fix: prevent automatic unhold and approval of held expenses with multiple violations by nabi-ebrahimi · Pull Request #90331 · Expensify/App

nabi-ebrahimi · 2026-05-12T11:58:17Z

Explanation of Change

This change prevents held expenses from being accidentally cleared when dismissing a duplicate-transaction warning.

Previously, dismissing a duplicate violation could merge stale transaction data back into Onyx. If that stale snapshot did not include the latest hold state, an expense that was actually on hold could briefly or permanently appear unheld. The update makes the dismissal merge only the specific duplicate dismissal field instead of rewriting the whole transaction/comment object, preserving unrelated transaction state like holds.

The approval flow was also updated to check for held expenses using the report’s current transaction data instead of relying only on report-level lookup behavior. This keeps the approval blocker aligned with the actual expenses currently loaded for the report.

A regression test was added to cover the stale-snapshot case: when a duplicate dismissal fails and rolls back, the existing hold remains intact while only the duplicate dismissal state is reverted.

Fixed Issues

$ #89429
PROPOSAL: #89429 (comment)

Tests

Open the workspace chat and create an expense report with multiple expenses.
Submit the expense report.
Open the submitted report.
Select one expense using its checkbox.
From the actions menu, place the selected expense on hold.
Click Approve to approve the report.
Verify that an approval modal appears with the following options:
- Approve all expenses
- Approve only unheld expenses and move held expenses to a new report

Verify that no errors appear in the JS console

Offline tests

Same as Tests.

QA Steps

Same as Tests.

// TODO: These must be filled out, or the issue title must include "[No QA]."

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

Android: Native

Recording_20260513_005557.mp4

Android: mWeb Chrome

Recording_20260513_004903.mp4

iOS: Native

Screen.Recording.2026-05-12.at.11.07.34.PM.mov

iOS: mWeb Safari

Screen.Recording.2026-05-12.at.11.12.05.PM.mov

MacOS: Chrome / Safari

Screen.Recording.2026-05-12.at.11.03.22.PM.mov

… violations

codecov · 2026-05-12T12:09:13Z

Codecov Report

✅ Changes either increased or maintained existing code coverage, great job!

Files with missing lines	Coverage Δ
src/libs/actions/Transaction.ts	`71.42% <100.00%> (+0.05%)`	⬆️
...neyReportHeaderPrimaryAction/useConfirmApproval.ts	`0.00% <0.00%> (ø)`
... and 10 files with indirect coverage changes

melvin-bot · 2026-05-12T20:34:15Z

@huult Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

melvin-bot · 2026-05-12T20:34:21Z

@huult @NikkiWines One of you needs to copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

huult · 2026-05-13T02:41:58Z

@nabi-ebrahimi Could you check why the TypeScript check failed?

…-violations

nabi-ebrahimi · 2026-05-13T08:05:56Z

@huult

@nabi-ebrahimi Could you check why the TypeScript check failed?

Fixed the TypeScript check. I added an explicit cast for the test-only stale transaction object because it intentionally uses hold: null, while the normal transaction type does not allow null.

huult · 2026-05-14T04:40:08Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Screen.Recording.2026-05-14.at.12.03.19.mp4

Android: mWeb Chrome

Screen.Recording.2026-05-14.at.12.04.12.mp4

iOS: HybridApp

Screen.Recording.2026-05-14.at.12.07.07.mp4

iOS: mWeb Safari

Screen.Recording.2026-05-14.at.12.08.31.mp4

MacOS: Chrome / Safari

Screen.Recording.2026-05-14.at.11.52.05.mp4

huult · 2026-05-14T05:22:02Z

+                            owner: 123,
+                        },
+                    },
+                    hold: null,


Suggested change

hold: null,

hold: '',

or

Suggested change

hold: null,

hold: undefined,

We don’t need to set hold to null or update the type for it.

Updated. I removed hold: null from the stale test fixture and switched it to undefined so the test still covers the stale snapshot case without widening the production type.

huult · 2026-05-14T05:22:16Z


    /** Whether the transaction is on hold */
-    hold?: string;
+    hold?: string | null;


Suggested change

hold?: string | null;

hold?: string;

Should remove null

Updated. I removed null from the hold type and kept it as hold?: string.

…-violations

nabi-ebrahimi · 2026-05-14T07:08:04Z

@huult, thank you for the review.

I’ve addressed your feedback. The lint error appears to be unrelated to this PR.

huult · 2026-05-15T02:25:17Z

@nabi-ebrahimi could you sync with main?

…oval-held-expense-multi-violations

nabi-ebrahimi · 2026-05-15T04:19:47Z

@nabi-ebrahimi could you sync with main?

@huult, thank you. I have merged the latest changes from main.

huult

LGTM.

NikkiWines

Holding merging pending an internal block atm - will merge once that's cleared

NikkiWines · 2026-05-18T10:36:13Z

@nabi-ebrahimi, I got a notification for a comment about a regression for this PR. Is this ready to be merged?

nabi-ebrahimi · 2026-05-18T11:09:52Z

Hi @NikkiWines, thanks for checking. This is not a regression — the reported behavior is unrelated to this PR. The PR has been tested and is ready to be merged.

@nabi-ebrahimi, I got a notification for a comment about a regression for this PR. Is this ready to be merged?

github-actions · 2026-05-18T11:22:56Z

🚧 @NikkiWines has triggered a test Expensify/App build. You can view the workflow run here.

github-actions · 2026-05-18T11:27:10Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #90331.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-69fd95a-123ad41-ff47f9760640c80b9f590c6fae5b5dcc7e17bb77/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-69fd95a-123ad41-52ab6946969630b4d741f8e412f0880a1421b07d/index.html

Web 🕸️
https://90331.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

OSBotify · 2026-05-18T11:29:58Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2026-05-19T08:08:02Z

🚀 Deployed to staging by https://github.com/NikkiWines in version: 9.3.76-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	cancelled 🔪
🍎 iOS 🍎	cancelled 🔪

MelvinBot · 2026-05-19T08:10:53Z

No help site changes required.

This PR is a bug fix that corrects internal behavior to match what the help site already documents:

Approve-Expenses.md already correctly describes the approval modal options for reports with held expenses
How-to-Find-and-Resolve-Flagged-Duplicate-Expenses.md already correctly describes the duplicate resolution flow

The fix ensures held expenses stay held when dismissing duplicate violations, and that the approval flow properly detects holds — both behaviors were already documented correctly. No new features, UI changes, or workflow changes were introduced.

OSBotify · 2026-05-19T22:00:36Z

🚀 Deployed to production by https://github.com/roryabraham in version: 9.3.77-3 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

fix: prevent auto-unhold and approval for held expenses with multiple…

aa87e91

… violations

melvin-bot Bot assigned nabi-ebrahimi May 12, 2026

nabi-ebrahimi marked this pull request as ready for review May 12, 2026 20:34

nabi-ebrahimi requested review from a team as code owners May 12, 2026 20:34

melvin-bot Bot requested review from heyjennahay and huult and removed request for a team and huult May 12, 2026 20:34

melvin-bot Bot requested review from a team, NikkiWines and huult and removed request for a team May 12, 2026 20:34

nabi-ebrahimi added 2 commits May 13, 2026 07:25

Merge branch 'main' into fix/prevent-auto-approval-held-expense-multi…

f8e6918

…-violations

Fixed type error

63b461a

huult reviewed May 14, 2026

View reviewed changes

nabi-ebrahimi added 2 commits May 14, 2026 06:42

Merge branch 'main' into fix/prevent-auto-approval-held-expense-multi…

6e14395

…-violations

Addressed hold type and stale test fixture comments

002f534

NikkiWines requested a review from huult May 14, 2026 16:35

Merge remote-tracking branch 'origin/main' into fix/prevent-auto-appr…

20434e3

…oval-held-expense-multi-violations

huult approved these changes May 15, 2026

View reviewed changes

NikkiWines approved these changes May 15, 2026

View reviewed changes

NikkiWines merged commit 69fd95a into Expensify:main May 18, 2026
38 checks passed

OSBotify mentioned this pull request May 19, 2026

Deploy Checklist: New Expensify 2026-05-19 #91039

Closed

75 tasks

melvin-bot Bot mentioned this pull request May 19, 2026

[Due for payment 2026-05-26] [$250] Held Expense with Multiple Violations Is Automatically Unheld and Approved Without Prompt #89429

Open

7 tasks

Conversation

nabi-ebrahimi commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

codecov Bot commented May 12, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

melvin-bot Bot commented May 12, 2026

Uh oh!

melvin-bot Bot commented May 12, 2026

Uh oh!

huult commented May 13, 2026

Uh oh!

nabi-ebrahimi commented May 13, 2026

Uh oh!

huult commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

huult May 14, 2026

Choose a reason for hiding this comment

Uh oh!

nabi-ebrahimi May 14, 2026

Choose a reason for hiding this comment

Uh oh!

huult May 14, 2026

Choose a reason for hiding this comment

Uh oh!

nabi-ebrahimi May 14, 2026

Choose a reason for hiding this comment

Uh oh!

nabi-ebrahimi commented May 14, 2026

Uh oh!

huult commented May 15, 2026

Uh oh!

nabi-ebrahimi commented May 15, 2026

Uh oh!

huult left a comment

Choose a reason for hiding this comment

Uh oh!

NikkiWines left a comment

Choose a reason for hiding this comment

Uh oh!

NikkiWines commented May 18, 2026

Uh oh!

nabi-ebrahimi commented May 18, 2026

Uh oh!

Uh oh!

github-actions Bot commented May 18, 2026

Uh oh!

github-actions Bot commented May 18, 2026

Uh oh!

OSBotify commented May 18, 2026

Uh oh!

OSBotify commented May 19, 2026

Uh oh!

MelvinBot commented May 19, 2026

Uh oh!

OSBotify commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nabi-ebrahimi commented May 12, 2026 •

edited

Loading

codecov Bot commented May 12, 2026 •

edited by github-actions Bot

Loading

huult commented May 14, 2026 •

edited

Loading