[v2.0 audit] Tracking epic — 46 findings since 1.7.3

# v2.0 Pre-release Audit — Tracking Epic Comprehensive code review of all changes between tag 1.7.3 and current main (~360 commits, ~1,700 LOC) in preparation for the v2.0 release. 46 individual findings were filed; this epic groups them by severity for tracking. All findings carry the `audit:v2.0` label. ## P0 — Critical (must-fix before 2.0) - [ ] #1011 — **[C1]** SourceGenerator: hint-name collisions when two .refitter files share a filename - [ ] #1012 — **[C2]** MSBuild task swallows CLI failures; build always reports success with stale/missing output - [ ] #1013 — **[C3]** ContractTypeSuffixApplier corrupts code via raw word-boundary regex (renames members, comments, strings; double-suffix on rerun) - [ ] #1014 — **[C4]** Forced JsonStringEnumConverter injection breaks Newtonsoft users and silently regresses internal enums - [ ] #1015 — **[C5]** ConvertOneOfWithDiscriminatorToAllOf NRE on Swagger 2 / OpenAPI 3 docs without components - [ ] #1016 — **[C6]** Multi-spec merge silently drops all schemas when first spec has no components ## P1 — High - [ ] #1017 — **[H1]** JsonSerializerContextGenerator emits non-compiling AOT context (generics, namespaces, polymorphism, nested types) - [ ] #1018 — **[H2]** ParameterExtractor.ConvertToVariableName produces invalid C# identifiers (multipart form-data fields) - [ ] #1019 — **[H3]** Security-scheme header parameter name not safely sanitized - [ ] #1020 — **[H4]** Dynamic-querystring constructor self-assigns when parameter name starts with non-letter - [ ] #1021 — **[H5]** CLI: --output / -o no longer overrides settings-file outputFolder (script regression) - [ ] #1022 — **[H6]** MSBuild predicted output paths diverge from CLI actual paths → silent missing compile items - [ ] #1023 — **[H7]** MSBuild IncludePatterns is substring-matched, over-includes files - [ ] #1024 — **[H8]** Refit major bump 9 → 10 silently leaks to Refitter.SourceGenerator consumers - [ ] #1025 — **[H9]** Microsoft.OpenApi.Readers 1.x → 3.x silently changes parsing/codegen for users - [ ] #1026 — **[H10]** Auto-enabling GenerateOptionalPropertiesAsNullable is a silent breaking shape change - [ ] #1027 — **[H11]** RefitInterfaceGenerator NRE when an OpenAPI response has no content ## P2 — Medium - [ ] #1028 — **[M1]** SourceGenerator pipeline output uses List<Diagnostic> (defeats incremental caching) - [ ] #1029 — **[M2]** SourceGenerator user-visible warnings only emit to Debug.WriteLine (no-op in Release) - [ ] #1030 — **[M3]** SettingsValidator only validates the first entry of openApiPaths - [ ] #1031 — **[M4]** ValidateOpenApiSpec does not resolve relative spec paths from settings-file directory - [ ] #1032 — **[M5]** InlineJsonConverters semantics silently changed: per-property → per-type (custom JsonNamingPolicy regression risk) - [ ] #1033 — **[M6]** Hard-coded \n in regex replacement → mixed CRLF/LF on Windows - [ ] #1034 — **[M7]** Merge mutates input documents[0] and silently drops conflicting paths/schemas without warning - [ ] #1035 — **[M8]** XML doc emission does not escape user-supplied parameter / dynamic-querystring descriptions - [ ] #1036 — **[M9]** ReOrderNullableParameters mis-classifies generic parameters that contain ? - [ ] #1037 — **[M10]** RefitInterfaceImports.GenerateNamespaceImports throws on empty namespace list - [ ] #1038 — **[M11]** CustomCSharpTypeResolver appends ? to mapped reference-type aliases regardless of nullable-reference-type setting - [ ] #1039 — **[M12]** GetQueryParameters mutates the shared operationModel.Parameters collection - [ ] #1040 — **[M13]** Static HttpClient has no timeout, no cancellation, no User-Agent - [ ] #1041 — **[M14]** MSBuild task: dotnet --list-runtimes invocation is fragile (NRE, unquoted args, no fallback when target TFM dll missing) - [ ] #1042 — **[M15]** Spectre.Console.Cli 0.53 → 0.55 pre-1.0 minor bump may shift CLI parsing - [ ] #1043 — **[M16]** CLI --generate-authentication-header changed from bool flag to enum value (silent script breakage) ## P2 — Low (no lower priority label exists) - [ ] #1044 — **[L1]** OpenApiPath + OpenApiPaths precedence is silent; no validation - [ ] #1045 — **[L2]** OpenApiPath remains null! when OpenApiPaths is set → NRE for library consumers - [ ] #1046 — **[L3]** Default OpenApiPaths = Array.Empty<string>() round-trips into saved settings as "openApiPaths": [] - [ ] #1047 — **[L4]** MSBuild task does regex-based JSON parsing of .refitter files - [ ] #1048 — **[L5]** CLI reads .refitter twice (validator + execute), risks drift - [ ] #1049 — **[L6]** Library code missing ConfigureAwait(false) — sync-over-async deadlock risk for hosted callers - [ ] #1050 — **[L7]** Enum-deserialization errors in .refitter give unhelpful JsonException - [ ] #1051 — **[L8]** XmlDocumentationGenerator.DecodeJsonEscapedText mishandles malformed \u sequences - [ ] #1052 — **[L9]** OperationNameGenerator.CheckForDuplicateOperationIds runs full pipeline twice in constructor - [ ] #1053 — **[L10]** IdentifierUtils.ReservedKeywords incomplete; Sanitize() does not escape keywords - [ ] #1054 — **[L11]** OpenApiDocumentFactory.CreateAsync(IEnumerable<string>) throws wrong exception type on null - [ ] #1055 — **[L12]** Reordering of interface-generator construction in Generate() is correct but fragile - [ ] #1056 — **[L13]** IdentifierUtils.Counted uses fresh HashSet per GenerateCode() call ## Scope notes Findings explicitly **excluded** as known intentional changes (per `plan-breaking-changes-discussion.md` and #998): - Settings rename `generateAuthenticationHeader` → `authenticationHeaderStyle` (intentional breaking change). - Source generator switching to `context.AddSource()` (intentional architectural change — but see #1011 for collision regression). - MSBuild output path fix (#998). ## Methodology 4 parallel reviewers partitioned the diff: 1. Core generators (`CSharpClientGeneratorFactory`, `RefitGenerator`, `RefitInterfaceGenerator`, multi-interface generators, `SchemaCleaner`, `OpenApiDocumentFactory`). 2. Identifiers & naming (`IdentifierUtils`, name generators, `ParameterExtractor`, `XmlDocumentationGenerator`, `JsonSerializerContextGenerator`, `ContractTypeSuffixApplier`). 3. CLI / MSBuild / Source Generator host code. 4. Settings, dependencies (`csproj`/`targets`/`Directory.Build.props`), CHANGELOG cross-reference. Findings were consolidated, deduped, and prioritised by user-visible impact.