From dd9c090a51cb2c231e68ddda26158fc6e3995103 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20V=C3=A1squez?= <jvasquez@navigatingcancer.com>
Date: Wed, 8 Jul 2026 22:56:44 -0600
Subject: [PATCH] Upgrade puma 3.12.6 -> 8.0.2 (security: clears 7+ CVEs)

puma was pinned ~> 3.7 (3.12.6, EOL, 2020) with a stack of advisories
including a Critical HTTP request-smuggling CVE; the pin blocked every fix.
Bumped to ~> 8.0.

Went to puma 8 rather than 6: puma 6.x still carries two open High PROXY
Protocol v1 advisories (CVE-2026-47736/47737) whose only fix is ~> 7.2.1 /
>= 8.0.2, so 6.x would not have fully cleared bundle-audit. puma 8.0.2 is
clean.

config/puma.rb and the Procfile needed no changes (standard threads/port/
environment DSL + tmp_restart plugin, all still valid in puma 8). Used
--conservative so rack stays at 2.x. Both lockfiles updated.

Verified locally: bundle-audit shows no remaining puma advisories; puma
8.0.2 boots as a server and serves HTTP 200 on /; app boots; test suite
green (16 runs, 52 assertions, 0 failures); rubocop + reek clean.
---
 Gemfile           | 2 +-
 Gemfile.lock      | 5 +++--
 Gemfile.next.lock | 5 +++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/Gemfile b/Gemfile
index db0b849..d13a591 100644
--- a/Gemfile
+++ b/Gemfile
@@ -25,7 +25,7 @@ gem "bundler-audit"
 gem "next_rails"
 gem "ostruct"
 gem "concurrent-ruby", "< 1.3.5"
-gem "puma", "~> 3.7"
+gem "puma", "~> 8.0"
 # minitest 6.0 dropped minitest/mock.rb into a separate minitest-mock gem;
 # pinned below 6 so a transitive bump (e.g. via `bundle update rails`)
 # doesn't silently drag the test suite's own framework across a major
diff --git a/Gemfile.lock b/Gemfile.lock
index f414aea..6f2f217 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -252,7 +252,8 @@ GEM
     prettyprint (0.2.0)
     prism (1.9.0)
     public_suffix (7.0.5)
-    puma (3.12.6)
+    puma (8.0.2)
+      nio4r (~> 2.0)
     racc (1.8.1)
     rack (2.2.23)
     rack-session (1.0.2)
@@ -433,7 +434,7 @@ DEPENDENCIES
   nokogiri (>= 1.13.0)
   ostruct
   pg (~> 1.1)
-  puma (~> 3.7)
+  puma (~> 8.0)
   rails (>= 8.1.0, < 8.2.0)
   redcarpet
   reek
diff --git a/Gemfile.next.lock b/Gemfile.next.lock
index f414aea..6f2f217 100644
--- a/Gemfile.next.lock
+++ b/Gemfile.next.lock
@@ -252,7 +252,8 @@ GEM
     prettyprint (0.2.0)
     prism (1.9.0)
     public_suffix (7.0.5)
-    puma (3.12.6)
+    puma (8.0.2)
+      nio4r (~> 2.0)
     racc (1.8.1)
     rack (2.2.23)
     rack-session (1.0.2)
@@ -433,7 +434,7 @@ DEPENDENCIES
   nokogiri (>= 1.13.0)
   ostruct
   pg (~> 1.1)
-  puma (~> 3.7)
+  puma (~> 8.0)
   rails (>= 8.1.0, < 8.2.0)
   redcarpet
   reek