build(deps): bump json from 2.21.2 to 3.0.2 in /hub

[dependabot]

Bumps json from 2.21.2 to 3.0.2.

Release notes

Sourced from json's releases.

v3.0.0

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.
• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.
• Removed JSON.load_default_options.
• Removed JSON.unsafe_load_default_options.
• Removed JSON.dump_default_options.
• Removed JSON::State#[] and JSON::State#[]=.
• Removed JSON.unparse.
• Removed JSON.fast_generate.
• Removed JSON.fast_unparse.
• Removed JSON.pretty_unparse.
• Removed JSON.restore.
• Removed JSON::PRETTY_STATE_PROTOTYPE.
• Removed the insecure create_additions option.
• Removed JSON::GenericObject.

Full Changelog: ruby/json@v2.21.2...v3.0.0

v3.0.0.rc1

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

... (truncated)

Changelog

Sourced from json's changelog.

2026-09-09 (3.0.2)

• Fix JSON.load_file and JSON.load_file! to load on Ruby 2.7.0 through 2.7.2, which cannot parse a leading parameter before ....

2026-09-08 (3.0.1)

• Restore the limit positional argument of JSON.dump.

2026-09-07 (3.0.0)

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.

2026-08-11 (3.0.0.rc1)

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.
• Removed JSON.load_default_options.
• Removed JSON.unsafe_load_default_options.
• Removed JSON.dump_default_options.
• Removed JSON::State#[] and JSON::State#[]=.
• Removed JSON.unparse.
• Removed JSON.fast_generate.
• Removed JSON.fast_unparse.
• Removed JSON.pretty_unparse.
• Removed JSON.restore.

... (truncated)

Commits

• 7b2a23d Release 3.0.2
• effca27 Fix the JSON::Coder.new call-seq
• 8bdd517 Update documentation to match json 3.0 API
• 29dad14 Fix JSON.load_file and JSON.load_file! to load on Ruby 2.7.0 through 2.7.2
• 73edd53 Centralize requires in the test suite
• c557a62 Release 3.0.1
• 566bd7c Restore the limit positional argument of JSON.dump
• 9427d36 Release 3.0.0
• 82bf6be Fix parser silently accepting a lone trailing surrogate in string values
• 1d37403 Stop installing ragel on CI
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like json is up-to-date now, so this is no longer needed.