[rheos]

Supersedes Dependabot #6, #7 and #9.

Batched deliberately: each of these only touches Gemfile.lock, so merging them one at a time conflicts the rest — #8 (rspec-rails) merged cleanly and immediately left #6 DIRTY. Three serial rebase cycles for three one-line bumps isn't a good trade.

Each verified on the axis the suite cannot reach

A green suite means something different for each of these, which is the whole point:

Bump	What actually verifies it
shoulda-matchers 5.3.0 → 8.0.1	test-only — the suite is the verification. 75 examples, 0 failures.
puma 6.6.1 → 8.0.2	rspec never boots a server. Booted the app; confirmed puma 8.0.2 serving requests.
rack-cors 2.0.2 → 3.0.0	a major, and this repo has no CORS specs at all. A green suite says nothing about it.

For rack-cors I issued a real preflight rather than trusting CI:

> OPTIONS /api/v1/networks
> Origin: https://app.growoperative.app
> Access-Control-Request-Method: GET
> Access-Control-Request-Headers: authorization

HTTP/1.1 200 OK
access-control-allow-origin: *
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
access-control-allow-headers: authorization
access-control-max-age: 7200

A simple GET with an Origin also carries access-control-allow-origin. The existing config/initializers/cors.rb (origins "*", all methods) works unchanged on 3.0.

Also: local development has been broken here

Not a dependency change, but found while trying to boot the app for the puma check, and worth fixing in the same PR since it blocks anyone verifying anything locally.

docker-entrypoint.sh was committed as mode 100644, not 100755. Every docker compose up in this repo died with:

exec ./docker-entrypoint.sh: permission denied

The deployed image is fine, which is why nobody noticed — the Dockerfile does RUN chmod +x docker-entrypoint.sh. But docker-compose.yml bind-mounts .:/app, which overlays the image's executable copy with the host's non-executable one. So api.foaf.io stayed healthy while local dev was dead. Committed mode is now 100755.

(Two other local-dev papercuts hit on the way, neither a repo change: the foaf_db_data volume still held MySQL data from before the 2026-08-22 Postgres migration, so Postgres refused to initdb; and a stale tmp/pids/server.pid persists on the host through the bind mount. Both cleared by hand.)

Refs rheos/growoperative-api#55