleanly handle overly large depth generator argument.
Add missing write barrier in ParserConfig.
2026-05-04 (2.19.5)
Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking comment: required integration status check failed (missing PROXY_URL secret), so this Dependabot lockfile bump is not approved. Assigned reviewers proxymesh and proxymeshai for human attention.
Sent by Cursor Approval Agent: oss dependabot approver
Resolve Gemfile.lock conflict by keeping Dependabot faraday 2.14.3 over main's 2.14.2.
Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
Resolve Gemfile.lock conflict by keeping Dependabot yard 0.9.44 over main's 0.9.43.
Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Approved: Dependabot lockfile-only bundler group bump with required integration check green and squash auto-merge already enabled. No new reviewers assigned (proxymesh and proxymeshai were already requested).
Sent by Cursor Approval Agent: oss dependabot approver
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filerubyPull requests that update ruby code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps the bundler group with 3 updates in the / directory: yard, excon and faraday.
Updates
yardfrom 0.9.38 to 0.9.44Release notes
Sourced from yard's releases.
Changelog
Sourced from yard's changelog.
... (truncated)
Commits
6f678d0Release: v0.9.443755c12Update changelogf78c19fFix possible path traversal in StaticCachingd29a77crubocop-yard: Add support for multiple & nested Hash keys definition (#1630)d5b67c5rubocop-yard: Add support for string literals in TypesExplainer (#1628)8ca7b6aUpdate copyright year in LICENSE filec2c3e75Fix license text formatting in README.mdbb515aeSupport all valid HTML entities in HybridMarkdown (#1681)1a3b19fBump actions/setup-node from 4 to 6 (#1678)b9416d6Release: v0.9.43Updates
exconfrom 1.4.2 to 1.5.0Changelog
Sourced from excon's changelog.
... (truncated)
Commits
f59b27ev1.5.0ea89a35expand redirect header redaction (#901)74e1754Raise Excon::Error::InvalidParameter when host is nil instead of crashing wit...4e784d5update bundled certsUpdates
faradayfrom 2.14.1 to 2.14.3Release notes
Sourced from faraday's releases.
Commits
f1ace87Version bump to 2.14.336764bfMerge commit from fork59334e0feat(test): add Stubs#clear to remove all stubs (#1675)469f25cUpgrade CI lint step from Ruby 3 to 4 (#1673)2ecd5e0Update version.rb3f1280cMerge commit from fork81dc168Upgrade package.json packages using audit fix (#1669)8b4d1fdCreate SECURITY.mda01039cfix(docs): fix incorrect link label in request-options and remove dead link i...7df3f24Lint: Style/OneClassPerFile (#1668)Updates
jsonfrom 2.19.3 to 2.21.1Release notes
Sourced from json's releases.
... (truncated)
Changelog
Sourced from json's changelog.
... (truncated)
Commits
fd61defRelease 2.21.1db70b14Rely on Ruby's HAVE_BUILTIN___BUILTIN_CLZLL9be0e8eRelease 2.21.0d1299d4Avoid re-decoding an incomplete number on every ResumableParser chunkcc010c4Fix ResumableParser losing tokens before a feed-boundary suspension0864e83Add JSON::ResumableParser#partial_value? and #empty?9dbfeb8Fix ResumableParser treating unterminated line comments as completeea008e8Add asort_keysoption to the generator.94c1af2Fix ResumableParser#partial_value SEGV on incomplete nested containersfaa5572Fix a few inconsistencies in readmeDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.