Bump json to patched version, fixing CVE-2026-54696 (v2.2.1)

Gemfile.lock

@@ -1,8 +1,8 @@
 PATH
   remote: .
   specs:
-    rubytree (2.2.0)
-      json (~> 2.0, > 2.9)
+    rubytree (2.2.1)
+      json (~> 2.0, >= 2.19.9)
 
 GEM
   remote: https://rubygems.org/
@@ -11,7 +11,7 @@ GEM
     date (3.4.1)
     diff-lcs (1.5.1)
     docile (1.4.1)
-    json (2.9.1)
+    json (2.21.1)
     language_server-protocol (3.17.0.3)
     parallel (1.26.3)
     parser (3.3.6.0)

History.md

@@ -1,5 +1,11 @@
 # History of Changes
 
+### 2.2.1 / 2026-07-24
+
+* Bump the `json` runtime dependency to 2.19.9+, fixing a heap buffer
+  overflow when generating to a streamed IO
+  ([CVE-2026-54696](https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687)).
+
 ### 2.2.0 / 2026-02-06
 
 * Prevent cycles by rejecting attempts to add an ancestor as a child.

lib/tree/version.rb

@@ -4,7 +4,7 @@
 #
 # Author:: Anupam Sengupta (anupamsg@gmail.com)
 #
-# Copyright (c) 2012-2024 Anupam Sengupta. All rights reserved.
+# Copyright (c) 2012-2026 Anupam Sengupta. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
@@ -35,5 +35,5 @@
 
 module Tree
   # Rubytree Package Version
-  VERSION = '2.2.0'
+  VERSION = '2.2.1'
 end

rubytree.gemspec

@@ -64,7 +64,7 @@ Gem::Specification.new do |s|
                             '--main', 'README.md',
                             '--quiet']
 
-  s.add_runtime_dependency 'json', '~> 2.0', '> 2.9'
+  s.add_runtime_dependency 'json', '~> 2.0', '>= 2.19.9'
 
   # NOTE: Rake is added as a development and test dependency in the Gemfile.
   s.add_development_dependency 'bundler', '~> 2.3'