fix: prevent read operations from rolling back the caller's transaction - #17748
Merged
Merged
Conversation
Read operations never call `initTransaction`, so they never own a transaction — but every one of them called `killTransaction(req)` in its catch block. Because `req` is shared with the caller, a failed read rolled back the caller's in-flight writes and deleted `req.transactionID`. When the caller swallows the error, the damage is silent. A hook doing `payload.findByID(...).catch(() => null)` against a trashed doc kills the transaction opened by the surrounding `create`; `create` sees no failure and goes on to `commitTransaction(req)`, which no-ops because the adapter session is already gone. The client gets a 201 with a real doc id and a populated doc, the Postgres sequence advances, and no row is ever written. Removes the `killTransaction` call — and the resulting useless try/catch — from the 14 operations that never open a transaction: collection find/findByID/count/countVersions/findVersions/findVersionByID/findDistinct/ docAccess, their global equivalents, and auth/access. Errors that propagate are still rolled back by the owning operation's own catch; errors that a hook catches now leave the transaction intact so it commits normally. The diff is mostly re-indentation — `git diff -w` shows the 6 removed lines per file. Documents the ownership rule on `killTransaction` so it isn't reintroduced. Fixes #17723
Contributor
📦 esbuild Bundle Analysis for payloadThis analysis was generated by esbuild-bundle-analyzer. 🤖
Largest pathsThese visualization shows top 20 largest paths in the bundle.Meta file: packages/next/meta_index.json, Out file: esbuild/index.js
Meta file: packages/payload/meta_index.json, Out file: esbuild/index.js
Meta file: packages/payload/meta_shared.json, Out file: esbuild/exports/shared.js
Meta file: packages/richtext-lexical/meta_client.json, Out file: esbuild/exports/client_optimized/index.js
Meta file: packages/ui/meta_client.json, Out file: esbuild/exports/client_optimized/index.js
Meta file: packages/ui/meta_shared.json, Out file: esbuild/exports/shared_optimized/index.js
DetailsNext to the size is how much the size has increased or decreased compared with the base branch of this PR.
|
Resolved conflicts in the 11 read operations that main touched via feat: add base access control (#17662) and the sort-validation change: kept main's `slug` argument to executeAccess and the new validateSortQuery calls, applied on top of this branch's removal of the outer try/catch + killTransaction wrapper.
nathanlentz
reviewed
Aug 13, 2026
…ub.com:payloadcms/payload into fix/trashed-relationship-silent-rollback-17723
nathanlentz
previously approved these changes
Aug 14, 2026
…-relationship-silent-rollback-17723
r1tsuu
enabled auto-merge (squash)
August 17, 2026 12:20
nathanlentz
approved these changes
Aug 17, 2026
Dynogic
added a commit
to Dynogic/payload
that referenced
this pull request
Oct 3, 2026
…ction (backport of upstream v4 payloadcms#17748, 07e8ef3, ported by hand; the 15 operations that never open a transaction drop their try/catch killTransaction, so a read that fails inside a write's hook, e.g. Payload's folder hook swallowing a missing parent, no longer silently discards the write on a replica set or Postgres; killTransaction documents the ownership rule) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RaEpthPEsDF9nb8STBgcLe
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Read operations never call
initTransaction, so they never own a transaction - but every one of them calledkillTransaction(req)in its catch block. Becausereqis shared with the caller, a failed read rolled back the caller's in-flight writes and deletedreq.transactionID.When the caller swallows the error, the damage is silent. A hook doing
payload.findByID(...).catch(() => null)against a trashed doc (issue #17723) kills the transaction opened by the surroundingcreate;createsees no failure and goes on tocommitTransaction(req), which no-ops because the adapter session is already gone. The client gets a 201 with a real doc id and a populated doc, the Postgres sequence advances, and no row is ever written.Removes the
killTransactioncall - and the resulting useless try/catch - from the 14 operations that never open a transaction: collectionfind/findByID/count/countVersions/findVersions/findVersionByID/findDistinct/docAccess, their global equivalents, andauth/access. Errors that propagate are still rolled back by the owning operation's own catch; errors that a hook catches now leave the transaction intact so it commits normally.The diff is mostly re-indentation.
Documents the ownership rule on
killTransactionso it isn't reintroduced.Fixes #17723