From 2ad4ea078a1efc30298afe684bb6688dcde10082 Mon Sep 17 00:00:00 2001
From: Tomas Hykel <mail@thykel.cz>
Date: Tue, 26 May 2026 22:52:38 +0200
Subject: [PATCH 1/3] fix(ui): Numeric ID instead of semantic one on the error
 message on bulk edit (WP #74928)

---
 app/views/work_packages/bulk/_errors.html.erb |  6 +++--
 .../work_packages/bulk_controller_spec.rb     | 23 +++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/app/views/work_packages/bulk/_errors.html.erb b/app/views/work_packages/bulk/_errors.html.erb
index 720e063cdd4..6ed5bf295b5 100644
--- a/app/views/work_packages/bulk/_errors.html.erb
+++ b/app/views/work_packages/bulk/_errors.html.erb
@@ -31,10 +31,12 @@
 
 <ul>
   <% erroneous_results.each do |call| %>
-    <% wp_id = call.state.copied_from_work_package_id || call.result.id %>
+    <% source_id = call.state.copied_from_work_package_id %>
+    <% wp = source_id ? WorkPackage.find_by(id: source_id) : call.result %>
+    <% wp_id = wp&.id || call.result.id %>
 
     <li>
-      <%= link_to "##{wp_id}", work_package_path(wp_id) %><%= selected_work_packages.map(&:id).include?(wp_id) ? "" : " (#{I18n.t('work_packages.bulk.descendant')})" %>:
+      <%= link_to wp&.formatted_id || "##{wp_id}", work_package_path(wp_id) %><%= selected_work_packages.map(&:id).include?(wp_id) ? "" : " (#{I18n.t('work_packages.bulk.descendant')})" %>:
       <%= safe_join call.errors.full_messages, " " %>
     </li>
   <% end %>
diff --git a/spec/controllers/work_packages/bulk_controller_spec.rb b/spec/controllers/work_packages/bulk_controller_spec.rb
index 72c297a2b98..8754bc387e7 100644
--- a/spec/controllers/work_packages/bulk_controller_spec.rb
+++ b/spec/controllers/work_packages/bulk_controller_spec.rb
@@ -583,6 +583,29 @@ RSpec.describe WorkPackages::BulkController, with_settings: { journal_aggregatio
       end
     end
 
+    context "with semantic identifiers",
+            with_settings: { work_packages_identifier: "semantic" } do
+      before do
+        work_package1.update_columns(identifier: "PROJ-1", sequence_number: 1)
+        work_package2.update_columns(identifier: "PROJ-2", sequence_number: 2)
+        put :update,
+            params: {
+              ids: work_package_ids,
+              work_package: { done_ratio: 150 }
+            }
+      end
+
+      it "shows semantic identifiers in the error flash" do
+        expect(flash[:error]).to include("PROJ-1")
+        expect(flash[:error]).to include("PROJ-2")
+      end
+
+      it "does not show bare numeric ids in the error flash" do
+        expect(flash[:error]).not_to include("##{work_package1.id}")
+        expect(flash[:error]).not_to include("##{work_package2.id}")
+      end
+    end
+
     describe "updating two children with dates to a new parent (Regression #28670)" do
       let(:task1) do
         create(:work_package,

From 1a1da55c6786b14fb95f53c3f63fa7dad2ff549f Mon Sep 17 00:00:00 2001
From: Tom Hykel <mail@thykel.cz>
Date: Tue, 26 May 2026 23:53:29 +0200
Subject: [PATCH 2/3] Potential fix for pull request finding 'CodeQL / Database
 query in a loop'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 app/views/work_packages/bulk/_errors.html.erb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/views/work_packages/bulk/_errors.html.erb b/app/views/work_packages/bulk/_errors.html.erb
index 6ed5bf295b5..cab02bd8e90 100644
--- a/app/views/work_packages/bulk/_errors.html.erb
+++ b/app/views/work_packages/bulk/_errors.html.erb
@@ -3,6 +3,9 @@
   error_count = erroneous_results.count
   total_count = service_result.dependent_results.map(&:result).uniq.count
   selected_count = selected_work_packages.count
+  selected_ids = selected_work_packages.map(&:id)
+  source_ids = erroneous_results.map { |call| call.state.copied_from_work_package_id }.compact.uniq
+  source_work_packages_by_id = source_ids.any? ? WorkPackage.where(id: source_ids).index_by(&:id) : {}
 %>
 
 <% if total_count - error_count == 0 %>
@@ -32,11 +35,11 @@
 <ul>
   <% erroneous_results.each do |call| %>
     <% source_id = call.state.copied_from_work_package_id %>
-    <% wp = source_id ? WorkPackage.find_by(id: source_id) : call.result %>
+    <% wp = source_id ? source_work_packages_by_id[source_id] : call.result %>
     <% wp_id = wp&.id || call.result.id %>
 
     <li>
-      <%= link_to wp&.formatted_id || "##{wp_id}", work_package_path(wp_id) %><%= selected_work_packages.map(&:id).include?(wp_id) ? "" : " (#{I18n.t('work_packages.bulk.descendant')})" %>:
+      <%= link_to wp&.formatted_id || "##{wp_id}", work_package_path(wp_id) %><%= selected_ids.include?(wp_id) ? "" : " (#{I18n.t('work_packages.bulk.descendant')})" %>:
       <%= safe_join call.errors.full_messages, " " %>
     </li>
   <% end %>

From 0df08645b1d5925c054b79348a355b8160e65571 Mon Sep 17 00:00:00 2001
From: Tomas Hykel <mail@thykel.cz>
Date: Tue, 2 Jun 2026 16:45:07 +0200
Subject: [PATCH 3/3] review feedback

---
 app/views/work_packages/bulk/_errors.html.erb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/work_packages/bulk/_errors.html.erb b/app/views/work_packages/bulk/_errors.html.erb
index cab02bd8e90..66eab8760e6 100644
--- a/app/views/work_packages/bulk/_errors.html.erb
+++ b/app/views/work_packages/bulk/_errors.html.erb
@@ -5,7 +5,7 @@
   selected_count = selected_work_packages.count
   selected_ids = selected_work_packages.map(&:id)
   source_ids = erroneous_results.map { |call| call.state.copied_from_work_package_id }.compact.uniq
-  source_work_packages_by_id = source_ids.any? ? WorkPackage.where(id: source_ids).index_by(&:id) : {}
+  source_work_packages_by_id = source_ids.any? ? WorkPackage.visible.where_display_id_in(*source_ids).index_by(&:id) : {}
 %>
 
 <% if total_count - error_count == 0 %>
@@ -39,7 +39,7 @@
     <% wp_id = wp&.id || call.result.id %>
 
     <li>
-      <%= link_to wp&.formatted_id || "##{wp_id}", work_package_path(wp_id) %><%= selected_ids.include?(wp_id) ? "" : " (#{I18n.t('work_packages.bulk.descendant')})" %>:
+      <%= link_to wp&.formatted_id || "##{wp_id}", work_package_path(wp) %><%= selected_ids.include?(wp_id) ? "" : " (#{I18n.t('work_packages.bulk.descendant')})" %>:
       <%= safe_join call.errors.full_messages, " " %>
     </li>
   <% end %>