Refresh vulnerable Ruby dependencies

Gemfile

@@ -2,6 +2,14 @@ source 'https://rubygems.org'
 
 gemspec
 
+# NOTE: the resolved lock has an effective Ruby floor of 3.2, which contradicts
+# required_ruby_version ">= 2.3" in xero-ruby.gemspec. activesupport 8.1.3.1
+# (pulled in transitively by json-jwt), connection_pool 3.0.2 and minitest 6.0.6
+# each declare required_ruby_version >= 3.2, and faraday 2.14.3 declares >= 3.0,
+# so `bundle install` fails on Ruby 3.1.x and below despite the gemspec claiming
+# support back to 2.3. PR #387 raises the gemspec floor to ">= 3.2" and must
+# land with or before this dependency refresh.
+
 group :development, :test do
   gem 'rake', '~> 13.2.1'
   gem 'pry-byebug'

Gemfile.lock

@@ -2,49 +2,51 @@ PATH
   remote: .
   specs:
     xero-ruby (18.1.0)
-      faraday (>= 2.0, < 3.0)
-      json (~> 2.1, >= 2.1.0)
-      json-jwt (~> 1.16, >= 1.16.3)
+      faraday (>= 2.14.3, < 3.0)
+      json (~> 2.1, >= 2.21.2)
+      json-jwt (~> 1.16, >= 1.16.6)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.2.1)
+    activesupport (8.1.3.1)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
       minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     aes_key_wrap (1.1.0)
     ast (2.4.2)
-    base64 (0.2.0)
-    bigdecimal (3.1.8)
+    base64 (0.3.0)
+    bigdecimal (4.1.2)
     bindata (2.5.0)
     bundler-audit (0.9.2)
       bundler (>= 1.2.0, < 3)
       thor (~> 1.0)
     byebug (11.1.3)
     coderay (1.1.3)
-    concurrent-ruby (1.3.4)
-    connection_pool (2.4.1)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
     diff-lcs (1.5.1)
-    drb (2.2.1)
-    faraday (2.12.0)
-      faraday-net_http (>= 2.0, < 3.4)
+    drb (2.2.3)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
       json
       logger
     faraday-follow_redirects (0.3.0)
       faraday (>= 1, < 3)
-    faraday-net_http (3.3.0)
-      net-http
-    i18n (1.14.6)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    json (2.7.2)
+    json (2.21.2)
     json-jwt (1.16.6)
       activesupport (>= 4.2)
       aes_key_wrap
@@ -53,15 +55,18 @@ GEM
       faraday (~> 2.0)
       faraday-follow_redirects
     language_server-protocol (3.17.0.3)
-    logger (1.6.1)
+    logger (1.7.0)
     method_source (1.1.0)
-    minitest (5.25.1)
-    net-http (0.4.1)
-      uri
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
     parallel (1.26.3)
     parser (3.3.5.0)
       ast (~> 2.4.1)
       racc
+    prism (1.9.0)
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
@@ -98,12 +103,12 @@ GEM
     rubocop-ast (1.32.3)
       parser (>= 3.3.1.0)
     ruby-progressbar (1.13.0)
-    securerandom (0.3.1)
+    securerandom (0.4.1)
     thor (1.3.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.6.0)
-    uri (0.13.1)
+    uri (1.1.1)
 
 PLATFORMS
   arm64-darwin-23

xero-ruby.gemspec

@@ -26,9 +26,9 @@ Gem::Specification.new do |s|
   s.license     = "Unlicense"
   s.required_ruby_version = ">= 2.3"
 
-  s.add_runtime_dependency 'faraday', '>= 2.0', '< 3.0'
-  s.add_runtime_dependency 'json', '~> 2.1', '>= 2.1.0'
-  s.add_runtime_dependency 'json-jwt', '~> 1.16', '>= 1.16.3'
+  s.add_runtime_dependency 'faraday', '>= 2.14.3', '< 3.0'
+  s.add_runtime_dependency 'json', '~> 2.1', '>= 2.21.2'
+  s.add_runtime_dependency 'json-jwt', '~> 1.16', '>= 1.16.6'
   s.add_development_dependency 'rspec', '~> 3.6', '>= 3.6.0'
 
   s.files         = Dir.glob("{lib}/**/*") + %w(README.md)