Remediate CVE-2026-33210 in json by bumping json

[eng-cve-remediation-app]

This PR contains the following updates:

Package	Type	Update	Change
json	dependencies	security	2.6.1 → 2.19.2
json	dependencies	security	2.6.3 → 2.19.2

json:json is not declared by this repo. It arrives through json, which is — so the fix is to bump that, not to pin json:json directly.

Carried library	Change
json:json	2.18.0 → 2.19.2

Dependency paths

• rubocop-capybara:rubocop-capybara → rubocop:rubocop → json:json
• dependency_checker:dependency_checker → puppet_forge:puppet_forge → faraday:faraday → json:json
• dependency_checker:dependency_checker → puppet_forge:puppet_forge → faraday-follow_redirects:faraday-follow_redirects → faraday:faraday → json:json
• rubocop-performance:rubocop-performance → rubocop:rubocop → json:json
• rubocop-factory_bot:rubocop-factory_bot → rubocop:rubocop → json:json
• rubocop-rspec_rails:rubocop-rspec_rails → rubocop:rubocop → json:json
• rubocop-rspec_rails:rubocop-rspec_rails → rubocop-rspec:rubocop-rspec → rubocop:rubocop → json:json
• rubocop-rspec:rubocop-rspec → rubocop:rubocop → json:json
• rubocop:rubocop → json:json
• bolt:bolt → r10k:r10k → puppet_forge:puppet_forge → faraday:faraday → json:json
• bolt:bolt → r10k:r10k → puppet_forge:puppet_forge → faraday-follow_redirects:faraday-follow_redirects → faraday:faraday → json:json
• bolt:bolt → orchestrator_client:orchestrator_client → faraday:faraday → json:json
• bolt:bolt → orchestrator_client:orchestrator_client → faraday-net_http_persistent:faraday-net_http_persistent → faraday:faraday → json:json
• puppet_litmus:puppet_litmus → bolt:bolt → r10k:r10k → puppet_forge:puppet_forge → faraday:faraday → json:json
• puppet_litmus:puppet_litmus → bolt:bolt → r10k:r10k → puppet_forge:puppet_forge → faraday-follow_redirects:faraday-follow_redirects → faraday:faraday → json:json
• puppet_litmus:puppet_litmus → bolt:bolt → orchestrator_client:orchestrator_client → faraday-net_http_persistent:faraday-net_http_persistent → faraday:faraday → json:json
• puppet_litmus:puppet_litmus → bolt:bolt → orchestrator_client:orchestrator_client → faraday:faraday → json:json

These packages are released in unison, so they move together — along with any sibling this repo pins at the same version.

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	8.2	CVE-2026-33210

---

Bump strategy

Strategy: json 2.6.1/2.6.3 -> 2.19.2 (CVE-2026-33210)

json is a direct dependency here, declared in Gemfile (group :development)
via two Ruby-version-guarded conditional lines, not a transitive one, despite the
long transitive dependency_paths list in the ticket (those paths just show other
gems — rubocop, faraday, bolt, puppet_forge, etc. — that also happen to depend on
json; the repo's own pin wins over whatever those would resolve to).

• Guard 1 (Ruby >= 3.1.0, < 3.1.3): was pinned = 2.6.1 -> bumped to = 2.19.2.
• Guard 2 (Ruby >= 3.2.0, < 4.0.0): was pinned = 2.6.3 -> bumped to = 2.19.2.

Verified json 2.19.2's required_ruby_version is >= 2.7, so a single target
version satisfies both guards — no need for two different fix versions.

Re-locked with bundle lock --update json (Gemfile.lock now shows json (2.19.2)),
then bundle install completed cleanly (183 gems installed).

No CHANGELOG.md entry added: this repo's changelog is generated by release
tooling (each entry ties a version tag to a merged PR number), so a hand-written
entry for an unmerged, unreleased change wouldn't match its convention.

[eng-cve-remediation-app]

🔎 Dependency bump analysis

Breaking changes: false · Reachability: no

---

Impact report

Changelog Report: json 2.18.0 → 2.19.2

Summary

This bump pins the dev-group json gem from 2.6.1/2.6.3 straight to
2.19.2 in Gemfile to remediate CVE-2026-33210 (format-string
injection in JSON.parse(doc, allow_duplicate_key: false), CVSS 8.2,
ticket MODULES-11936). Reviewing all intermediate releases (2.18.0 →
2.19.3) turned up no breaking API changes, no removed methods, and no
minimum-Ruby bump. json is a dev-only tooling dependency in this repo
(pulled in as a transitive requirement of rubocop) and is not
required or called anywhere in this module's own code. Verdict: not
breaking — safe for auto-merge.

Upstream changes (2.18.0 → 2.19.3)

Version	Date	Notable change	Breaking?
2.18.0	2025-12-11	Add :allow_control_characters parser option (additive)	No
2.18.1	2026-02-03	Fix rare GC crash in to_json without a user #to_json	No (bug fix)
2.19.0	2026-03-06	allow_blank option now type-checks and raises TypeError for invalid input where it previously silently accepted it; add allow_invalid_escape option (additive)	No — documented as a fix, not flagged breaking by maintainer; behavior only differs for callers passing invalid types to allow_blank, which this repo does not do
2.19.1	2026-03-08	Fix compiler-dependent GC bug introduced in 2.18.0	No (bug fix)
2.19.2	2026-03-18	Security fix: format-string injection in JSON.parse(doc, allow_duplicate_key: false) — this is CVE-2026-33210, the CVE that triggered this bump	No (security fix, not an API change)
2.19.3	2026-03-25	Fix handling of unescaped control chars preceded by a backslash	No (bug fix, included transitively since Gemfile pins exactly 2.19.2, not present here)

No entry in any of these releases is flagged BREAKING, no public method
or class was removed, and no required_ruby_version change was called
out.

The actual diff

Gemfile changes two group :development conditional lines (only the
version literal changes, for two different RUBY_VERSION ranges):

-  gem "json", '= 2.6.1', require: false if ... RUBY_VERSION in ['>= 3.1.0','< 3.1.3']
-  gem "json", '= 2.6.3', require: false if ... RUBY_VERSION in ['>= 3.2.0','< 4.0.0']
+  gem "json", '= 2.19.2', require: false if ... RUBY_VERSION in ['>= 3.1.0','< 3.1.3']
+  gem "json", '= 2.19.2', require: false if ... RUBY_VERSION in ['>= 3.2.0','< 4.0.0']

Gemfile.lock correspondingly resolves json (2.19.2) (line 125), which
satisfies rubocop's json (~> 2.3) constraint (line 338) and the
top-level DEPENDENCIES pin json (= 2.19.2) (line 470). No other gem in
the lockfile changed as part of this bump.

How we use it

• json appears only in group :development of Gemfile — it is a
  dev/test-tooling dependency, never loaded at runtime by the Puppet
  module itself.
• This module ships only manifests/ (Puppet DSL) and spec/ (RSpec
  tests) — there is no lib/ with custom Ruby types, providers, or
  functions.
• Grepped the whole repo (excluding the unrelated untracked hub/
  directory) for require 'json', require "json", JSON.parse,
  JSON.generate, JSON.dump, JSON.load, to_json, from_json, and
  allow_duplicate_key — zero matches. The gem is pulled in
  transitively to satisfy rubocop's dependency graph; this repo's own
  code never calls into the json gem's API directly.
• Because none of the surface that changed (parser options, GC internals,
  the vulnerable duplicate-key/format-string path) is touched by this
  repo, none of the 2.18.0→2.19.2 changes are reachable.

Action items / risks

• No action needed. The bump is a straightforward dev-dependency
  security patch with no breaking upstream changes and no usage in this
  repo's own code.
• No cohort/family-split concern here — json isn't part of a
  matched-set family bump (that concern applies to things like the
  bouncycastle *-jdk18on Java artifacts, not this Ruby gem).

References

• ruby/json CHANGES.md
• json 2.19.2 on RubyGems
• json 2.18.0 on RubyGems
• CVE-2026-33210: https://www.mend.io/vulnerability-database/CVE-2026-33210

[bastelfreak]

All PRs I saw so far from this bot are wrong or don't make sense. Same here. The Gemfile comes from a template. So update the template...

[amitkarsale]

All PRs I saw so far from this bot are wrong or don't make sense. Same here. The Gemfile comes from a template. So update the template...

Thanks for your input Tim!