Index: upstream issues & unreported defects this fork addresses

[cliedeman]

Master index of everything this fork is carrying ahead of upstream. Each row is one concern (a fork PR), with a short description and the upstream (ChilliCream/graphql-platform) issue/PR it addresses. Items marked No upstream issue yet are defects this fork found that are not reported in the core repo (per the request, those are listed too).

Companion trackers: codegen/fuzzing batch #13, generator performance #17, reviewer reading guide #21.

Legend: ✅ fix shipped · 🟡 characterization/analysis only · 🧪 regression guard (already fixed on main) · ⛔ closed/superseded.

---

1. Strawberry Shake — codegen correctness: fragments / interfaces / unions

Found via a differential codegen fuzzer (graphql-js validity oracle → CSharpGenerator.Generate → Roslyn compile). Tracker: #13.

Fork PR	Description	Upstream
#9 ✅	Composite (object/interface) field selected both directly and via a fragment at the same level throws Could not find an output type for the specified field syntax.	No upstream issue yet
#7 ✅	Same named fragment spread ≥2× in one selection set emits a duplicate base interface → generated C# fails with CS0528 already listed in interface list.	No upstream issue yet
#8 ✅	Union members selected through a named fragment on the abstract type generate empty member classes (fields dropped, only __typename survives).	Fixes #5992
#10 🟡	Same named fragment spread across two operations produces two divergently named per-op models instead of one shared model (characterizing test + analysis only).	Relates #6873
#15 🧪	Schema inheritance (two types sharing an interface base) once emitted a duplicate base class (HC0065). No longer reproduces on main; PR locks it in with a regression guard.	Relates #5593

2. Strawberry Shake — runtime: result deserialization / entity store

Fork PR	Description	Upstream
#11 ✅	An entity referenced more than once with different selection sets loses data after deserialization (root cause behind the inline-fragment-ordering report).	Fixes #8063
#12 ✅	An unknown concrete __typename (union/interface member added server-side after generation) throws NotSupportedException and fails the entire result; now degrades gracefully to null in nullable positions.	Fixes #6415

3. Strawberry Shake — operation/service generation: uploads

Fork PR	Description	Upstream
#14 ✅	More than one Upload-typed field emits uncompilable C#: reused local u (CS0128) and a duplicate MapFilesFromType<T> member.	Fixes #9559, #7852

4. Strawberry Shake — generator performance (large clients)

Profiled on a real 703-operation client. Tracker: #17. No upstream issues filed for these.

Fork PR	Description	Upstream
#20 ✅	TypeDescriptorMapper is O(N²) in operation count (linear scans per field); index descriptor lookups → flat with N (up to ~10× faster).	No upstream issue yet (fork #17)
#18 ✅	DataTypeDescriptorMapper scales super-quadratically; index data-type components by runtime name.	No upstream issue yet (fork #17)
#19 ✅	Single-file output calls NormalizeWhitespace over one giant tree (super-linear + OOM); format per namespace, byte-identical output.	No upstream issue yet (fork #17)
no PR yet	HC0107 field-merge validation wall: the merged-document OverlappingFieldsCanBeMergedRule exhausts its 100k-comparison budget at ~280–300 ops, so a large client cannot even be analyzed. Fix (raise/skip the budget for codegen) validated but not yet a PR.	No upstream issue yet (fork #17)

5. Razor / Blazor

Fork PR	Description	Upstream
#3 ✅	Generated Use* components inject the concrete runtime type instead of the operation interface, so they can't be mocked in bUnit.	PR #9636, fixes #9635
#2 ✅	Persist IOperationResult<T> across the Blazor prerender → interactive boundary via .NET 10 [PersistentState] (results are interfaces backed by the entity store and don't round-trip through System.Text.Json).	Relates #7209
#1 ⛔	Earlier reactive UsePersistentQuery<T> approach to the same goal; closed as the wrong direction, superseded by #2.	Relates #7209
#16 ✅	Subscriptions over SSE only stream after the connection closes on Blazor WASM (browser HttpClient buffers the body); enable per-request response streaming for subscriptions.	Refs #6944, #8555

6. HotChocolate — validation defects (differential fuzzing)

From a differential fuzzer diffing HotChocolate's default rules against graphql-js v17 (PR #6, research branch). All four findings are unreported upstream.

Item	Description	Upstream
#6 (1)	Int literals not 32-bit range-checked (out-of-range integers accepted at every literal position).	No upstream issue yet
#6 (2)	Most severe: a list literal given to an input-object argument makes HC report the entire document valid, masking every other error (ValueVisitor/VariableVisitor Break without ReportError).	No upstream issue yet
#6 (3)	ScalarLeafs not enforced on __typename under abstract types ({ pet { __typename { x } } } accepted).	No upstream issue yet
#6 (4)	Directive arguments not validated on __typename (@skip with no/wrong/ill-typed args accepted).	No upstream issue yet

7. HotChocolate — authorization

Fork PR	Description	Upstream
#22 ✅	The UserState → Features migration (ChilliCream#8267/ChilliCream#8329) broke consumers that pass a ready-made UserState via ContextData under the legacy key — notably the in-memory Strawberry Shake client (manual user injection), which silently deauthenticated. Restores the legacy fallback.	No upstream issue yet (regression from #8267/#8329)

8. Fork infrastructure (not upstream concerns)

Listed for completeness; these enable the fork itself and have no upstream equivalent.

Fork PR	Description
#4	Fork release publisher on the default branch (packs/pushes the renamed Stackworx.StrawberryShake.* packages via NuGet trusted publishing).
#5	bUnit smoke test + package-scoped fork CI (ci-fork.yml).

---

🤖 Generated with Claude Code