evolve75 / RubyTree / 30135635142

89%

master: 96%

push

github

Bump json to patched version, fixing CVE-2026-54696

json 2.9.0 through 2.19.8 has a heap buffer overflow when the
generator streams an object containing a large string to an IO
(GHSA-x2f5-4prf-w687). Raise the gemspec's minimum json constraint
to the patched 2.19.9 (keeping the existing `~> 2.19` upper bound),
update Gemfile.lock accordingly (resolves to 2.21.1), and record the
fix in CHANGELOG.md.

No version bump or release tag on this branch -- the version bump
and R2.2.1 release tag were already applied on master.

947 of 1344 branches covered (70.46%)

2270 of 2564 relevant lines covered (88.53%)

14493.62 hits per line