Parse request bodies with JSON.parse in the stdlib fallback

Restore the original `Grape::Json = ::JSON` stdlib fallback (the wrapper
module added in #2759 is no longer needed) and fix the json_class
deserialization vector at its source: parse incoming bodies with
JSON.parse instead of JSON.load.

JSON.parse never honours the json_class additions mechanism, so it keeps
json_class payloads inert without the create_additions: false wrapper,
without the per-call delegation, and without depending on JSON.load's
shifting defaults (deprecated since json 2.8.0, defaulting to false in 3.0).

Net change vs. master: lib/grape/json.rb returns to its pre-#2759 shape;
lib/grape/parser/json.rb switches .load to .parse.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ericproulx

CHANGELOG.md

@@ -61,6 +61,7 @@
 * [#2752](https://github.com/ruby-grape/grape/pull/2752): Skip per-request `ActiveSupport::Notifications` payload and dispatch when no subscriber is listening, via private `instrument_<event>` guards on `Endpoint`/`Middleware::Formatter` - [@ericproulx](https://github.com/ericproulx).
 * [#2757](https://github.com/ruby-grape/grape/pull/2757): Build the `Grape::Cookies` jar only when a cookie is read or written (via a new `Grape::Request#cookies?` predicate gating response-cookie flushing), and drop the jar's now-redundant lazy-parse `Proc` - [@ericproulx](https://github.com/ericproulx).
 * [#2756](https://github.com/ruby-grape/grape/pull/2756): Tighten dependency lower bounds to their compatibility floors (`rack >= 2.2.4`, `zeitwerk >= 2.6`, `dry-configurable >= 1.0`) - [@ericproulx](https://github.com/ericproulx).
+* [#2762](https://github.com/ruby-grape/grape/pull/2762): Parse request bodies with `JSON.parse` in the stdlib JSON fallback, dropping the `create_additions: false` wrapper from #2759 (`JSON.parse` never honours `json_class`) - [@ericproulx](https://github.com/ericproulx).
 * Your contribution here.
 
 #### Fixes

lib/grape/json.rb

@@ -4,16 +4,7 @@ module Grape
   if defined?(::MultiJson)
     Json = ::MultiJson
   else
-    module Json
-      ParseError = ::JSON::ParserError
-
-      def self.load(str)
-        ::JSON.load(str, nil, create_additions: false)
-      end
-
-      def self.dump(obj, *)
-        ::JSON.dump(obj, *)
-      end
-    end
+    Json = ::JSON
+    Json::ParseError = Json::ParserError
   end
 end

lib/grape/parser/json.rb

@@ -4,7 +4,7 @@ module Grape
   module Parser
     class Json < Base
       def self.call(object, _env)
-        ::Grape::Json.load(object)
+        ::Grape::Json.parse(object)
       rescue ::Grape::Json::ParseError
         # handle JSON parsing errors via the rescue handlers or provide error message
         raise Grape::Exceptions::InvalidMessageBody.new('application/json')

spec/grape/parser/json_spec.rb

@@ -14,7 +14,8 @@
   end
 
   # Verify that json_class payloads are treated as plain data and do not
-  # trigger Ruby object instantiation via JSON.load's create_additions mechanism.
+  # trigger Ruby object instantiation. JSON.parse never honours the json_class
+  # additions mechanism (unlike JSON.load), so the named class is never built.
   context 'when the request body contains a json_class key' do
     let(:triggered) { [] }