Security tab not working after updating from 1.8.1 to 1.9.0

[leoslamas]

👟 Reproduction steps

When I click the Auth/Security tab, it doesn't open. I've upgraded from 1.8.1 to 1.9.0, and I can reproduce everytime, having an 1.8.1 installation and upgrading to 1.9.0 (following the official steps)

👍 Expected behavior

To open all the configuration at "Security" tab page.

👎 Actual Behavior

The pink loading bar appears but nothing happens, and the console shows this when I click "Security":

CmVFoSLP.js:1 Uncaught TypeError: Cannot read properties of null (reading 'group')
    at V7AL4vJL.js:4455:2260
    at Array.filter (<anonymous>)
    at G9 (V7AL4vJL.js:4455:2248)
    at q9 (V7AL4vJL.js:4455:2399)
    at V7AL4vJL.js:291:10045
    at Q (CmVFoSLP.js:1:29591)
    at CmVFoSLP.js:1:24240
    at Zr (CmVFoSLP.js:1:27430)
    at ei (CmVFoSLP.js:1:28480)
    at B (CmVFoSLP.js:1:23332)

🎲 Appwrite version

Different version (specify in environment)

💻 Operating system

Linux

🧱 Your Environment

Hetzner CX22. Appwrite 1.9.0 (migrated from 1.8.1)

👀 Have you spent some time to check if this issue has been raised before?

• I checked and didn't find similar issue

🏢 Have you read the Code of Conduct?

• I have read the Code of Conduct

[WhoamiI00]

Hey, took a look at this and opened #3077 but want to be upfront — I couldn't actually pin down the exact line your stack trace points at, so it might not be the literal fix.

Here's what I found digging through the code. The Security page hits project.listPolicies() and immediately does .map((policy) => [policy.$id, policy]) on the result, so a single null entry there would blow up before anything renders. The passwordPolicies component also reads .total / .enabled directly on policies that +page.ts casts without checking they exist — which would explode too if a 1.8.1→1.9.0 migration left some policies missing. Both seem like plausible upgrade-only failure modes that wouldn't reproduce on a fresh 1.9 install.

But — null.group specifically. I grepped every .filter() that touches .group in the repo and the only matches are cloud-only billing code (planComparisonBox, billing.ts) which shouldn't run on self-hosted. None of the policy models in @appwrite.io/console declare a group field either. Your stack trace lands in V7AL4vJL.js:4455:2260 which is minified prod JS without source maps, so I can't tell where it's actually throwing.

If you can run the console in dev (bun run dev against your upgraded backend) you'll get an unminified trace pointing at the real line, and we can fix that directly. In the meantime #3077 should at least stop the page going blank for anyone whose policy list is incomplete after the migration, even if it isn't the root cause of the null.group you're seeing.