RP-6332: Fix Dependabot alerts (json, addressable, ffi)

[ryanbond]

Summary

Resolves four open high-severity Dependabot alerts on Gemfile.lock by upgrading the affected gems. Changes are confined to Gemfile and Gemfile.lock; the gem's public API is unchanged (no edits under lib/ and no .gemspec change).

Fixed

Package	Old -> New	Severity	GHSA	Root-cause direct dep + mechanism
json	2.1.0 -> 2.7.6	high	GHSA-jphg-qwrw-7w9g	Direct runtime dep in clever-ruby.gemspec (json ">= 1.8", "< 3"). Bumped within the existing range via lockfile; no gemspec/API change.
addressable	2.4.0 -> 2.9.0	high	GHSA-h27x-rffw-24p4	Transitive via webmock (dev/test). Added gem 'addressable', '>= 2.9.0' to the development/test group so bundler resolves the patched version.
addressable	2.4.0 -> 2.9.0	high	GHSA-jxhc-q857-3j6g	Same root cause as above; 2.9.0 also covers the earlier (<= 2.7.0) ReDoS advisory.
ffi	1.9.18 -> 1.16.3	high	GHSA-2gw2-8q9w-cw8p	Transitive via sys-uname/ethon (dev/test). Added gem 'ffi', '>= 1.9.24', '< 1.17' to the development/test group. The < 1.17 cap is required because ffi >= 1.17 requires Ruby >= 3.0 while this project targets Ruby 2.6; 1.16.3 is the highest patched version compatible with the toolchain.

addressable 2.9.0 introduced public_suffix (5.1.1) as a new transitive dependency (reflected in the lockfile).

Not fixed / dead-end

None. All four open alerts are resolved.

Backward incompatibility

None. json stays within the gemspec's declared < 3 runtime range, so no consumer-visible change and no major bump. addressable and ffi are development/test-only transitive dependencies and are not part of the gem's published runtime surface.

Testing

• Toolchain: Ruby 2.6.10, Bundler 1.x. Gems installed at locked versions into a local vendor/bundle (gitignored).
• Spec suite (rspec, equivalent to rake spec): 2 examples, 0 failures.

..
Finished in 0.08174 seconds (files took 1.99 seconds to load)
2 examples, 0 failures

Note: a full bundle install cannot complete in the CI/sandbox environment because the unrelated dev gem autotest-fsevent (0.2.14) fails its native build on macOS Darwin 25 (Darwin 25 is not (yet) supported). This is a pre-existing environment limitation independent of these security changes (the unmodified baseline also fails to install, on the old ffi 1.9.18 native build). The four security-relevant gems plus all gems required to run the spec suite were installed at their locked versions and the suite passes.

🤖 Generated with Claude Code