From 0357b6473af7f2253453b1808dc3a0d8d14ec5c5 Mon Sep 17 00:00:00 2001
From: Anupam Sengupta <anupamsg@gmail.com>
Date: Fri, 24 Jul 2026 19:57:31 -0400
Subject: [PATCH 1/2] Bump json to patched version, fixing CVE-2026-54696

json 2.9.0 through 2.19.8 has a heap buffer overflow when the
generator streams an object containing a large string to an IO
(GHSA-x2f5-4prf-w687). Raise the gemspec's minimum json constraint
to the patched 2.19.9 and update Gemfile.lock accordingly (resolves
to 2.21.1). The existing `~> 2.0` upper bound already permitted this
version, so no constraint widening was needed.
---
 Gemfile.lock     | 4 ++--
 rubytree.gemspec | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 63a5334..9e73976 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -2,7 +2,7 @@ PATH
   remote: .
   specs:
     rubytree (2.2.0)
-      json (~> 2.0, > 2.9)
+      json (~> 2.0, >= 2.19.9)
 
 GEM
   remote: https://rubygems.org/
@@ -11,7 +11,7 @@ GEM
     date (3.4.1)
     diff-lcs (1.5.1)
     docile (1.4.1)
-    json (2.9.1)
+    json (2.21.1)
     language_server-protocol (3.17.0.3)
     parallel (1.26.3)
     parser (3.3.6.0)
diff --git a/rubytree.gemspec b/rubytree.gemspec
index 9351423..b0cf4d2 100644
--- a/rubytree.gemspec
+++ b/rubytree.gemspec
@@ -64,7 +64,7 @@ Gem::Specification.new do |s|
                             '--main', 'README.md',
                             '--quiet']
 
-  s.add_runtime_dependency 'json', '~> 2.0', '> 2.9'
+  s.add_runtime_dependency 'json', '~> 2.0', '>= 2.19.9'
 
   # NOTE: Rake is added as a development and test dependency in the Gemfile.
   s.add_development_dependency 'bundler', '~> 2.3'

From 6bf3aede9514a1f2f0ddc47375ea090abcb74025 Mon Sep 17 00:00:00 2001
From: Anupam Sengupta <anupamsg@gmail.com>
Date: Fri, 24 Jul 2026 20:00:14 -0400
Subject: [PATCH 2/2] Bump version to 2.2.1 for the json CVE patch release

Prepares the 2.2.1 patch release: bumps Tree::VERSION, updates the
self-referential Gemfile.lock entry, adds the History.md release
note for the json CVE-2026-54696 fix, and refreshes the copyright
year range.
---
 Gemfile.lock        | 2 +-
 History.md          | 6 ++++++
 lib/tree/version.rb | 4 ++--
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 9e73976..0925235 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rubytree (2.2.0)
+    rubytree (2.2.1)
       json (~> 2.0, >= 2.19.9)
 
 GEM
diff --git a/History.md b/History.md
index 1d571ac..17670c2 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,11 @@
 # History of Changes
 
+### 2.2.1 / 2026-07-24
+
+* Bump the `json` runtime dependency to 2.19.9+, fixing a heap buffer
+  overflow when generating to a streamed IO
+  ([CVE-2026-54696](https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687)).
+
 ### 2.2.0 / 2026-02-06
 
 * Prevent cycles by rejecting attempts to add an ancestor as a child.
diff --git a/lib/tree/version.rb b/lib/tree/version.rb
index dd7e64e..42789b0 100644
--- a/lib/tree/version.rb
+++ b/lib/tree/version.rb
@@ -4,7 +4,7 @@
 #
 # Author:: Anupam Sengupta (anupamsg@gmail.com)
 #
-# Copyright (c) 2012-2024 Anupam Sengupta. All rights reserved.
+# Copyright (c) 2012-2026 Anupam Sengupta. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
@@ -35,5 +35,5 @@
 
 module Tree
   # Rubytree Package Version
-  VERSION = '2.2.0'
+  VERSION = '2.2.1'
 end