Bump json from 1.8.3 to 2.3.0

[dependabot]

Bumps json from 1.8.3 to 2.3.0.

Release notes

Sourced from json's releases.

v2.3.0

What's Changed

• README: Docs at rubydoc.info, not on rubyforge by @​olleolleolle in flori/json#376
• Remove RubyForge homepage reference by @​olleolleolle in flori/json#378
• Add ascii_only option to JSON::Ext::Generator::State.new. by @​sho-h in flori/json#367
• Gemspec: Drop EOL'd property rubyforge_project by @​olleolleolle in flori/json#381
• Backport ruby core changes by @​hsbt in flori/json#388
• Minor cleanup for ruby 2.7 warnings and failures. by @​zenspider in flori/json#389
• relax test-unit version for old ruby by @​hsbt in flori/json#390
• Bump versions for 2.3.0. by @​headius in flori/json#391

New Contributors

• @​zenspider made their first contribution in flori/json#389

Full Changelog: ruby/json@v2.2.0...v2.3.0

v2.2.0

What's Changed

• Fixed json_create example to use create_additions = true by @​perlun in flori/json#331
• README: Fixed code examples to start in the left-most column by @​perlun in flori/json#330
• Added missing bigdecimal for its test by @​hsbt in flori/json#335
• README: Added note about json/add/exception by @​perlun in flori/json#332
• fix link in travis widget by @​lostapathy in flori/json#340
• [CI] Test against Ruby 2.5 by @​nicolasleger in flori/json#352
• Removed control characters from gemspec. by @​hsbt in flori/json#360
• Fix typos in README.md by @​yui-knk in flori/json#363
• Backport from Ruby core repository by @​hsbt in flori/json#359
• Fix for bigdecimal updates by @​mrkn in flori/json#362
• Fix a typo. by @​sho-h in flori/json#369
• fix JSON::Generator::State#ascii_only? document same as lib/json/pure/generator.rb. by @​sho-h in flori/json#366

New Contributors

• @​lostapathy made their first contribution in flori/json#340
• @​nicolasleger made their first contribution in flori/json#352
• @​yui-knk made their first contribution in flori/json#363

Full Changelog: ruby/json@v2.1.0...v2.2.0

v2.1.0

What's Changed

• README.md typo fix by @​kaworu in flori/json#300
• Correct documentation of OpenStruct.json_create by @​kyanagi in flori/json#301
• No Bignum by @​nobu in flori/json#302
• CHANGES.md: Fixed typo by @​perlun in flori/json#306
• Actually test BigDecimal parsing. by @​xb in flori/json#321
• Back-out change of directory of json-java.gemspec. by @​xb in flori/json#323

New Contributors

• @​kaworu made their first contribution in flori/json#300
• @​kyanagi made their first contribution in flori/json#301

... (truncated)

Changelog

Sourced from json's changelog.

2019-12-11 (2.3.0)

• Fix default of create_additions to always be false for JSON(user_input) and JSON.parse(user_input, nil). Note that JSON.load remains with default true and is meant for internal serialization of trusted data. [CVE-2020-10663]
• Fix passing args all #to_json in json/add/*.
• Fix encoding issues
• Fix issues of keyword vs positional parameter
• Fix JSON::Parser against bigdecimal updates
• Bug fixes to JRuby port

2019-02-21 (2.2.0)

• Adds support for 2.6 BigDecimal and ruby standard library Set datetype.

2017-04-18 (2.1.0)

• Allow passing of decimal_class option to specify a class as which to parse JSON float numbers.

2017-03-23 (2.0.4)

• Raise exception for incomplete unicode surrogates/character escape sequences. This problem was reported by Daniel Gollahon (dgollahon).
• Fix arbitrary heap exposure problem. This problem was reported by Ahmad Sherif (ahmadsherif).

2017-01-12 (2.0.3)

• Set required_ruby_version to 1.9
• Some small fixes

2016-07-26 (2.0.2)

• Specify required_ruby_version for json_pure.
• Fix issue #295 failure when parsing frozen strings.

2016-07-01 (2.0.1)

• Fix problem when requiring json_pure and Parser constant was defined top level.
• Add RB_GC_GUARD to avoid possible GC problem via Pete Johns.
• Store current_nesting on stack by Aaron Patterson.

2015-09-11 (2.0.0)

• Now complies to newest JSON RFC 7159.
• Implements compatibility to ruby 2.4 integer unification.
• Removed support for quirks_mode option.
• Drops support for old rubies whose life has ended, that is rubies < 2.0. Also see https://www.ruby-lang.org/en/news/2014/07/01/eol-for-1-8-7-and-1-9-2/
• There were still some mentions of dual GPL licensing in the source, but JSON has just the Ruby license that itself includes an explicit dual-licensing clause that allows covered software to be distributed under the terms of the Simplified BSD License instead for all ruby versions >= 1.9.3. This is however a GPL compatible license according to the Free Software Foundation. I changed these mentions to be consistent with the Ruby license setting in the gemspec files which were already correct now.

... (truncated)

Commits

• 92cf5c4 v2.3.0
• 579ae85 Add some more recent jruby
• acabfeb Make tests green on jruby
• c194360 Update travis config
• 49317c1 Ignore log files
• d84439f Merge pull request #391 from headius/prep_2.3.0
• 38f68d1 Bump versions for 2.3.0.
• 40524a9 Merge pull request #390 from flori/relax-test-unit
• 87379e6 relax test-unit version for old ruby
• 05de02f Merge branch 'zenspider-zenspider/ruby-2.7'
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.