Merge 2.19.9 changes

Author: byroot

CHANGES.md

@@ -5,6 +5,11 @@
 * Deprecate default support of JavaScript comments in the parser and add `allow_comments: true` parsing option.
 * Integrate with Ruby 4.1 `ruby_sized_xfree`.
 
+### 2026-06-11 (2.19.9)
+
+* Fix buffer overflow that could lead to a crash when writing JSON directly into an IO
+  with `JSON.generate(object, io)`. [CVE-PENDING].
+
 ### 2026-06-03 (2.19.8)
 
 * Fix 1-byte buffer overread on EOS errors.

lib/json/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSON
-  VERSION = '2.19.8'
+  VERSION = '2.19.9'
 end