Cap json dependency below 3.0

json 3.0.0 (released 2026-09-07) removed the JSON.create_id= writer along with the insecure create_additions option it configured [1].

jgrep, a transitive dependency of facterdb pulled in here via rspec-puppet-facts’ on_supported_os, still calls JSON.create_id = nil unconditionally, so any consuming module’s spec using on_supported_os fails to load with:

NoMethodError: undefined method `create_id=’ for JSON:Module

This gemspec’s unconstrained json dependency let Bundler resolve consuming modules’ bundles up to json 3.0.0 and hit that failure. Cap it below 3.0 until jgrep or facterdb drop the removed call.