From c62c74b1b83b7a40afea5019117141da237f5796 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 21:32:46 +0000
Subject: [PATCH] bug: return 404 instead of crashing when updating a missing
 todo

exports.update dereferenced todo without checking err or null, so
POST /update/<unknown id> threw inside the Mongo callback and killed the
process. Return next(err) on DB error and 404 when the todo is missing.
sarif.json routes/index.js anchors after line 219 shifted by 2.

Refs: sfind-036662fe9eae4ebbb6c944fc5bf559eb
---
 routes/index.js |  2 ++
 sarif.json      | 16 ++++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/routes/index.js b/routes/index.js
index 6b5455f03e4..8392fe75181 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -217,6 +217,8 @@ exports.edit = function (req, res, next) {
 
 exports.update = function (req, res, next) {
   Todo.findById(req.params.id, function (err, todo) {
+    if (err) return next(err);
+    if (!todo) return res.status(404).send('Todo not found');
 
     todo.content = req.body.content;
     todo.updated_at = Date.now();
diff --git a/sarif.json b/sarif.json
index 60dd725676e..f4fd459ecf9 100644
--- a/sarif.json
+++ b/sarif.json
@@ -1881,7 +1881,7 @@
                 },
                 "region": {
                   "startLine": 166,
-                  "endLine": 221,
+                  "endLine": 223,
                   "startColumn": 18,
                   "endColumn": 1
                 }
@@ -1907,7 +1907,7 @@
                           },
                           "region": {
                             "startLine": 166,
-                            "endLine": 221,
+                            "endLine": 223,
                             "startColumn": 18,
                             "endColumn": 1
                           }
@@ -1978,8 +1978,8 @@
                   "uriBaseId": "%SRCROOT%"
                 },
                 "region": {
-                  "startLine": 223,
-                  "endLine": 231,
+                  "startLine": 225,
+                  "endLine": 233,
                   "startColumn": 21,
                   "endColumn": 1
                 }
@@ -2004,8 +2004,8 @@
                             "uriBaseId": "%SRCROOT%"
                           },
                           "region": {
-                            "startLine": 223,
-                            "endLine": 231,
+                            "startLine": 225,
+                            "endLine": 233,
                             "startColumn": 21,
                             "endColumn": 1
                           }
@@ -2021,8 +2021,8 @@
                             "uriBaseId": "%SRCROOT%"
                           },
                           "region": {
-                            "startLine": 225,
-                            "endLine": 225,
+                            "startLine": 227,
+                            "endLine": 227,
                             "startColumn": 21,
                             "endColumn": 36
                           }