fix(import): import steps that have no expected result - #626
Merged
Conversation
The CSV import route passed a raw null for Steps.expectedResult, a nullable Json column that ZenStack v3 only accepts as the DbNull sentinel — the convention the copy/move worker and the version service already follow. Every stepped row was reported as a problem and no steps were created, while the case rows were still inserted, so a failed import left half-built cases behind. This also broke the documented export, edit and re-import round trip, since our own export writes null expected results. The route's unit tests mock the database, so they never exercised the real validation. Restoring a soft-deleted case had a related defect: it re-created version 1 and collided with the case's surviving version snapshots. The restore path now allocates the next free version, the way the update path does. (cherry picked from commit a6091db)
Commits scoped to the release pipeline change workflow files, not the application, so they should not decide the next app version on their own. Without this rule the feat(release) already on main since v1.0.1 would turn the next patch release into 1.1.0.
The 1.0.0 graduation took beta's tree wholesale, which dropped the security floors main had accumulated in pnpm-workspace.yaml. Two of the open alerts are that regression: sharp@0.32.6 came back under the docs OG plugin and linkify-it 2.x/3.x under the Forge app's Atlassian packages. Both floors are restored. @hono/node-server moves off its exact 1.19.13 pin to the patched 1.19 line; it stays on 1.x because @zenstackhq/cli only accepts ^1.13.8. npm's xlsx is frozen at 0.18.5 and will never receive the prototype pollution and ReDoS fixes, so the dependency now points at the SheetJS CDN tarball for 0.20.3, integrity-pinned in the lockfile. It parses uploaded attachments for the preview, so those fixes matter. image-size has no fixed release and is only reachable through the docs build, so it is left as is.
Contributor
Author
|
🎉 This PR is included in version 1.0.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backports the CSV import fix from
release/v1.1to the 1.0 line so it ships as a patch release.nullforSteps.expectedResult, a nullable Json column that ZenStack v3 only accepts as theDbNullsentinel (the conventioncopyMoveWorker.tsandtestCaseVersionService.tsalready follow). Every stepped row was reported asInvalid create args for model "Steps": … expected string, received null at "data.expectedResult" …and no steps were created, while the case rows were still inserted, so a failed import left half-built cases behind. This also broke the documented export → edit → re-import round trip, since our own export writes empty expected results. Reported against 1.0.x on 2026-09-08.@@unique([repositoryCaseId, version])). The restore path now allocates the next free version, the way the update path does..releaserc.json:release-scoped commits no longer bump the app version. They change workflow files, not the application. Without this rule thefeat(release)from feat(release): publish the Helm chart alongside the self-host images #621, already onmainsince v1.0.1, would make this release 1.1.0 instead of 1.0.2. Same treatment as thedocs,packages,cli,forge-appanddepsscopes.Cherry-pick of
a6091db41fromrelease/v1.1, which keeps the fix for 1.1.Dependency updates for the open Dependabot alerts
The 1.0.0 graduation took beta's tree wholesale, which silently dropped the security floors main had accumulated in
pnpm-workspace.yaml(the #563 sweep). Two of the alerts are that regression.sharp— restores the^0.35.0floor. Without it the docs site's@acid-info/docusaurus-ogpulledsharp@0.32.6back in; it now builds against 0.35.4 (verified bybuild:docsin the gate). Dependabot alert 454.linkify-it— restores the^5.0.2floor.@forge/react's Atlassian packages had pulled 2.2.0 and 3.0.3 back in; both now dedupe to 5.0.2, which ships CJS and ESM builds so@atlaskit/adf-schema'srequire()path is fine. Forge app webpack build passes. Alerts 441 and 453.@hono/node-server— exact pin1.19.13→^1.19.15, resolving 1.19.17. Stays on 1.x because@zenstackhq/clionly accepts^1.13.8. Alert 514.xlsx— npm'sxlsxis frozen at 0.18.5 and will never receive the fixes; SheetJS publishes current releases only from its own CDN. The dependency now points athttps://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz, integrity-pinned in the lockfile withversion: 0.20.3. This is the attachment preview parser (lib/utils/officeDocuments.ts), so it runs on untrusted uploads and the prototype-pollution and ReDoS fixes matter. Alerts 512, 513, 515, 516.image-size(alerts 496, 497) — no fix exists; the latest release is the vulnerable 2.0.2. It is only reachable through@docusaurus/mdx-loaderat docs build time, processing our own images. Recommend dismissing as "vulnerable code is not actually used".The other floors the graduation dropped (
adm-zip,body-parser,brace-expansion@1,immutable,svgo) already resolve to safe versions in the lockfile, so they are left alone.Related Issue
Customer email report (no issue filed).
Type of Change
How Has This Been Tested?
Describe the tests you ran to verify your changes:
app/api/repository/import/route.test.ts(41 tests), including theDbNullexpectation on the step create and the new "allocates the next version when the restored case already has snapshots" regression testparseStepsCell/aggregateMultiRowSteps; fullpnpm precommitgate, re-run after the dependency changes (12,932 tests, docs build with sharp 0.35.4); Forge app webpack build with linkify-it 5.0.2; lockfile grepped to confirm no vulnerable copy remainsTest Configuration:
Checklist
Screenshots (if applicable)
Additional Notes
Merging this cuts v1.0.2 via semantic-release (squash title
fix(import): …→ patch). Verified by running@semantic-release/commit-analyzeroverv1.0.1..HEADwith this branch's.releaserc.json:patchwith the new rule,minor(1.1.0) without it. The release notes will also list #619 and #621, which are onmainbut unreleased.Follow-up worth its own change: the import wizard offers "Expected Result" as a mapping target in single-row mode, but the route only honors it in multi-row mode. That is what led the reporter to a CSV where every step had no expected result.