(See Rails 8.1.4 section below for the latest update)

A routine bundle update took a ton of tests from green to red recently in several of our Rails Apps.

How it showed up

A sample backtrace:

ArgumentError: wrong number of arguments (given 2, expected 1)
    app/controllers/sessions_controller.rb:46:in 'SessionsController#destroy'

Nothing there takes two arguments. The error was being raised much further down.

The actual cause

Running one test with a full backtrace showed the real stack. Reading it bottom-up:

ActionDispatch::Request::Session#[]
  → ActionDispatch::Session::CookieStore#unpacked_cookie_data
    → ActionDispatch::Cookies::EncryptedKeyRotatingCookieJar#parse
      → ActiveSupport::MessageEncryptor#decrypt_and_verify
        → ActiveSupport::Messages::Metadata#deserialize_from_json
          → ActiveSupport::JSON.decode
            → JSON.parse   ← ArgumentError

Two ways out

Rails has already fixed this in PR #58601 on 2026-08-28 and was backported to 8-1-stable the same day. What has not happened is a release, the v8.1.3.1 is still the newest version and does not include this fix. That leaves two options.

Option 1 - run Rails edge

gem "rails", github: "rails/rails", branch: "8-1-stable"

Option 2 - pin json to 2.x.

gem "json", "~> 2.21"

% bundle install
Fetching gem metadata from https://rubygems.org/........
Resolving dependencies...
Using json 2.21.2 (was 3.0.2)

Extra for Option 2

A pin stops bundle update, but it does not stop Dependabot from opening a pull request offering json 3 again. We can do this:

- package-ecosystem: bundler
  directory: "/"
  schedule:
    interval: weekly
  open-pull-requests-limit: 8
  ignore:
  - dependency-name: json
    versions: [">= 3.0"]

Updated: Rails 8.1.4 (Oct 2026)

Rails 8.1.4 (released 2026-09-24) includes the fix (Reference). ActiveSupport::JSON.decode now passes its options as keywords:

# Rails 8.1.3.1
::JSON.parse(json, options)

# Rails 8.1.4
::JSON.parse(json, **options)

Both workarounds can go now.

  1. Upgrade Rails to 8.1.4. If you took Option 1, switch from 8-1-stable back to the released gem.
  2. Remove the json pin from Gemfile and the ignore block from .github/dependabot.yml.
  3. Update json:
% bundle update json --conservative
Fetching gem metadata from https://rubygems.org/........
Resolving dependencies...
Using json 3.0.2 (was 2.21.2)
Bundle updated!

NOTE: json 3.0 has breaking changes of its own. Duplicate keys are rejected, unknown options raise ArgumentError, and comments are no longer allowed by default. Check your own JSON.parse calls (Reference).