Skip to content

chore(deps): bump json from 2.17.1.2 to 2.19.9 in /performance-tests#6512

Merged
antonis merged 1 commit into
mainfrom
dependabot/bundler/performance-tests/json-2.19.9
Jul 24, 2026
Merged

chore(deps): bump json from 2.17.1.2 to 2.19.9 in /performance-tests#6512
antonis merged 1 commit into
mainfrom
dependabot/bundler/performance-tests/json-2.19.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown
Contributor

Bumps json from 2.17.1.2 to 2.19.9.

Release notes

Sourced from json's releases.

v2.19.9

  • Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

Full Changelog: ruby/json@v2.19.8...v2.19.9

v2.19.8

What's Changed

  • Fix 1-byte buffer overread on EOS errors.
  • Handle invalid types passed as max_nesting option.

Full Changelog: ruby/json@v2.19.7...v2.19.8

v2.19.7

What's Changed

  • Fix some more edge cases with out of range floats.
  • Ensure the string provided to JSON.parse can't be mutated during parsing.
  • Add missing write barriers in State#dup.
  • Further validate generator depth config.

Full Changelog: ruby/json@v2.19.6...v2.19.7

v2.19.6

What's Changed

  • Cleanly handle overly large depth generator argument.
  • Add missing write barrier in ParserConfig.

Full Changelog: ruby/json@v2.19.5...v2.19.6

v2.19.5

What's Changed

  • Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.

Full Changelog: ruby/json@v2.19.4...v2.19.5

v2.19.4

What's Changed

  • Fix parsing of out of range floats (very large exponents that lead to either 0.0 or Inf).

Full Changelog: ruby/json@v2.19.2...v2.19.4

v2.19.3

  • Fix handling of unescaped control characters preceeded by a backslash.

Full Changelog: ruby/json@v2.19.2...v2.19.3

... (truncated)

Changelog

Sourced from json's changelog.

2026-06-11 (2.19.9)

  • Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

2026-06-03 (2.19.8)

  • Fix 1-byte buffer overread on EOS errors.
  • Handle invalid types passed as max_nesting option.

2026-05-28 (2.19.7)

  • Fix some more edge cases with out of range floats.
  • Ensure the string provided to JSON.parse can't be mutated during parsing.
  • Add missing write barriers in State#dup.
  • Further validate generator depth config.

2026-05-28 (2.19.6)

  • Cleanly handle overly large depth generator argument.
  • Add missing write barrier in ParserConfig.

2026-05-04 (2.19.5)

  • Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.

2026-04-19 (2.19.4)

  • Fix parsing of out of range floats (very large exponents that lead to either 0.0 or Inf).

2026-03-25 (2.19.3)

  • Fix handling of unescaped control characters preceeded by a backslash.

2026-03-18 (2.19.2)

  • Fix a format string injection vulnerability in JSON.parse(doc, allow_duplicate_key: false). CVE-2026-33210.

2026-03-08 (2.19.1)

  • Fix a compiler dependent GC bug introduced in 2.18.0.

2026-03-06 (2.19.0)

  • Fix allow_blank parsing option to no longer allow invalid types (e.g. load([], allow_blank: true) now raise a type error).
  • Add allow_invalid_escape parsing option to ignore backslashes that aren't followed by one of the valid escape characters.

2026-02-03 (2.18.1)

  • Fix a potential crash in very specific circumstance if GC triggers during a call to to_json

... (truncated)

Commits
  • 2cff267 Release 2.19.9
  • fd6a65b generator.c: don't start with a stack buffer in IO case
  • 5233dd9 Release 2.19.8
  • 3f44b26 Prevent buffer over-read when generating EOF error
  • be8d068 Handle invalid types passed as max_nesting option
  • 59501c0 Get rid of all_images gem
  • c7a7b2b Add a security note in README
  • ab6c8f2 Release 2.19.7
  • f033b9d Fix some more edge cases with out of range floats
  • 5ca8a67 parser.c: Ensure the user provided string can't be mutated
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [json](https://github.com/ruby/json) from 2.17.1.2 to 2.19.9.
- [Release notes](https://github.com/ruby/json/releases)
- [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md)
- [Commits](ruby/json@v2.17.1.2...v2.19.9)

---
updated-dependencies:
- dependency-name: json
  dependency-version: 2.19.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Jul 24, 2026
@dependabot
dependabot Bot requested a review from alwx as a code owner July 24, 2026 05:51
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 24, 2026
@dependabot dependabot Bot added the ruby Pull requests that update ruby code label Jul 24, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


  • chore(deps): bump json from 2.17.1.2 to 2.19.9 in /performance-tests by dependabot[bot] in #6512
  • chore(deps): update CLI to v3.6.2 by github-actions in #6511
  • chore(deps): update Sentry Android Gradle Plugin to v6.16.0 by github-actions in #6508
  • chore(deps): update Android SDK to v8.50.1 by github-actions in #6503

🤖 This preview updates automatically when you update the PR.

@antonis antonis added the ready-to-merge Triggers the full CI test suite label Jul 24, 2026
@github-actions

Copy link
Copy Markdown
Contributor

iOS (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3850.59 ms 1220.04 ms -2630.54 ms
Size 4.98 MiB 6.55 MiB 1.57 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
853723c+dirty 3852.60 ms 1234.64 ms -2617.96 ms
c151573+dirty 3841.06 ms 1232.13 ms -2608.93 ms
d7d54c6+dirty 3827.13 ms 1217.18 ms -2609.95 ms
68ae91b+dirty 3834.04 ms 1216.60 ms -2617.44 ms
f170ec3+dirty 3822.26 ms 1218.33 ms -2603.93 ms
f9c1ed4+dirty 3833.98 ms 1226.30 ms -2607.68 ms
267d3ed+dirty 3853.65 ms 1224.70 ms -2628.94 ms
3d536d1+dirty 3840.00 ms 1220.13 ms -2619.87 ms
a216cb9+dirty 3839.33 ms 1225.26 ms -2614.07 ms
c004dae+dirty 3850.32 ms 1227.79 ms -2622.53 ms

App size

Revision Plain With Sentry Diff
853723c+dirty 5.15 MiB 6.69 MiB 1.53 MiB
c151573+dirty 5.15 MiB 6.68 MiB 1.53 MiB
d7d54c6+dirty 4.98 MiB 6.51 MiB 1.53 MiB
68ae91b+dirty 4.98 MiB 6.46 MiB 1.48 MiB
f170ec3+dirty 5.15 MiB 6.69 MiB 1.53 MiB
f9c1ed4+dirty 4.98 MiB 6.50 MiB 1.53 MiB
267d3ed+dirty 5.15 MiB 6.69 MiB 1.54 MiB
3d536d1+dirty 4.98 MiB 6.53 MiB 1.55 MiB
a216cb9+dirty 4.98 MiB 6.51 MiB 1.53 MiB
c004dae+dirty 5.15 MiB 6.67 MiB 1.51 MiB

@github-actions

Copy link
Copy Markdown
Contributor

iOS (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3826.48 ms 1207.40 ms -2619.07 ms
Size 4.98 MiB 6.55 MiB 1.57 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
7ff4d0f+dirty 3859.87 ms 1224.75 ms -2635.12 ms
d7d54c6+dirty 3842.44 ms 1204.87 ms -2637.57 ms
7ac3378+dirty 1202.35 ms 1198.31 ms -4.04 ms
ecf47a2+dirty 3844.68 ms 1223.98 ms -2620.70 ms
f9c1ed4+dirty 3842.09 ms 1220.70 ms -2621.40 ms
3d536d1+dirty 3846.55 ms 1225.73 ms -2620.82 ms
a0d8cf8+dirty 3826.15 ms 1213.12 ms -2613.03 ms
5748023+dirty 3844.74 ms 1225.49 ms -2619.26 ms
a216cb9+dirty 3853.25 ms 1224.77 ms -2628.48 ms
c004dae+dirty 3857.82 ms 1224.87 ms -2632.95 ms

App size

Revision Plain With Sentry Diff
7ff4d0f+dirty 5.15 MiB 6.70 MiB 1.55 MiB
d7d54c6+dirty 4.98 MiB 6.51 MiB 1.53 MiB
7ac3378+dirty 3.38 MiB 4.76 MiB 1.38 MiB
ecf47a2+dirty 4.98 MiB 6.46 MiB 1.49 MiB
f9c1ed4+dirty 4.98 MiB 6.50 MiB 1.53 MiB
3d536d1+dirty 4.98 MiB 6.53 MiB 1.55 MiB
a0d8cf8+dirty 5.15 MiB 6.67 MiB 1.51 MiB
5748023+dirty 5.15 MiB 6.68 MiB 1.53 MiB
a216cb9+dirty 4.98 MiB 6.51 MiB 1.53 MiB
c004dae+dirty 5.15 MiB 6.67 MiB 1.51 MiB

@github-actions

Copy link
Copy Markdown
Contributor

Android (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 431.19 ms 501.80 ms 70.61 ms
Size 49.74 MiB 55.36 MiB 5.62 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
2c735cc+dirty 435.20 ms 459.48 ms 24.28 ms
a5d243c+dirty 499.20 ms 525.62 ms 26.42 ms
5fe1c6c+dirty 365.84 ms 408.62 ms 42.78 ms
4953e94+dirty 398.80 ms 431.81 ms 33.01 ms
5a316ea+dirty 626.41 ms 645.00 ms 18.59 ms
bfba737+dirty 425.19 ms 465.98 ms 40.79 ms
3ce5254+dirty 373.90 ms 427.84 ms 53.94 ms
40c9884+dirty 453.76 ms 478.98 ms 25.22 ms
853723c+dirty 415.82 ms 460.94 ms 45.12 ms
68ae91b+dirty 515.04 ms 578.08 ms 63.04 ms

App size

Revision Plain With Sentry Diff
2c735cc+dirty 43.94 MiB 48.94 MiB 5.00 MiB
a5d243c+dirty 48.30 MiB 53.54 MiB 5.23 MiB
5fe1c6c+dirty 43.94 MiB 49.00 MiB 5.06 MiB
4953e94+dirty 43.94 MiB 48.94 MiB 5.00 MiB
5a316ea+dirty 49.74 MiB 55.09 MiB 5.34 MiB
bfba737+dirty 49.74 MiB 55.09 MiB 5.34 MiB
3ce5254+dirty 43.94 MiB 48.98 MiB 5.04 MiB
40c9884+dirty 49.74 MiB 55.09 MiB 5.34 MiB
853723c+dirty 48.30 MiB 53.58 MiB 5.28 MiB
68ae91b+dirty 49.74 MiB 54.79 MiB 5.05 MiB

@github-actions

Copy link
Copy Markdown
Contributor

Android (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 457.61 ms 500.40 ms 42.79 ms
Size 49.74 MiB 55.36 MiB 5.62 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
5a316ea+dirty 501.17 ms 555.26 ms 54.09 ms
bfba737+dirty 419.52 ms 462.68 ms 43.16 ms
3a829f0+dirty 474.65 ms 518.24 ms 43.59 ms
37a2091+dirty 407.82 ms 441.22 ms 33.40 ms
40c9884+dirty 430.40 ms 497.76 ms 67.36 ms
3b6e9f9+dirty 442.70 ms 486.44 ms 43.74 ms
21a1e70+dirty 405.72 ms 436.16 ms 30.44 ms
c151573+dirty 530.34 ms 559.43 ms 29.09 ms
580fb5c+dirty 436.34 ms 471.63 ms 35.28 ms
774257e+dirty 407.09 ms 447.46 ms 40.37 ms

App size

Revision Plain With Sentry Diff
5a316ea+dirty 49.74 MiB 55.09 MiB 5.34 MiB
bfba737+dirty 49.74 MiB 55.09 MiB 5.34 MiB
3a829f0+dirty 48.30 MiB 53.58 MiB 5.28 MiB
37a2091+dirty 48.30 MiB 53.58 MiB 5.28 MiB
40c9884+dirty 49.74 MiB 55.09 MiB 5.34 MiB
3b6e9f9+dirty 48.30 MiB 53.54 MiB 5.23 MiB
21a1e70+dirty 49.74 MiB 54.82 MiB 5.07 MiB
c151573+dirty 48.30 MiB 53.54 MiB 5.24 MiB
580fb5c+dirty 49.74 MiB 54.79 MiB 5.05 MiB
774257e+dirty 48.30 MiB 53.58 MiB 5.28 MiB

@antonis
antonis enabled auto-merge (squash) July 24, 2026 07:22
@antonis
antonis merged commit a636fa4 into main Jul 24, 2026
136 of 165 checks passed
@antonis
antonis deleted the dependabot/bundler/performance-tests/json-2.19.9 branch July 24, 2026 07:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ready-to-merge Triggers the full CI test suite ruby Pull requests that update ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant