From 184ad29b8ad4c28dc35184559c2f8ace38a0e6c9 Mon Sep 17 00:00:00 2001
From: ncttjz <phucnop37@gmail.com>
Date: Tue, 7 Jul 2026 15:47:03 +0700
Subject: [PATCH 1/2] fix: return 400 when environment is null in featurestate
 update

Add null check in validate_environment to prevent AttributeError crash
when a null environment is passed in the payload to
/api/v1/features/featurestates/{pk}/.

Fixes #6597
---
 api/features/serializers.py                   |  4 ++++
 .../unit/features/test_unit_features_views.py | 24 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/api/features/serializers.py b/api/features/serializers.py
index 08dad4020b1c..ca0cc85c7632 100644
--- a/api/features/serializers.py
+++ b/api/features/serializers.py
@@ -728,6 +728,10 @@ def validate_feature(self, feature):  # type: ignore[no-untyped-def]
         return feature
 
     def validate_environment(self, environment):  # type: ignore[no-untyped-def]
+        if environment is None:
+            raise serializers.ValidationError(
+                "Environment may not be null."
+            )
         if self.instance and self.instance.environment_id != environment.id:  # type: ignore[union-attr]
             raise serializers.ValidationError(
                 "Cannot change the environment of a feature state"
diff --git a/api/tests/unit/features/test_unit_features_views.py b/api/tests/unit/features/test_unit_features_views.py
index 26b85fdbdc5d..c6f42c9352b2 100644
--- a/api/tests/unit/features/test_unit_features_views.py
+++ b/api/tests/unit/features/test_unit_features_views.py
@@ -3246,6 +3246,30 @@ def test_update_feature_state__change_feature__returns_400(
     )
 
 
+def test_update_feature_state__null_environment__returns_400(
+    admin_client_new: APIClient,
+    environment: Environment,
+    feature: Feature,
+    feature_state: FeatureState,
+) -> None:
+    # Given
+    url = reverse("api-v1:features:featurestates-detail", args=[feature_state.id])
+    data = {
+        "enabled": True,
+        "environment": None,
+        "feature": feature.id,
+    }
+
+    # When
+    response = admin_client_new.put(
+        url, data=json.dumps(data), content_type="application/json"
+    )
+
+    # Then
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+    assert "environment" in response.json()
+
+
 @pytest.mark.parametrize(
     "client",
     [lazy_fixture("admin_master_api_key_client"), lazy_fixture("admin_client")],

From 30e4990a8688dbfd711b21624eda0168f0400631 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 08:48:47 +0000
Subject: [PATCH 2/2] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 api/features/serializers.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/api/features/serializers.py b/api/features/serializers.py
index ca0cc85c7632..eb6cda2a003c 100644
--- a/api/features/serializers.py
+++ b/api/features/serializers.py
@@ -729,9 +729,7 @@ def validate_feature(self, feature):  # type: ignore[no-untyped-def]
 
     def validate_environment(self, environment):  # type: ignore[no-untyped-def]
         if environment is None:
-            raise serializers.ValidationError(
-                "Environment may not be null."
-            )
+            raise serializers.ValidationError("Environment may not be null.")
         if self.instance and self.instance.environment_id != environment.id:  # type: ignore[union-attr]
             raise serializers.ValidationError(
                 "Cannot change the environment of a feature state"