[dependabot]

Bumps the bundler-dependencies group with 2 updates: json and webmock.

Updates json from 3.0.2 to 3.1.0

Changelog

Sourced from json's changelog.

2026-10-13 (3.1.0)

• Added rfc8785 generator option to canonicalize the output. Replaces the json-canonicalization with numerous correctness fixes.
• Use the rb_len_t type introduced in Ruby 4.1 to allow for proper 64bit support on LP64 platforms (Windows).
• JRuby: parser errors now include the position (line, column and the message suffix) as well as json_path, matching the C extension.
• Improved the accuracy of parser error's line, column and snipets in presence of multibyte characters.
• Fix JSON.load to work correctly when provided a Zlib::GzipReader as IO source.
• Reject non-ASCII BINARY strings during JSON generation. This was deprecated since a long time and scheduled to be removed for 3.0.

Commits

• a15b2ba Release 3.1.0
• d09e383 Refactor rfc8785_sort_keys_proc
• e19f7d7 Handle invalid encoding in JSON path keys
• 78d6a83 parser.c: only update the stack once fully spilled
• 6ea6201 Fix parsing of number with out of range negative exponents
• 1b67eb3 Fix parsing of unescaped NULL bytes in strings
• c1a4372 ResumableParser: fix handling of incomplete unicode escape
• 429c109 More hardening against adversarial encode methods
• 8df32ab Index the generated JSON array by rb_len_t
• 21193d0 Match rb_hash_bulk_insert fallback to Ruby's declaration
• Additional commits viewable in compare view

Updates webmock from 3.29.0 to 3.34.0

Release notes

Sourced from webmock's releases.

3.34.0

• Allow with(query: :any) to match any query string (#1099)

  stub_request(:get, "www.example.com").with(query: :any) matches requests with any query string, or none. RSpec's anything works the same way. Previously, this raised NoMethodError, and you had to write with(query: hash_including({})).

  Use a URL without query parameters when passing query: :any. Otherwise, WebMock raises ArgumentError.

  Thanks to nightpool

• Raise a clear ArgumentError for an unsupported query option

  Previously, a value such as with(query: :all) raised NoMethodError (undefined method split). The new error lists the supported values.

• Show anything for keys given without a value to hash_including or hash_excluding outside RSpec

  Previously, with Minitest or Test::Unit, messages showed #<WebMock::Matchers::AnyArgMatcher:0x...>, for example for with(query: hash_including(:a)). RSpec's own matchers already showed anything.

• Provide HTTP_HOST to to_rack apps when the client has not supplied a Host header (#1084)

  Previously, requests from some HTTP clients reached the Rack app without HTTP_HOST. This caused host checks such as Sinatra's HostAuthorization to see an empty host.

  WebMock now fills in the host from the request URL, including the port when it is not the default. An explicit Host header is preserved.

  Thanks to Benoit Tigeot

• Fix Rack compatibility for to_rack apps

  The request environment now passes Rack::Lint.

  SERVER_PORT and CONTENT_LENGTH are now strings. If your app or tests read them directly, use string comparisons, such as env['SERVER_PORT'] == "80". The environment also includes SERVER_PROTOCOL.

  CONTENT_TYPE is omitted when the request has no content type. The Content-Length header is passed only as CONTENT_LENGTH, without an extra HTTP_CONTENT_LENGTH entry. Transfer-Encoding is removed because the body has already been decoded.

  Repeated header values are joined into one string. Header values and the body read from rack.input now use binary (ASCII-8BIT) strings.

3.33.0

• Return effective_url as a String for stubbed Typhoeus responses (#869)

  Previously, this was an Addressable::URI. If your code calls methods such as effective_url.host, parse the returned string into a URI first.

  The URL keeps the request's port, query order and encoding. It follows curl's formatting: for example, http://example.com:80 becomes http://example.com:80/. Stubbed timeouts now provide an effective_url too.

  Thanks to Tom Brammar

• Fix incorrect removal of default ports from displayed URLs

  WebMock could accidentally remove :80 or :443 from a URL's path or query. For example, an error message could show /foo/bar instead of /foo:80/bar.

  Only the host's default port is now removed. This also works when the port is immediately followed by a query string, as in http://example.com:80?a=b.

... (truncated)

Changelog

Sourced from webmock's changelog.

3.34.0

• Allow with(query: :any) to match any query string (#1099)

  stub_request(:get, "www.example.com").with(query: :any) matches requests with any query string, or none. RSpec's anything works the same way. Previously, this raised NoMethodError, and you had to write with(query: hash_including({})).

  Use a URL without query parameters when passing query: :any. Otherwise, WebMock raises ArgumentError.

  Thanks to nightpool

• Raise a clear ArgumentError for an unsupported query option

  Previously, a value such as with(query: :all) raised NoMethodError (undefined method split). The new error lists the supported values.

• Show anything for keys given without a value to hash_including or hash_excluding outside RSpec

  Previously, with Minitest or Test::Unit, messages showed #<WebMock::Matchers::AnyArgMatcher:0x...>, for example for with(query: hash_including(:a)). RSpec's own matchers already showed anything.

• Provide HTTP_HOST to to_rack apps when the client has not supplied a Host header (#1084)

  Previously, requests from some HTTP clients reached the Rack app without HTTP_HOST. This caused host checks such as Sinatra's HostAuthorization to see an empty host.

  WebMock now fills in the host from the request URL, including the port when it is not the default. An explicit Host header is preserved.

  Thanks to Benoit Tigeot

• Fix Rack compatibility for to_rack apps

  The request environment now passes Rack::Lint.

  SERVER_PORT and CONTENT_LENGTH are now strings. If your app or tests read them directly, use string comparisons, such as env['SERVER_PORT'] == "80". The environment also includes SERVER_PROTOCOL.

  CONTENT_TYPE is omitted when the request has no content type. The Content-Length header is passed only as CONTENT_LENGTH, without an extra HTTP_CONTENT_LENGTH entry. Transfer-Encoding is removed because the body has already been decoded.

  Repeated header values are joined into one string. Header values and the body read from rack.input now use binary (ASCII-8BIT) strings.

3.33.0

• Return effective_url as a String for stubbed Typhoeus responses (#869)

  Previously, this was an Addressable::URI. If your code calls methods such as effective_url.host, parse the returned string into a URI first.

  The URL keeps the request's port, query order and encoding. It follows curl's formatting: for example, http://example.com:80 becomes http://example.com:80/. Stubbed timeouts now provide an effective_url too.

  Thanks to Tom Brammar

• Fix incorrect removal of default ports from displayed URLs

  WebMock could accidentally remove :80 or :443 from a URL's path or query. For example, an error message could show /foo/bar instead of /foo:80/bar.

... (truncated)

Commits

• 11392e4 Version 3.34.0
• eabc151 Close the gaps a review found in the Rack env
• 38f08be Make the Rack env for to_rack apps follow the Rack spec
• 732328b Tidy the Rack host fallback and its specs
• 3d831ce Set HTTP_HOST in the Rack env instead of the Net::HTTP signature
• aa71fc1 Merge pull request #1084 from benoittgt/prevent-empty-host
• 5fbb394 Reject query :any with a URI query and accept anything matchers
• d94e918 Reject unsupported query options and describe :any as anything
• 0b56b62 Merge pull request #1099 from nightpool/add-any-query-option
• 78d1078 Version 3.33.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
github-project-fetch	Ready	Preview	Oct 19, 2026 1:18pm UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.