From f8b210756962b4adee613326ea39e566d0c130a4 Mon Sep 17 00:00:00 2001
From: Morgan Roderick <morgan@roderick.dk>
Date: Thu, 10 Sep 2026 08:28:27 +0200
Subject: [PATCH] Pin json gem to ~> 2.3

json 3.0 (pulled in transitively by rubocop's json >= 2.3) made
JSON.parse keyword-only. ActiveSupport::JSON.decode passes an options
hash positionally, so every session-cookie decryption raises
ArgumentError and all specs that touch a session fail.

Pinned until Rails supports json 3.x. Also stops Dependabot re-bumping
json in the ruby-deps group (ref #2864).
---
 Gemfile      | 5 +++++
 Gemfile.lock | 1 +
 2 files changed, 6 insertions(+)

diff --git a/Gemfile b/Gemfile
index 37985b608..56e293d2a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -35,6 +35,11 @@ gem 'jwt'
 # vips backend is never loaded.
 gem 'image_processing'
 gem 'mini_magick'
+# json 3.0 breaks ActiveSupport::JSON.decode: json 3.0 made JSON.parse
+# keyword-only, so Rails' JSON.parse(json, options) positional-hash call
+# raises ArgumentError and every session-cookie read fails. Pinned until
+# Rails supports json 3.x (https://github.com/codebar/planner/pull/2864).
+gem 'json', '~> 2.3'
 gem 'mutex_m' # LOCKED: Added because of activesupport 7.0
 gem 'nokogiri'
 gem 'omniauth'
diff --git a/Gemfile.lock b/Gemfile.lock
index 3d7447274..fdb77c2a4 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -662,6 +662,7 @@ DEPENDENCIES
   image_processing
   irb
   jquery-rails
+  json (~> 2.3)
   jwt
   launchy
   letter_opener