R2.2.1

• Bump version to 2.2.1 for the json CVE patch release

  Prepares the 2.2.1 patch release: bumps Tree::VERSION, updates the
  self-referential Gemfile.lock entry, adds the History.md release
  note for the json CVE-2026-54696 fix, and refreshes the copyright
  year range.

• Bump json to patched version, fixing CVE-2026-54696

  json 2.9.0 through 2.19.8 has a heap buffer overflow when the
  generator streams an object containing a large string to an IO
  (GHSA-x2f5-4prf-w687). Raise the gemspec's minimum json constraint
  to the patched 2.19.9 and update Gemfile.lock accordingly (resolves
  to 2.21.1). The existing ~> 2.0 upper bound already permitted this
  version, so no constraint widening was needed.

• Guard release workflow against tags pushed off master

  Tag-push triggers in GitHub Actions can't be filtered by branch
  directly, so a release tag pushed from any branch would still fire
  the publish workflow. Add a step that verifies the tagged commit is
  reachable from origin/master and fails before the build/publish
  steps run if it isn't, so an accidental tag elsewhere can't trigger
  a release.

• Add RubyGems trusted publishing release workflow

  RubyGems.org expired all legacy API keys after a CDN caching bug
  (GHSA-9j48-x3c3-mrp2) could replay one account's key to another
  request for up to an hour. Rather than storing a fresh long-lived
  API key on a maintainer's machine, add a tag-triggered GitHub
  Actions workflow that publishes to RubyGems.org via OIDC trusted
  publishing, so no RubyGems credential needs to be held anywhere.

The existing rake gem:push task (which also pushes to GitHub
Packages) remains available as a manual fallback.

Requires a Trusted Publisher to be configured for the rubytree
gem at rubygems.org, pointing at this repository and workflow file.

• Backport Gemfile.lock yard constraint fix to master

  The gemspec was updated to require yard >= 0.9.44 (dd9c1d3) but the
  Gemfile.lock DEPENDENCIES section was not regenerated, leaving the stale

= 0.9.42 constraint. Bundler in deployment mode (used by CI) compares
the live gemspec constraint against DEPENDENCIES and fails with exit code
16 when they diverge. Align the lock file to >= 0.9.44.

• Raise yard minimum version to 0.9.44

  Bump the yard development dependency floor from >= 0.9.42 to >= 0.9.44
  to address the medium-severity Dependabot alert (GHSA: YARD static cache
  reads raw traversal paths before router sanitization). Yard 0.9.44 is
  the first patched release; tightening the constraint ensures the
  vulnerable range is no longer satisfiable.

• Bump yard from 0.9.42 to 0.9.44 in the bundler group across 1 directory

  Bumps the bundler group with 1 update in the / directory: yard.

Updates yard from 0.9.42 to 0.9.44

---

updated-dependencies:

• dependency-name: yard
  dependency-version: 0.9.44
  dependency-type: direct:development
  dependency-group: bundler
  ...

Signed-off-by: dependabot[bot] support@github.com

• Restrict GitHub Actions token permissions

  Add explicit workflow-level contents: read permissions to the
  legacy test and coveralls workflows so code scanning no longer
  flags the default GITHUB_TOKEN scope as unspecified.

• Raise yard minimum version to 0.9.42

  Tighten the gemspec and lockfile dependency floor so the manifest no longer permits vulnerable YARD releases while keeping master on the already-locked 0.9.42 version.

• Bump yard from 0.9.37 to 0.9.42 in the bundler group across 1 directory (#127)

  Bumps the bundler group with 1 update in the / directory: yard.

Updates yard from 0.9.37 to 0.9.42

---

updated-dependencies:

• dependency-name: yard
  dependency-version: 0.9.42
  dependency-type: direct:development
  dependency-group: bundler
  ...

Signed-off-by: dependabot[bot] support@github.com
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Release R2.2.0 (#114)

  • Preparing for 2.1.2.

• Updated the version to 2.1.2pre

• Linked the Github repository in the metadata (for Github packages)

• Updated the Rakefile to publish packages to the Github registry.

Registry: https://github.com/evolve75/RubyTree/pkgs/rubygems/rubytree

• Prevent adding ancestor as child

• Detach children on remove_all!

Ensure children become true roots after remove_all! by clearing their parent
links. This matches the method's contract and prevents stale parent
references from corrupting later traversal or metrics.

• Guard rename_child collisions

Raise when renaming a child to an existing sibling name to prevent overwriting
entries in the children hash. This avoids orphaning nodes and keeps child
lookup consistent.

• Harden binary child assignment

Fix set_child_at index errors and clean up parent/hash references
when replacing or clearing children. This preserves swap semantics and
avoids stale lookups.

• Handle nils in traversal

Skip nil children during postorder and breadth-first traversals so binary
nodes with missing children do not break traversal. Add a regression test
covering nil child traversal paths.

• Fix each_level enumerator

Return a level-wise enumerator when no block is given and add a test to
assert the yielded level arrays match the tree structure.

• Fix to_s empty content

Render '' when a node has nil content and add tests for both
nil and non-nil content values.

• Document 2.2.0 API changes

Add a new 2.2.0 section covering recent behavior changes in tree
operations and traversal, plus link references for the new entries.

• Release 2.2.0

Bump the gem version to 2.2.0 and record the 2.2.0 changes in the
project history.