[dependabot]

Updates the requirements on json to permit the latest version.

Changelog

Sourced from json's changelog.

2026-10-13 (3.1.0)

• Added rfc8785 generator option to canonicalize the output. Replaces the json-canonicalization with numerous correctness fixes.
• Use the rb_len_t type introduced in Ruby 4.1 to allow for proper 64bit support on LP64 platforms (Windows).
• JRuby: parser errors now include the position (line, column and the message suffix) as well as json_path, matching the C extension.
• Improved the accuracy of parser error's line, column and snipets in presence of multibyte characters.
• Fix JSON.load to work correctly when provided a Zlib::GzipReader as IO source.
• Reject non-ASCII BINARY strings during JSON generation. This was deprecated since a long time and scheduled to be removed for 3.0.

2026-09-09 (3.0.2)

• Fix JSON.load_file and JSON.load_file! to load on Ruby 2.7.0 through 2.7.2, which cannot parse a leading parameter before ....

2026-09-08 (3.0.1)

• Restore the limit positional argument of JSON.dump.

2026-09-07 (3.0.0)

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.

2026-08-11 (3.0.0.rc1)

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.

... (truncated)

Commits

• a15b2ba Release 3.1.0
• d09e383 Refactor rfc8785_sort_keys_proc
• e19f7d7 Handle invalid encoding in JSON path keys
• 78d6a83 parser.c: only update the stack once fully spilled
• 6ea6201 Fix parsing of number with out of range negative exponents
• 1b67eb3 Fix parsing of unescaped NULL bytes in strings
• c1a4372 ResumableParser: fix handling of incomplete unicode escape
• 429c109 More hardening against adversarial encode methods
• 8df32ab Index the generated JSON array by rb_len_t
• 21193d0 Match rb_hash_bulk_insert fallback to Ruby's declaration
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

🟢 Approval recommended

No blocking compatibility issues were identified for this narrow dependency change; runtime tests were not run.

No open issues 🎉

What changed in this PR

Expands the JSON dependency range for Kiota Ruby’s JSON serialization component.

Changes:

• Permits JSON 3.1.x by raising the upper bound to < 3.2.0, retaining the minimum version of 2.6.3.

File	Description
components/​serialization/​json/​microsoft_kiota_serialization_json.gemspec	Widens the allowed JSON dependency range.

_{Review effort: Balanced}