OpenAPI: spec for collections inside polymorphic objects inside polymorphic objects are not generated correctly

[stijn-o-ispnext]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Describe the bug
I have a polymorphic object that has collection properties (List) that is used inside another polymorphic object. This results in the library generating stuff like:

 "$ref": "#/components/schemas/polymorphicClass/anyOf/0/properties/polymorphicClassThatIsAProperty/anyOf/8/properties/intList"

Instead of

"type": [
  "null",
  "array"
],
"items": {
  "type": "number",
  "format": "int32"
}

Expected Behavior

Correct array spec should be generated

Steps To Reproduce

Simply create this structure and expose class A via a controller and generate OpenAPI specs for it:

[JsonPolymorphic(TypeDiscriminatorPropertyName = "type")]
[JsonDerivedType(typeof(B), typeDiscriminator: "test")]
public abstract class A
{
    public C TestProperty { get; set; }
}

public class B : A
{
}

[JsonPolymorphic(TypeDiscriminatorPropertyName = "otherType")]
[JsonDerivedType(typeof(D), typeDiscriminator: "test1")]
public abstract class C
{
}

public class D : C
{
    public List<int> TestInts { get; set; }
}

Exceptions (if any)

No response

.NET Version

10.0.101

Anything else?

.NET SDK:
Version: 10.0.101
Commit: fad253f51b
Workload version: 10.0.100-manifests.c57ac48b
MSBuild version: 18.0.6+fad253f51

Runtime Environment:
OS Name: Mac OS X
OS Version: 26.4
OS Platform: Darwin
RID: osx-arm64
Base Path: /usr/local/share/dotnet/sdk/10.0.101/

.NET workloads installed:
There are no installed workloads to display.
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.

Host:
Version: 10.0.1
Architecture: arm64
Commit: fad253f51b

.NET SDKs installed:
9.0.303 [/usr/local/share/dotnet/sdk]
9.0.308 [/usr/local/share/dotnet/sdk]
10.0.101 [/usr/local/share/dotnet/sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 9.0.7 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.11 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.1 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 9.0.7 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.11 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.1 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
None

Environment variables:
DOTNET_ROOT [/usr/local/share/dotnet]

global.json file:
Not found

[github-actions]

Triage Summary

Area: area-minimal — This issue is about OpenAPI schema generation (Microsoft.AspNetCore.OpenApi) which lives under src/OpenApi/, classified under area-minimal.
Type: bug — The OpenAPI document generator produces invalid $ref paths pointing deep into anyOf sub-schemas (e.g., #/components/schemas/.../anyOf/0/properties/.../anyOf/8/properties/intList) instead of inlining the correct array schema for a List<T> property on a nested polymorphic type.

Potential Duplicates

• None found — Searches for "OpenAPI polymorphic collection $ref schema" and "JsonPolymorphic anyOf array items" returned no matching open issues.

Notes

• The bug manifests specifically when a List<T> property is declared on a derived type (D) of an inner polymorphic hierarchy (C), where that inner hierarchy is itself used as a property type in an outer polymorphic type (A). The schema transformer incorrectly emits a relative $ref deep into the inline anyOf discriminator tree rather than the proper type: array / items: ... schema.
• No regression information was provided; the reporter is on .NET 10.0.101 and did not mention a previously working version.

Generated by Issue Triage Agent for dotnet/aspnetcore for issue #128155 · ● 273.2K · ◷

[Youssef1313]

This is probably coming from System.Text.Json which we rely on in OpenAPI implementation. Moved to dotnet/runtime for investigation on their side first. Feel free to transfer back to aspnetcore if it's not STJ issue please.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-meta
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-text-json
See info in area-owners.md if you want to be subscribed.