From f140ff69c52f563b7c74fe0a5a6788274c331ed9 Mon Sep 17 00:00:00 2001 From: Dominik Korittki <23359034+dkorittki@users.noreply.github.com> Date: Wed, 4 Mar 2026 15:20:07 +0100 Subject: [PATCH 1/7] chore: update router go.mod to use engine change --- router-tests/go.mod | 2 +- router-tests/go.sum | 4 ++-- router/go.mod | 2 +- router/go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/router-tests/go.mod b/router-tests/go.mod index 251d8af3c0..46a4f29f04 100644 --- a/router-tests/go.mod +++ b/router-tests/go.mod @@ -27,7 +27,7 @@ require ( github.com/wundergraph/cosmo/demo/pkg/subgraphs/projects v0.0.0-20250715110703-10f2e5f9c79e github.com/wundergraph/cosmo/router v0.0.0-20260213130455-6e3277e7b850 github.com/wundergraph/cosmo/router-plugin v0.0.0-20250808194725-de123ba1c65e - github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257 + github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb go.opentelemetry.io/otel v1.36.0 go.opentelemetry.io/otel/sdk v1.36.0 go.opentelemetry.io/otel/sdk/metric v1.36.0 diff --git a/router-tests/go.sum b/router-tests/go.sum index 2c12b0b234..cff45d78b3 100644 --- a/router-tests/go.sum +++ b/router-tests/go.sum @@ -356,8 +356,8 @@ github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLV github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw= github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc= github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257 h1:hGsaKXRkH3o8DkyizY48/wC1Q+NB1nfD9EKVA7Gc81Y= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb h1:+vwm85gNfiq2rNl652/lHoURn64MTdLwR/TVOdyTVck= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg= github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM= github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4= diff --git a/router/go.mod b/router/go.mod index 7519ebbf65..3e9e84dff9 100644 --- a/router/go.mod +++ b/router/go.mod @@ -31,7 +31,7 @@ require ( github.com/tidwall/gjson v1.18.0 github.com/tidwall/sjson v1.2.5 github.com/twmb/franz-go v1.16.1 - github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257 + github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb // Do not upgrade, it renames attributes we rely on go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 go.opentelemetry.io/contrib/propagators/b3 v1.23.0 diff --git a/router/go.sum b/router/go.sum index ad42d0211f..1c1ae8deda 100644 --- a/router/go.sum +++ b/router/go.sum @@ -328,8 +328,8 @@ github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLV github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw= github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc= github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257 h1:hGsaKXRkH3o8DkyizY48/wC1Q+NB1nfD9EKVA7Gc81Y= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb h1:+vwm85gNfiq2rNl652/lHoURn64MTdLwR/TVOdyTVck= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4= github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= From d23b2692299e15a28417da75f53e2e4ed2e0df2d Mon Sep 17 00:00:00 2001 From: Dominik Korittki <23359034+dkorittki@users.noreply.github.com> Date: Thu, 5 Mar 2026 10:01:12 +0100 Subject: [PATCH 2/7] chore: add tests to verify engine fix --- router-tests/grpc_subgraph_test.go | 5 +++++ router-tests/router_plugin_test.go | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/router-tests/grpc_subgraph_test.go b/router-tests/grpc_subgraph_test.go index 4871423266..54f5f56bcb 100644 --- a/router-tests/grpc_subgraph_test.go +++ b/router-tests/grpc_subgraph_test.go @@ -264,6 +264,11 @@ func TestGRPCSubgraph(t *testing.T) { query: `{ project(id: 2) { id name urgent: topPriorityItem(category: "task") { __typename } nextDeadline: criticalDeadline(withinDays: 10000) { __typename } subsub: subProjects { id name status otherSubs: subProjects { id name } } } }`, expected: `{"data":{"project":{"id":"2","name":"Microservices Revolution","urgent":{"__typename":"Task"},"nextDeadline":{"__typename":"Milestone"},"subsub":[{"id":"4","name":"DevOps Transformation","status":"PLANNING","otherSubs":[{"id":"1","name":"Cloud Migration Overhaul"}]},{"id":"5","name":"Security Overhaul","status":"ON_HOLD","otherSubs":[{"id":"2","name":"Microservices Revolution"}]}]}}}`, }, + { + name: "query project resources with complex types inside inline fragments", + query: `query { projectResources(projectId: "1") { ... on Milestone { id name dependencies { id name } } ... on Task { id name subtasks { id name } } } }`, + expected: `{"data":{"projectResources":[{},{},{},{},{"id":"1","name":"Infrastructure Assessment","dependencies":[]},{"id":"2","name":"Cloud Environment Setup","dependencies":[{"id":"1","name":"Infrastructure Assessment"},{"id":"","name":""}]},{"id":"3","name":"Application Migration","dependencies":[{"id":"2","name":"Cloud Environment Setup"},{"id":"","name":""}]},{"id":"1","name":"Current Infrastructure Audit","subtasks":[{"id":"1a","name":"Server Inventory"},{"id":"1b","name":"Database Inventory"},{"id":"","name":""}]},{"id":"2","name":"Cloud Provider Selection","subtasks":null},{"id":"3","name":"Network Setup","subtasks":[{"id":"3a","name":"VPC Configuration"},{"id":"3b","name":"Security Groups"},{"id":"","name":""}]},{"id":"14","name":"Database Migration","subtasks":[]}]}}`, + }, } testenv.Run(t, &testenv.Config{ RouterConfigJSONTemplate: testenv.ConfigWithGRPCJSONTemplate, diff --git a/router-tests/router_plugin_test.go b/router-tests/router_plugin_test.go index 12e9845b9c..4e873769d7 100644 --- a/router-tests/router_plugin_test.go +++ b/router-tests/router_plugin_test.go @@ -455,6 +455,11 @@ func TestRouterPluginRequests(t *testing.T) { query: `{ project(id: 2) { id name urgent: topPriorityItem(category: "task") { __typename } nextDeadline: criticalDeadline(withinDays: 10000) { __typename } subsub: subProjects { id name status otherSubs: subProjects { id name } } } }`, expected: `{"data":{"project":{"id":"2","name":"Microservices Revolution","urgent":{"__typename":"Task"},"nextDeadline":{"__typename":"Milestone"},"subsub":[{"id":"4","name":"DevOps Transformation","status":"PLANNING","otherSubs":[{"id":"1","name":"Cloud Migration Overhaul"}]},{"id":"5","name":"Security Overhaul","status":"ON_HOLD","otherSubs":[{"id":"2","name":"Microservices Revolution"}]}]}}}`, }, + { + name: "query project resources with complex types inside inline fragments", + query: `query { projectResources(projectId: "1") { ... on Milestone { id name dependencies { id name } } ... on Task { id name subtasks { id name } } } }`, + expected: `{"data":{"projectResources":[{},{},{},{},{"id":"1","name":"Infrastructure Assessment","dependencies":[]},{"id":"2","name":"Cloud Environment Setup","dependencies":[{"id":"1","name":"Infrastructure Assessment"},{"id":"","name":""}]},{"id":"3","name":"Application Migration","dependencies":[{"id":"2","name":"Cloud Environment Setup"},{"id":"","name":""}]},{"id":"1","name":"Current Infrastructure Audit","subtasks":[{"id":"1a","name":"Server Inventory"},{"id":"1b","name":"Database Inventory"},{"id":"","name":""}]},{"id":"2","name":"Cloud Provider Selection","subtasks":null},{"id":"3","name":"Network Setup","subtasks":[{"id":"3a","name":"VPC Configuration"},{"id":"3b","name":"Security Groups"},{"id":"","name":""}]},{"id":"14","name":"Database Migration","subtasks":[]}]}}`, + }, } testenv.Run(t, &testenv.Config{ RouterConfigJSONTemplate: testenv.ConfigWithPluginsJSONTemplate, From 4248ff421c7ee10e9873b94250c904d344f605ba Mon Sep 17 00:00:00 2001 From: Dominik Korittki <23359034+dkorittki@users.noreply.github.com> Date: Thu, 5 Mar 2026 10:43:05 +0100 Subject: [PATCH 3/7] chore: use latest engine version --- router-tests/go.mod | 2 +- router-tests/go.sum | 4 ++-- router/go.mod | 2 +- router/go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/router-tests/go.mod b/router-tests/go.mod index 46a4f29f04..74a77b9812 100644 --- a/router-tests/go.mod +++ b/router-tests/go.mod @@ -27,7 +27,7 @@ require ( github.com/wundergraph/cosmo/demo/pkg/subgraphs/projects v0.0.0-20250715110703-10f2e5f9c79e github.com/wundergraph/cosmo/router v0.0.0-20260213130455-6e3277e7b850 github.com/wundergraph/cosmo/router-plugin v0.0.0-20250808194725-de123ba1c65e - github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb + github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258 go.opentelemetry.io/otel v1.36.0 go.opentelemetry.io/otel/sdk v1.36.0 go.opentelemetry.io/otel/sdk/metric v1.36.0 diff --git a/router-tests/go.sum b/router-tests/go.sum index cff45d78b3..3d19587f52 100644 --- a/router-tests/go.sum +++ b/router-tests/go.sum @@ -356,8 +356,8 @@ github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLV github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw= github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc= github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb h1:+vwm85gNfiq2rNl652/lHoURn64MTdLwR/TVOdyTVck= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258 h1:Cf3kkNDUlQPWNJi3kwF1UqUbUIxMnk5NN3ST7hGI4ow= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg= github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM= github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4= diff --git a/router/go.mod b/router/go.mod index 3e9e84dff9..74d4a4785a 100644 --- a/router/go.mod +++ b/router/go.mod @@ -31,7 +31,7 @@ require ( github.com/tidwall/gjson v1.18.0 github.com/tidwall/sjson v1.2.5 github.com/twmb/franz-go v1.16.1 - github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb + github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258 // Do not upgrade, it renames attributes we rely on go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 go.opentelemetry.io/contrib/propagators/b3 v1.23.0 diff --git a/router/go.sum b/router/go.sum index 1c1ae8deda..3398a5736e 100644 --- a/router/go.sum +++ b/router/go.sum @@ -328,8 +328,8 @@ github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLV github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw= github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc= github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb h1:+vwm85gNfiq2rNl652/lHoURn64MTdLwR/TVOdyTVck= -github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.257.0.20260304134830-53361709e0bb/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258 h1:Cf3kkNDUlQPWNJi3kwF1UqUbUIxMnk5NN3ST7hGI4ow= +github.com/wundergraph/graphql-go-tools/v2 v2.0.0-rc.258/go.mod h1:gfmmrPd2khZONmwYE8RIfnGjwIG+RqL52jYiBzcUST8= github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4= github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= From 4f3fcb5104586bcaa41a30165f292aaca31eab24 Mon Sep 17 00:00:00 2001 From: Dominik Korittki <23359034+dkorittki@users.noreply.github.com> Date: Thu, 5 Mar 2026 11:53:34 +0100 Subject: [PATCH 4/7] chore: add CVE-2025-15558 to trivy ignore --- .trivyignore.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.trivyignore.yaml b/.trivyignore.yaml index a993cf83c7..1b4224649c 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -1,4 +1,9 @@ vulnerabilities: - id: CVE-2026-24051 statement: Intended to be fixed in `ENG-9057`. The vulnerability happens on macOS/Darwin, as most images are used on Linux machines, we're ok with making this compromise. This was discussed with the team and OK'ed. - + - id: CVE-2025-15558 + statement: > + Windows-only vulnerability in github.com/docker/cli (dependency of go-containerregistry in router). + The router image is built and runs on Linux. Per the CVE description, "this issue does not impact non-Windows binaries". + Updating go-containerregistry fixes the issue but expects us to set router go version to 1.25.6 for a fix we are not affected by. + This can be reevaluated once we surpass 1.25.6 as the router's go version. From 3e3b7b68fbf7abaf5914cf5f8f4c77c05a41753d Mon Sep 17 00:00:00 2001 From: Dominik Korittki <23359034+dkorittki@users.noreply.github.com> Date: Thu, 5 Mar 2026 11:56:04 +0100 Subject: [PATCH 5/7] chore: rephrase --- .trivyignore.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.trivyignore.yaml b/.trivyignore.yaml index 1b4224649c..c63ac010f5 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -5,5 +5,5 @@ vulnerabilities: statement: > Windows-only vulnerability in github.com/docker/cli (dependency of go-containerregistry in router). The router image is built and runs on Linux. Per the CVE description, "this issue does not impact non-Windows binaries". - Updating go-containerregistry fixes the issue but expects us to set router go version to 1.25.6 for a fix we are not affected by. - This can be reevaluated once we surpass 1.25.6 as the router's go version. + Updating go-containerregistry fixes the issue but expects us to set router go version to 1.25.6 for a fix on sparsely used machines. + This can be reevaluated once we update go version to 1.26. From 611adae89a06a06111d686a970357d251c9a8651 Mon Sep 17 00:00:00 2001 From: Dominik Korittki <23359034+dkorittki@users.noreply.github.com> Date: Thu, 5 Mar 2026 12:51:48 +0100 Subject: [PATCH 6/7] chore: rephrase --- .trivyignore.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.trivyignore.yaml b/.trivyignore.yaml index c63ac010f5..fabda36ee0 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -4,6 +4,7 @@ vulnerabilities: - id: CVE-2025-15558 statement: > Windows-only vulnerability in github.com/docker/cli (dependency of go-containerregistry in router). - The router image is built and runs on Linux. Per the CVE description, "this issue does not impact non-Windows binaries". - Updating go-containerregistry fixes the issue but expects us to set router go version to 1.25.6 for a fix on sparsely used machines. - This can be reevaluated once we update go version to 1.26. + Per the CVE description, "this issue does not impact non-Windows binaries". + Most images are used on Linux. + Updating go-containerregistry fixes the issue but expects us to set router go version to 1.25.6 for a fix on a sparsely used platform. + This can be reevaluated once we update to go 1.25.6 / 1.26. From 2d8aaf566c99965023094ca2d4f2845428b297c5 Mon Sep 17 00:00:00 2001 From: Dominik Korittki <23359034+dkorittki@users.noreply.github.com> Date: Fri, 6 Mar 2026 08:49:18 +0100 Subject: [PATCH 7/7] chore: remove CVE-2026-24051 from trivy ignore Fix has been merged to main already, no need to ignore it. --- .trivyignore.yaml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.trivyignore.yaml b/.trivyignore.yaml index fabda36ee0..bbac2202e2 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -1,10 +1,3 @@ vulnerabilities: - id: CVE-2026-24051 statement: Intended to be fixed in `ENG-9057`. The vulnerability happens on macOS/Darwin, as most images are used on Linux machines, we're ok with making this compromise. This was discussed with the team and OK'ed. - - id: CVE-2025-15558 - statement: > - Windows-only vulnerability in github.com/docker/cli (dependency of go-containerregistry in router). - Per the CVE description, "this issue does not impact non-Windows binaries". - Most images are used on Linux. - Updating go-containerregistry fixes the issue but expects us to set router go version to 1.25.6 for a fix on a sparsely used platform. - This can be reevaluated once we update to go 1.25.6 / 1.26.