- ClientFamilyMembersWritePlatformServiceImpl#updateFamilyMember: guard maritalStatusId/genderId/professionId with != null instead of != 0 so a payload that omits these keys doesn't NPE when the boxed Long is unboxed. - application.properties: fix the broken property name `fineract.security.cors.allowed-metho pas` -> `allowed-methods`. The typo left CORS allowed-methods empty, which made Spring reject every browser POST with "Invalid CORS request" 403 once the SPA sent an Origin header. - application.properties: change the Hikari default password from 313863 to root so the local devRun matches the tenant-DB default at line 49. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>