fix(deps): allow json 3

[woodhull]

TL;DR

Allow consumers to use JSON 3 while preserving the JSON security minimum. Require Faraday 2.14.4 or newer so API response parsing works with JSON 3.

Why

#115 declared json explicitly to set a floor that excludes CVE-2026-54696. The pessimistic ~> 2.19 operator also caps it below 3.0. Apps already on json 3 get downgraded to 2.x when they upgrade to langfuse-rb 0.12.x.

Faraday 2.14.3 passes parser options as a positional hash, which JSON 3 rejects. Faraday 2.14.4 fixes that call. The SDK also uses to_json; JSON 3 retains its stricter duplicate-key and parsing behavior.

CI now runs the full suite with JSON 3 on Ruby 3.2, 3.3, and 3.4. Shared test dependencies let those jobs resolve independently of RuboCop's JSON 2 constraint.

Testing

The full suite passed locally on Ruby 3.2 with JSON 2.21.2 and JSON 3.0.2: 1,663 examples, zero failures, and 97.01% line coverage for each. RuboCop passed for all 112 files.

A live JSON 3 check fetched a prompt through the SDK and matched it against the Langfuse CLI. A synthetic trace and score were written successfully and independently verified through the CLI.

The regression was reproduced before the fix: JSON 3.0.2 with Faraday 2.14.3 failed 209 examples. Hosted checks must pass on the updated head before merging.

Checklist

• CHANGELOG updated under Unreleased
• Tests pass

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency constraint and CI-only changes; SDK JSON usage is limited to JSON.parse/JSON.generate, with explicit json 3 test coverage added.

Overview
Relaxes runtime dependency constraints so apps on json 3.x are no longer forced back to 2.x when depending on langfuse-rb. The gemspec changes json from ~> 2.19 to >= 2.19.9, < 4 (CVE floor kept) and bumps the minimum Faraday to >= 2.14.4 for JSON 3–compatible response parsing.

CI and dev setup add a dedicated gemfiles/test.gemfile (optional JSON_VERSION pin) and a test-json3 matrix job that runs the full RSpec suite with json ~> 3.0 on Ruby 3.2–3.4; ci-success now gates on that job. The root Gemfile delegates test deps via eval_gemfile, and gemfiles/*.lock is gitignored.

^{Reviewed by Cursor Bugbot for commit b1fc306. Bugbot is set up for automated code reviews on this repo. Configure here.}