fix(deps): allow json 3

.github/workflows/ci.yml

@@ -53,6 +53,30 @@ jobs:
           flags: unittests
           fail_ci_if_error: false
 
+  test-json3:
+    name: Test JSON 3 (Ruby ${{ matrix.ruby }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.2', '3.3', '3.4']
+    env:
+      BUNDLE_GEMFILE: gemfiles/test.gemfile
+      JSON_VERSION: '~> 3.0'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Run tests
+        run: bundle exec rspec
+
   lint:
     name: Lint (Rubocop)
     runs-on: ubuntu-latest
@@ -72,13 +96,13 @@ jobs:
 
   ci-success:
     name: CI Success
-    needs: [test, lint]
+    needs: [test, test-json3, lint]
     runs-on: ubuntu-latest
     if: always()
     steps:
       - name: Check all jobs
         run: |
-          if [ "${{ needs.test.result }}" != "success" ] || [ "${{ needs.lint.result }}" != "success" ]; then
+          if [ "${{ needs.test.result }}" != "success" ] || [ "${{ needs.test-json3.result }}" != "success" ] || [ "${{ needs.lint.result }}" != "success" ]; then
             echo "One or more CI jobs failed"
             exit 1
           fi

.gitignore

@@ -7,6 +7,7 @@ coverage/
 # Bundler
 .bundle/
 vendor/bundle/
+gemfiles/*.lock
 
 # Gem build artifacts
 *.gem

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Allow JSON 3.x and require Faraday 2.14.4 or newer for compatible response parsing (#123).
+
 ## [0.12.2] - 2026-09-04
 
 ### Fixed

Gemfile

@@ -1,17 +1,9 @@
 # frozen_string_literal: true
 
-source "https://rubygems.org"
-
-# Specify your gem's dependencies in langfuse.gemspec
-gemspec
+eval_gemfile "gemfiles/test.gemfile"
 
 # Development dependencies
 group :development, :test do
-  gem "dotenv", "~> 2.8"
-  gem "rake", "~> 13.0"
-  gem "rspec", "~> 3.12"
   gem "rubocop", "~> 1.50"
   gem "rubocop-rspec", "~> 2.20"
-  gem "simplecov", "~> 0.22"
-  gem "webmock", "~> 3.18"
 end

Gemfile.lock

@@ -4,9 +4,9 @@ PATH
     langfuse-rb (0.12.2)
       base64 (~> 0.2)
       concurrent-ruby (>= 1.3.7, < 2.0)
-      faraday (>= 2.14.3, < 3)
+      faraday (>= 2.14.4, < 3)
       faraday-retry (>= 1.0, < 3.0)
-      json (~> 2.19, >= 2.19.9)
+      json (>= 2.19.9, < 4)
       mustache (~> 1.1)
       opentelemetry-api (~> 1.2)
       opentelemetry-common (~> 0.21)
@@ -28,15 +28,18 @@ GEM
     diff-lcs (1.6.2)
     docile (1.4.1)
     dotenv (2.8.1)
-    faraday (2.14.3)
+    faraday (2.14.4)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
     faraday-net_http (3.4.1)
       net-http (>= 0.5.0)
     faraday-retry (2.4.0)
       faraday (~> 2.0)
-    google-protobuf (4.33.4)
+    google-protobuf (4.33.4-arm64-darwin)
+      bigdecimal
+      rake (>= 13)
+    google-protobuf (4.33.4-x86_64-linux-gnu)
       bigdecimal
       rake (>= 13)
     googleapis-common-protos-types (1.22.0)
@@ -129,7 +132,7 @@ GEM
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
     unicode-emoji (4.2.0)
-    uri (1.0.4)
+    uri (1.1.1)
     webmock (3.25.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)

gemfiles/test.gemfile

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in langfuse.gemspec
+gemspec path: ".."
+
+# Test JSON compatibility independently of development tools' dependency constraints.
+gem "json", ENV["JSON_VERSION"] if ENV["JSON_VERSION"]
+
+group :development, :test do
+  gem "dotenv", "~> 2.8"
+  gem "rake", "~> 13.0"
+  gem "rspec", "~> 3.12"
+  gem "simplecov", "~> 0.22"
+  gem "webmock", "~> 3.18"
+end

langfuse.gemspec

@@ -29,15 +29,15 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   # Runtime dependencies - HTTP & Templating
-  # faraday floor raised to 2.14.3 to exclude CVE-2026-33637 and CVE-2026-54297.
+  # Faraday 2.14.4 adds JSON 3 compatibility and includes the fixes for CVE-2026-33637 and CVE-2026-54297.
   # This drops Faraday 1.x support; Faraday 2.x needs Ruby >= 3.0, satisfied by our >= 3.2.0 floor.
-  spec.add_dependency "faraday", ">= 2.14.3", "< 3"
+  spec.add_dependency "faraday", ">= 2.14.4", "< 3"
   spec.add_dependency "faraday-retry", ">= 1.0", "< 3.0"
   spec.add_dependency "mustache", "~> 1.1"
   # json is used directly at runtime (api_client, read_api, score_client) and was only
   # constrained transitively via faraday. Declared explicitly with a >= 2.19.9 floor so
   # consumers cannot resolve json affected by CVE-2026-54696.
-  spec.add_dependency "json", "~> 2.19", ">= 2.19.9"
+  spec.add_dependency "json", ">= 2.19.9", "< 4"
 
   # Runtime dependencies - Concurrency (for SWR caching)
   # concurrent-ruby floor raised to 1.3.7 to exclude CVE-2026-54904/54905/54906.