A routine bundle update took a ton of tests from green to red recently in several of our Rails Apps.

How it showed up

A sample backtrace:

ArgumentError: wrong number of arguments (given 2, expected 1)
    app/controllers/sessions_controller.rb:46:in 'SessionsController#destroy'

Nothing there takes two arguments. The error was being raised much further down.

The actual cause

Running one test with a full backtrace showed the real stack. Reading it bottom-up:

ActionDispatch::Request::Session#[]
  → ActionDispatch::Session::CookieStore#unpacked_cookie_data
    → ActionDispatch::Cookies::EncryptedKeyRotatingCookieJar#parse
      → ActiveSupport::MessageEncryptor#decrypt_and_verify
        → ActiveSupport::Messages::Metadata#deserialize_from_json
          → ActiveSupport::JSON.decode
            → JSON.parse   ← ArgumentError

Two ways out

Rails has already fixed this in PR #58601 on 2026-08-28 and was backported to `8-1-stable` the same day. What has not happened is a release, the v8.1.3.1 is still the newest version and has not include this fix. That leaves two options.

Option 1 - run Rails edge

gem "rails", github: "rails/rails", branch: "8-1-stable"

Option 2 - pin json to 2.x.

gem "json", "~> 2.21"
% bundle install
Fetching gem metadata from https://rubygems.org/........
Resolving dependencies...
Using json 2.21.2 (was 3.0.2)

Extra for Option 2

A pin stops bundle update, but it does not stop Dependabot from opening a pull request offering json 3 again. We can do this:

- package-ecosystem: bundler
  directory: "/"
  schedule:
    interval: weekly
  open-pull-requests-limit: 8
  ignore:
  - dependency-name: json
    versions: [">= 3.0"]