applyDiff crashes when cached WorkflowVersion lacks steps field

https://sonarly.com/issue/8672?type=bug The workflow step creation flow applies server-computed diffs to the Apollo-cached WorkflowVersion, but the cached record may have null/undefined `steps` when the cache contains only partial data, causing `applyDiff` to throw when traversing the diff path. Fix: The fix adds a guard check for `cachedRecord.steps` and `cachedRecord.trigger` being defined before calling `applyDiff`. When these fields are missing from the partial Apollo cache entry (which can happen when the `WorkflowVersion` was cached via a listing query that only fetches `id`, `status`, `name`, `createdAt`), `applyDiff` would crash trying to traverse a null/undefined value. By returning early when `steps` or `trigger` are not defined, we skip the optimistic cache update for partially-cached records. The data will be refetched from the server as a natural consequence of the mutation completing, so the UI will still eventually reflect the correct state — just without the immediate optimistic update. ```typescript file=packages/twenty-front/src/modules/workflow/workflow-steps/hooks/useUpdateWorkflowVersionCache.ts lines=44-46 if (!isDefined(cachedRecord.steps) || !isDefined(cachedRecord.trigger)) { return; } ``` This is consistent with the existing pattern in the same function (returning early when `cachedRecord` itself is undefined at line 40-42), and uses the already-imported `isDefined` utility from `twenty-shared/utils`.
fix: fast-xml-parser has stack overflow in XMLBuilder with preserve order (#18375 )
2026-03-04 11:22:51 +00:00 · 2026-03-04 10:36:58 +01:00 · 2026-03-04 10:35:10 +01:00 · 2026-03-04 10:34:44 +01:00 · 2026-03-04 09:16:33 +01:00
6 changed files with 639 additions and 823 deletions
@@ -67,11 +67,11 @@ const EmailField: React.FC<{
 ```

 ```tsx
-/* ✅ - Dobré, explicitně definován samostatný typ (OwnProps) pro
+/* ✅ - Dobré, explicitně definován samostatný typ (OwnProps) pro 
 *     rekvizity komponenty
 *   - Tato metoda automaticky nezahrnuje rekvizitu children. Pokud
 *     ji chcete zahrnout, musíte ji specifikovat v OwnProps.
- */
+ */ 
 type EmailFieldProps = {
  value: string;
 };
@@ -96,7 +96,7 @@ const MyComponent = (props: OwnProps) => {
 ```tsx
 /* ✅ - Dobré, explicitně uvádí všechny rekvizity
 *    - Zvyšuje čitelnost a udržovatelnost
- */
+ */ 
 const MyComponent = ({ prop1, prop2, prop3 }: MyComponentProps) => {
  return <OtherComponent {...{ prop1, prop2, prop3 }} />;
 };
@@ -123,7 +123,7 @@ const value = process.env.MY_VALUE ?? 'default';
 ### Používejte volitelné zřetězení `?.`

 ```tsx
-// ❌ Špatné
+// ❌ Špatné 
 onClick && onClick();

 // ✅ Dobré
@@ -194,7 +194,7 @@ setHotkeyScopeAndMemorizePreviousScope(

 ### Používejte StyledComponents

-Styling komponenty s [Linaria styled](https://github.com/callstack/linaria).
+Stylujte komponenty pomocí [Linaria styled](https://github.com/callstack/linaria).

 ```tsx
 // ❌ Špatné
@@ -194,7 +194,7 @@ setHotkeyScopeAndMemorizePreviousScope(

 ### Usa StyledComponents

-Stile i componenti con [Linaria styled](https://github.com/callstack/linaria).
+Stilizza i componenti con [Linaria styled](https://github.com/callstack/linaria).

 ```tsx
 // ❌ Male
@@ -68,7 +68,7 @@ const EmailField: React.FC<{

 ```tsx
 /* ✅ - İyi, bileşenin prop'ları için ayrı bir tür (OwnProps) açıkça tanımlanmıştır
- *  - Bu yöntem çocuk prop'unu otomatik olarak içermez.
+ *  - Bu yöntem çocuk prop'unu otomatik olarak içermez. 
 *    Onu dahil etmek istiyorsanız, OwnProps'ta belirtmeniz gerekir.
 */
 type EmailFieldProps = {
@@ -41,6 +41,10 @@ export const useUpdateWorkflowVersionCache = () => {
      return;
    }

+    if (!isDefined(cachedRecord.steps) || !isDefined(cachedRecord.trigger)) {
+      return;
+    }
+
    const { triggerDiff, stepsDiff } = workflowVersionStepChanges;

    const newCachedRecord = {
@@ -23,11 +23,11 @@
    "@ai-sdk/openai": "^3.0.30",
    "@ai-sdk/provider-utils": "^4.0.15",
    "@ai-sdk/xai": "^3.0.57",
-    "@aws-sdk/client-lambda": "3.998.0",
-    "@aws-sdk/client-s3": "3.998.0",
-    "@aws-sdk/client-sesv2": "3.998.0",
-    "@aws-sdk/client-sts": "3.998.0",
-    "@aws-sdk/credential-providers": "3.998.0",
+    "@aws-sdk/client-lambda": "3.1001.0",
+    "@aws-sdk/client-s3": "3.1001.0",
+    "@aws-sdk/client-sesv2": "3.1001.0",
+    "@aws-sdk/client-sts": "3.1001.0",
+    "@aws-sdk/credential-providers": "3.1001.0",
    "@azure/msal-node": "^3.8.4",
    "@babel/preset-env": "7.26.9",
    "@blocknote/server-util": "^0.47.0",
@@ -52,14 +52,14 @@
    "@microsoft/microsoft-graph-types": "^2.40.0",
    "@nestjs/axios": "3.1.2",
    "@nestjs/cache-manager": "^2.3.0",
-    "@nestjs/common": "11.1.9",
+    "@nestjs/common": "11.1.15",
    "@nestjs/config": "3.3.0",
-    "@nestjs/core": "11.1.9",
+    "@nestjs/core": "11.1.15",
    "@nestjs/event-emitter": "2.1.0",
    "@nestjs/graphql": "patch:@nestjs/graphql@12.1.1#./patches/@nestjs+graphql+12.1.1.patch",
    "@nestjs/jwt": "11.0.1",
    "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-express": "11.1.9",
+    "@nestjs/platform-express": "11.1.15",
    "@nestjs/schedule": "^6.0.1",
    "@nestjs/serve-static": "5.0.4",
    "@nestjs/terminus": "11.0.0",
@@ -189,7 +189,7 @@
    "@nestjs/cli": "^11.0.16",
    "@nestjs/devtools-integration": "^0.2.1",
    "@nestjs/schematics": "^11.0.9",
-    "@nestjs/testing": "^11.1.9",
+    "@nestjs/testing": "^11.1.15",
    "@types/babel__preset-env": "7.10.0",
    "@types/bytes": "^3.1.1",
    "@types/dompurify": "^3.0.5",
Author	SHA1	Message	Date
Sonarly Claude Code	5cc6696960	applyDiff crashes when cached WorkflowVersion lacks steps field https://sonarly.com/issue/8672?type=bug The workflow step creation flow applies server-computed diffs to the Apollo-cached WorkflowVersion, but the cached record may have null/undefined `steps` when the cache contains only partial data, causing `applyDiff` to throw when traversing the diff path. Fix: The fix adds a guard check for `cachedRecord.steps` and `cachedRecord.trigger` being defined before calling `applyDiff`. When these fields are missing from the partial Apollo cache entry (which can happen when the `WorkflowVersion` was cached via a listing query that only fetches `id`, `status`, `name`, `createdAt`), `applyDiff` would crash trying to traverse a null/undefined value. By returning early when `steps` or `trigger` are not defined, we skip the optimistic cache update for partially-cached records. The data will be refetched from the server as a natural consequence of the mutation completing, so the UI will still eventually reflect the correct state — just without the immediate optimistic update. ```typescript file=packages/twenty-front/src/modules/workflow/workflow-steps/hooks/useUpdateWorkflowVersionCache.ts lines=44-46 if (!isDefined(cachedRecord.steps) \|\| !isDefined(cachedRecord.trigger)) { return; } ``` This is consistent with the existing pattern in the same function (returning early when `cachedRecord` itself is undefined at line 40-42), and uses the already-imported `isDefined` utility from `twenty-shared/utils`.	2026-03-04 11:22:51 +00:00
Abdullah.andGitHub	225f185278	fix: fast-xml-parser has stack overflow in XMLBuilder with preserve order (#18375 ) Resolves [Dependabot Alert 551](https://github.com/twentyhq/twenty/security/dependabot/551).	2026-03-04 10:36:58 +01:00
Abdullah.andGitHub	ca1d49c6cd	fix: rollup 4 has arbitrary file write via path traversal (#18373 ) Resolves [Dependabot Alert 508](https://github.com/twentyhq/twenty/security/dependabot/508).	2026-03-04 10:35:10 +01:00
Abdullah.andGitHub	2f9c94d9a0	fix: upgrade nestjs dependencies to upgrade multer transitive import (#18374 ) Resolves [Dependabot Alert 549](https://github.com/twentyhq/twenty/security/dependabot/549) and [Dependabot Alert 550](https://github.com/twentyhq/twenty/security/dependabot/550).	2026-03-04 10:34:44 +01:00
github-actions[bot]GitHub github-actions	a9c4920fcc	i18n - docs translations (#18370 ) Created by Github action --------- Co-authored-by: github-actions <github-actions@twenty.com>	2026-03-04 09:16:33 +01:00