diff() nulls parent objects when only nested keys exist

[skanakal]

Setup

• Rancher version: 2.13.1, master
• Rancher UI Extensions: NA
• Browser type & version: Any

Describe the bug

When modifying nested values in rancher-logging chart, specifically hostTailer.workloadMetaOverrides the UI correctly generates the new data but then immediately overwrites the entire object with null during the object diffing process. This results (labels/annotations) failin to save.

To Reproduce

1. Install rancher-logging (rancher-logging 4.10.0-rancher.19)
2. edit helm values and add

logging:
  enabled: true
  fluentbitDisabled: true
  hostTailer:
    enabled: true
    workloadMetaOverrides:
      annotations:
        hello: world
      labels:
        key: hellowrold

3. Save

Result

root@master-0:~# kubectl get hosttailer -A -o yaml
apiVersion: v1
items:
- apiVersion: logging-extensions.banzaicloud.io/v1alpha1
  kind: HostTailer
  metadata:
    annotations:
      meta.helm.sh/release-name: rancher-logging
      meta.helm.sh/release-namespace: cattle-logging-system
    creationTimestamp: "2026-01-21T06:49:53Z"
    generation: 1
    labels:
      app.kubernetes.io/managed-by: Helm
    name: hosttailer
    namespace: cattle-logging-system
    resourceVersion: "532722"
    uid: fa01ff80-d3b4-4e63-8547-21916d896fad
  spec:
    enableRecreateWorkloadOnImmutableFieldChange: false
    image:
      imagePullSecrets: []
    workloadMetaOverrides: {}
    workloadOverrides: {}

Expected Result

root@master-0:~# kubectl get hosttailer -A -o yaml
apiVersion: v1
items:
- apiVersion: logging-extensions.banzaicloud.io/v1alpha1
  kind: HostTailer
  metadata:
    annotations:
      meta.helm.sh/release-name: rancher-logging
      meta.helm.sh/release-namespace: cattle-logging-system
    creationTimestamp: "2026-01-21T06:22:54Z"
    generation: 4
    labels:
      app.kubernetes.io/managed-by: Helm
    name: hosttailer
    namespace: cattle-logging-system
    resourceVersion: "528992"
    uid: 7a0d06d4-f1c9-4e41-bf03-718dc7c13592
  spec:
    enableRecreateWorkloadOnImmutableFieldChange: false
    image:
      imagePullSecrets: []
    workloadMetaOverrides:
      annotations:
         hello: world
      labels:
         key: hellowrold
    workloadOverrides: {}
kind: List

Screenshots

On the rancher UI, edit charts -> rancher-logging -> edit values.yaml

Additional context

[SURE-10926]

[skanakal]

The diff function uses difference() on flat string paths. When an object moved from a empty {}) to a "nested" (having workloadMetaOverrides.labels.key), the original path string disappeared from the definedKeys array. The missing loop interpreted this string disappearance as a deletion and called set(out, k, null), which explicitly nullified the parent one... hence workloadMetaOverrides: null one UI (see the screenshot)

Fix or possible solution:

improves how the diff function handles deep nesting and it adds a safety check to prevent accidental deletions... WDYT?

diff --git a/shell/utils/object.js b/shell/utils/object.js
index 99be7ee599..28d793b6b7 100644
--- a/shell/utils/object.js
+++ b/shell/utils/object.js
@@ -220,8 +220,13 @@ export function diff(from, to, preventNull = false) {
     if ( Array.isArray(toVal) || Array.isArray(fromVal) ) {
       // Don't diff arrays, just use the whole value
       res[k] = toVal;
-    } else if ( isObject(toVal) && isObject(from[k]) ) {
-      res[k] = diff(fromVal, toVal);
+    } else if ( isObject(toVal) && isObject(fromVal) ) {
+      const nested = diff(fromVal, toVal, preventNull);
+
+      // Only assign if there are actual differences
+      if (!isEmpty(nested)) {
+        res[k] = nested;
+      }
     } else {
       res[k] = toVal;
     }
@@ -235,6 +240,14 @@ export function diff(from, to, preventNull = false) {
 
   for ( const k of missing ) {
     // we need to gate this in order to prevent unforseen problems with addonConfig
+    const hasDescendant = toKeys.some(
+      (tk) => tk.startsWith(`${ k }.`)
+    );
+
+    if (hasDescendant) {
+      continue;
+    }
+
     if (preventNull) {

[skanakal]

@aalves08 Can we backport this to 2.14 version?