Bump json from 2.18.1 to 2.19.2

[dependabot]

Bumps json from 2.18.1 to 2.19.2.

Release notes

Sourced from json's releases.

v2.19.2

What's Changed

• Fix a format string injection vulnerability in JSON.parse(doc, allow_duplicate_key: false). CVE-2026-33210

Full Changelog: ruby/json@v2.19.1...v2.19.2

v2.19.1

What's Changed

• Fix a compiler dependent GC bug introduced in 2.18.0.

Full Changelog: ruby/json@v2.19.0...v2.19.1

v2.19.0

What's Changed

• Fix allow_blank parsing option to no longer allow invalid types (e.g. load([], allow_blank: true) now raise a type error).
• Add allow_invalid_escape parsing option to ignore backslashes that aren't followed by one of the valid escape characters.

Full Changelog: ruby/json@v2.18.1...v2.19.0

Changelog

Sourced from json's changelog.

2026-03-18 (2.19.2)

• Fix a format string injection vulnerability in JSON.parse(doc, allow_duplicate_key: false). CVE-2026-33210.

2026-03-08 (2.19.1)

• Fix a compiler dependent GC bug introduced in 2.18.0.

2026-03-06 (2.19.0)

• Fix allow_blank parsing option to no longer allow invalid types (e.g. load([], allow_blank: true) now raise a type error).
• Add allow_invalid_escape parsing option to ignore backslashes that aren't followed by one of the valid escape characters.

Commits

• 54f8a87 Release 2.19.2
• 393b41c Fix a format string injection vulnerability
• dbf6bb1 Merge pull request #953 from ruby/dependabot/github_actions/actions/create-gi...
• 7187315 Bump actions/create-github-app-token from 2 to 3
• 4a42a04 Release 2.19.1
• 13689c2 Add missing GC_GUARD in fbuffer_append_str
• a11acc1 Release 2.19.0
• 0a4fb79 fbuffer.h: Use size_t over unsigned long
• a29fcdc Add depth validation to Jruby and TruffleRuby implementations
• de993aa Reject negative depth; add overflow guards to prevent hang/crash
• Additional commits viewable in compare view