Skip to content

fix(router): fix gRPC nested fields mapping inside inline fragments #2584

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dkorittki merged 10 commits into from
Mar 6, 2026
Merged

fix(router): fix gRPC nested fields mapping inside inline fragments #2584

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
f140ff6
chore: update router go.mod to use engine change
dkorittki Mar 4, 2026
d23b269
chore: add tests to verify engine fix
dkorittki Mar 5, 2026
283a1b9
Merge branch 'main' into dominik/eng-9083-test-for-regression-in-router
dkorittki Mar 5, 2026
4248ff4
chore: use latest engine version
dkorittki Mar 5, 2026
4f3fcb5
chore: add CVE-2025-15558 to trivy ignore
dkorittki Mar 5, 2026
3e3b7b6
chore: rephrase
dkorittki Mar 5, 2026
611adae
chore: rephrase
dkorittki Mar 5, 2026
bb6726b
Merge branch 'main' into dominik/eng-9083-test-for-regression-in-router
dkorittki Mar 6, 2026
2d8aaf5
chore: remove CVE-2026-24051 from trivy ignore
dkorittki Mar 6, 2026
e53c0ee
Merge branch 'main' into dominik/eng-9083-test-for-regression-in-router
dkorittki Mar 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion .trivyignore.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,10 @@
vulnerabilities:
- id: CVE-2026-24051
statement: Intended to be fixed in `ENG-9057`. The vulnerability happens on macOS/Darwin, as most images are used on Linux machines, we're ok with making this compromise. This was discussed with the team and OK'ed.

- id: CVE-2025-15558
statement: >
Windows-only vulnerability in github.com/docker/cli (dependency of go-containerregistry in router).
Per the CVE description, "this issue does not impact non-Windows binaries".
Most images are used on Linux.
Updating go-containerregistry fixes the issue but expects us to set router go version to 1.25.6 for a fix on a sparsely used platform.
This can be reevaluated once we update to go 1.25.6 / 1.26.
2 changes: 1 addition & 1 deletion router-tests/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ require (
github.com/wundergraph/cosmo/demo/pkg/subgraphs/projects v0.0.0-20250715110703-10f2e5f9c79e
github.com/wundergraph/cosmo/router v0.0.0-20260213130455-6e3277e7b850
github.com/wundergraph/cosmo/router-plugin v0.0.0-20250808194725-de123ba1c65e
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258
go.opentelemetry.io/otel v1.36.0
go.opentelemetry.io/otel/sdk v1.36.0
go.opentelemetry.io/otel/sdk/metric v1.36.0
Expand Down
4 changes: 2 additions & 2 deletions router-tests/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -356,8 +356,8 @@ github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLV
github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw=
github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc=
github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257 h1:hGsaKXRkH3o8DkyizY48/wC1Q+NB1nfD9EKVA7Gc81Y=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258 h1:Cf3kkNDUlQPWNJi3kwF1UqUbUIxMnk5NN3ST7hGI4ow=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8=
github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg=
github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
Expand Down
5 changes: 5 additions & 0 deletions router-tests/grpc_subgraph_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,11 @@ func TestGRPCSubgraph(t *testing.T) {
query: `{ project(id: 2) { id name urgent: topPriorityItem(category: "task") { __typename } nextDeadline: criticalDeadline(withinDays: 10000) { __typename } subsub: subProjects { id name status otherSubs: subProjects { id name } } } }`,
expected: `{"data":{"project":{"id":"2","name":"Microservices Revolution","urgent":{"__typename":"Task"},"nextDeadline":{"__typename":"Milestone"},"subsub":[{"id":"4","name":"DevOps Transformation","status":"PLANNING","otherSubs":[{"id":"1","name":"Cloud Migration Overhaul"}]},{"id":"5","name":"Security Overhaul","status":"ON_HOLD","otherSubs":[{"id":"2","name":"Microservices Revolution"}]}]}}}`,
},
{
name: "query project resources with complex types inside inline fragments",
query: `query { projectResources(projectId: "1") { ... on Milestone { id name dependencies { id name } } ... on Task { id name subtasks { id name } } } }`,
expected: `{"data":{"projectResources":[{},{},{},{},{"id":"1","name":"Infrastructure Assessment","dependencies":[]},{"id":"2","name":"Cloud Environment Setup","dependencies":[{"id":"1","name":"Infrastructure Assessment"},{"id":"","name":""}]},{"id":"3","name":"Application Migration","dependencies":[{"id":"2","name":"Cloud Environment Setup"},{"id":"","name":""}]},{"id":"1","name":"Current Infrastructure Audit","subtasks":[{"id":"1a","name":"Server Inventory"},{"id":"1b","name":"Database Inventory"},{"id":"","name":""}]},{"id":"2","name":"Cloud Provider Selection","subtasks":null},{"id":"3","name":"Network Setup","subtasks":[{"id":"3a","name":"VPC Configuration"},{"id":"3b","name":"Security Groups"},{"id":"","name":""}]},{"id":"14","name":"Database Migration","subtasks":[]}]}}`,
},
}
testenv.Run(t, &testenv.Config{
RouterConfigJSONTemplate: testenv.ConfigWithGRPCJSONTemplate,
Expand Down
5 changes: 5 additions & 0 deletions router-tests/router_plugin_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -455,6 +455,11 @@ func TestRouterPluginRequests(t *testing.T) {
query: `{ project(id: 2) { id name urgent: topPriorityItem(category: "task") { __typename } nextDeadline: criticalDeadline(withinDays: 10000) { __typename } subsub: subProjects { id name status otherSubs: subProjects { id name } } } }`,
expected: `{"data":{"project":{"id":"2","name":"Microservices Revolution","urgent":{"__typename":"Task"},"nextDeadline":{"__typename":"Milestone"},"subsub":[{"id":"4","name":"DevOps Transformation","status":"PLANNING","otherSubs":[{"id":"1","name":"Cloud Migration Overhaul"}]},{"id":"5","name":"Security Overhaul","status":"ON_HOLD","otherSubs":[{"id":"2","name":"Microservices Revolution"}]}]}}}`,
},
{
name: "query project resources with complex types inside inline fragments",
query: `query { projectResources(projectId: "1") { ... on Milestone { id name dependencies { id name } } ... on Task { id name subtasks { id name } } } }`,
expected: `{"data":{"projectResources":[{},{},{},{},{"id":"1","name":"Infrastructure Assessment","dependencies":[]},{"id":"2","name":"Cloud Environment Setup","dependencies":[{"id":"1","name":"Infrastructure Assessment"},{"id":"","name":""}]},{"id":"3","name":"Application Migration","dependencies":[{"id":"2","name":"Cloud Environment Setup"},{"id":"","name":""}]},{"id":"1","name":"Current Infrastructure Audit","subtasks":[{"id":"1a","name":"Server Inventory"},{"id":"1b","name":"Database Inventory"},{"id":"","name":""}]},{"id":"2","name":"Cloud Provider Selection","subtasks":null},{"id":"3","name":"Network Setup","subtasks":[{"id":"3a","name":"VPC Configuration"},{"id":"3b","name":"Security Groups"},{"id":"","name":""}]},{"id":"14","name":"Database Migration","subtasks":[]}]}}`,
},
}
testenv.Run(t, &testenv.Config{
RouterConfigJSONTemplate: testenv.ConfigWithPluginsJSONTemplate,
Expand Down
2 changes: 1 addition & 1 deletion router/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ require (
github.com/tidwall/gjson v1.18.0
github.com/tidwall/sjson v1.2.5
github.com/twmb/franz-go v1.16.1
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258
// Do not upgrade, it renames attributes we rely on
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0
go.opentelemetry.io/contrib/propagators/b3 v1.23.0
Expand Down
4 changes: 2 additions & 2 deletions router/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,8 +328,8 @@ github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLV
github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw=
github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc=
github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257 h1:hGsaKXRkH3o8DkyizY48/wC1Q+NB1nfD9EKVA7Gc81Y=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258 h1:Cf3kkNDUlQPWNJi3kwF1UqUbUIxMnk5NN3ST7hGI4ow=
github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8=
github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
Expand Down
Loading