-
Bump json to patched version, fixing CVE-2026-71847
json 2.21.1 and earlier ship a use-after-free in
JSON::ResumableParser#partial_value that can crash on truncated
duplicate-key streams (GHSA-9hj4-r449-hfvc). Bump the runtime
dependency floor to 2.21.2, which includes the fix. -
Bump actions/checkout to v7 to resolve Node.js 20 deprecation
GitHub Actions runners now force actions/checkout@v2 and @v4 to run
on Node.js 24 despite targeting Node.js 20, emitting a deprecation
warning on every run. actions/checkout@v5 switched to Node 24
natively; bump straight to the latest v7.0.1 (no breaking changes
apply to our plain-checkout usage) across ruby.yml, coveralls.yml,
and release.yml.
