Skip to content

[pull] main from fern-api:main#653

Merged
pull[bot] merged 46 commits into
code:mainfrom
fern-api:main
Apr 15, 2026
Merged

[pull] main from fern-api:main#653
pull[bot] merged 46 commits into
code:mainfrom
fern-api:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented Apr 15, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

iamnamananand996 and others added 30 commits April 15, 2026 16:37
* feat(cli): add --id flag and [target] auto-detection to docs preview delete

- CLI v1 & v2: [target] positional auto-detects URL vs ID via isPreviewUrl()
- Explicit --url and --id flags with mutual exclusivity validation
- Shared utilities: sanitizePreviewId, buildPreviewDomain, isPreviewUrl
- Unit tests: 42 tests covering all utilities and auto-detection logic
- Backward compatible: bare URL positional still works

* fix(cli): fix test import for previewUrlValidation to use @fern-api/docs-preview

* fix(cli): re-export isPreviewUrl and PREVIEW_URL_PATTERN from deleteDocsPreview for tests

* fix(cli): inline preview URL helpers to avoid broken @fern-api/ui-core-utils transitive dep

* Use shared docs-preview utils and update tests

Replace duplicated preview URL/id utilities in CLI packages with shared functions from @fern-api/docs-preview (isPreviewUrl, buildPreviewDomain). Remove local sanitize/build implementations and update imports in cli and cli-v2. Adjust previewUrlUtils: rename PREVIEW_FQDN_LIMIT to SUBDOMAIN_LIMIT, clarify comments, and keep truncate logic consistent with server. Update tests to assert subdomain length and exact behavior for short IDs. Update changelog entry to document the new --id flag and clarify positional target handling (marked as feat). This centralizes preview URL logic so the CLI matches server-side behavior.

---------

Co-authored-by: Naman Anand <info@buildwithfern.com>
* [Grype Scan][java-sdk] Scaffold PR for 3 vulnerabilities

* fix(java-sdk): update python3, python3-libs, libnghttp2 to fix 3 high CVEs

Update OS-level packages in java-sdk container:
- python3/python3-libs: 3.9.25-1.amzn2023.0.3 -> 3.9.25-1.amzn2023.0.4 (ALAS2023-2026-1583)
- libnghttp2: 1.59.0-3.amzn2023.0.1 -> 1.59.0-3.amzn2023.0.2 (ALAS2023-2026-1542, CVE-2026-27135)

Delete grype scan scaffold file.

Co-Authored-By: unknown <>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…limits (#15015)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
… to release script (#15023)

* fix: handle pre-release versions in release script

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: graduate pre-release versions instead of skipping past base version

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat: add pre-release tag support to changelog entries

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…nerator version (#14937)

* fix(go): preserve SDK version in dynamic snippets instead of using generator version

Co-Authored-By: David Konigsberg <davidakonigsberg@gmail.com>

* use util

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: patrick thornton <patrickthornton@g.harvard.edu>
* chore(seed): add allOf composition test fixtures

Add two test-definition fixtures exercising allOf edge cases:
- allof: default settings (extends mode)
- allof-inline: inline-all-of-schemas enabled, shares the same spec

Covers array items narrowing, primitive constraint narrowing via $ref,
required propagation, metadata inheritance, and multi-parent overlap.

* chore(internal): add allOf debug pipeline script and IR snapshots

Add debug-allof-pipeline.ts for running allof/allof-inline fixtures
through the full CLI pipeline (openapi-ir → write-definition → ir).
Include generated IR snapshots confirming remaining allOf bugs.

* test(cli): add assertion-based allOf tests reproducing SPS Commerce bugs

Add V3 importer test fixture and assertion tests for the allOf edge
cases reported in Pylon #18189 / FER-9158. Tests validate:
- Case A: array items narrowing preserves parent required status
- Case B: property-level allOf with $ref + inline primitive
- Case C: required field preservation through allOf composition

7 of 8 assertions currently fail, confirming the bugs. The task is
complete when all 8 pass.

* fix(cli): resolve allOf composition bugs in V3 OpenAPI importer

- Enhance shouldMergeAllOf path to resolve $ref elements instead of bailing out
- Add cycle detection via Set to prevent infinite loops on circular refs
- Handle property-level allOf with $ref to non-object types (e.g. enums)
  by referencing the original type instead of creating synthetic copies
- Update test infrastructure to serialize IR discriminants for assertions
- Update snapshots for allof-spscommerce fixture

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: resolve biome noNonNullAssertion lint errors in SchemaOrReferenceConverter

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: add biome-ignore for pre-existing noNonNullAssertion in test file

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: update v3-sdks snapshots for allOf merge changes

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: update convertIRtoJsonSchema snapshots for allof/allof-inline

Co-Authored-By: bot_apk <apk@cognition.ai>

* update config

* Add case 6

* seed outputs

* Automated update of seed files

* fix: update convertIRtoJsonSchema snapshots for new allof types

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: thread visitedRefs across recursive SchemaConverter calls for cross-schema cycle detection

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: format SchemaConverter.ts constructor for biome

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: update ir-generator-tests test-definitions for allof-inline

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: update ir-generator-tests test-definitions for allof

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: deduplicate merged allOf refs and guard composition-keyword shortcuts

Deduplicate $ref entries in the merged allOf array after mergeWith
array-concatenation to prevent false-positive cycle detection in
diamond inheritance patterns (A → B, C; B, C → D).

Add allOf/oneOf/anyOf checks to the resolved-schema guard in
maybeConvertSingularAllOfReferenceObject so the shortcut only fires
for true scalar/enum primitives, not schemas defined via composition
keywords whose inline constraints would be silently discarded.

* fix: guard single-element allOf cycles and add versions.yml entry

Thread visitedRefs through the single-element allOf branch in
SchemaConverter to detect self-referential and indirect cycles
(e.g. A → B → A via single-element allOf chains), matching the
protection already present in the multi-element shouldMergeAllOf path.

Add the required versions.yml changelog entry for the allOf
composition fixes in this PR.

* nits

* fix(cli): address review feedback on allOf composition

- Preserve outer `inlined` status through allOf merge path instead of
  hardcoding `inlined: true`
- Guard variants-flattening against $ref-resolved schemas to prevent
  destructive flattening of named union types
- Seed dedup seenRefs from resolvedRefs to prevent duplicate property
  declarations in diamond inheritance
- Bail out of allOf shortcut when inline elements contain `type: "null"`
  to preserve nullable semantics in OpenAPI 3.1 patterns
- Add optional guard for required executionContext field in Case B test
- Remove debug script (scripts/debug-allof-pipeline.ts)
- Remove orphaned allof-spscommerce snapshot files
- Move changelog to changes/unreleased/ per release-versioning convention

* fix(cli): address remaining review comments on allOf composition

- Fix inlined: true -> inlined: this.inlined in single-element allOf path
- Propagate inlinedTypes in both allOf shortcuts in SchemaOrReferenceConverter
- Update stale test comment and remove duplicate biome-ignore
- Update v3-sdks snapshots

Co-Authored-By: judah <jsklan.development@gmail.com>

* fix(cli): separate resolvedRefs concerns and add format keyword guard

- SchemaConverter.ts: Use separate localResolvedRefs set for tracking refs
  within current allOf array. Check this.visitedRefs for ancestor cycles
  only. Same-array duplicate $refs now skip (continue) instead of
  triggering hasCycle=true.

- SchemaOrReferenceConverter.ts: Add !s.format guard to inline elements
  check and !resolved.format guard to resolved schema check in
  maybeConvertSingularAllOfReferenceObject, preventing the shortcut from
  discarding inline format constraints like {format: "date-time"}.

Co-Authored-By: bot_apk <apk@cognition.ai>

* style: fix biome formatting for inline format guard

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix(cli): preserve outer schema metadata in shouldMergeAllOf path

Copy TYPE_INVARIANT_KEYS (description, deprecated, example, default,
readOnly, writeOnly, etc.) from the outer this.schema into mergedSchema
before constructing mergedConverter, so metadata fields are not silently
dropped for schemas routed through the shouldMergeAllOf path.

Co-Authored-By: bot_apk <apk@cognition.ai>

* refactor(cli): replace lodash.mergeWith with per-key allOf schema merge

Replace the generic lodash.mergeWith deep merge in the shouldMergeAllOf
path with a purpose-built mergeAllOfSchemas function that uses explicit
per-key strategies for OpenAPI schema keywords:

- required: set union
- properties/items: recursive deep merge
- example/default: deep merge objects
- deprecated/readOnly/writeOnly: OR (true if any says true)
- min/max constraints: most restrictive value
- description/type/format/etc: outer schema wins
- allOf from children: flattened before merge (prevents leakage)

This eliminates the post-merge fixup code (allOf dedup block,
TYPE_INVARIANT_KEYS loop) that was the source of cascading review
issues. Also adds !s.items and array-form null-type guards to the
allOf shortcut in SchemaOrReferenceConverter.

* fix(cli): fix type errors in allOf schema merge and eliminate `as any` in tests

Use `"items" in s` instead of `s.items` to avoid TS error on NonArraySchemaObject,
and replace all `as any` casts in mergeAllOfSchemas tests with proper OpenAPI types.

* fix(cli): harden allOf merge pipeline against $ref leaks, nested flattening, and metadata loss

Filter unresolved $ref objects from nested allOf flattening to prevent
spurious top-level $ref keys corrupting merged schemas. Make
flattenNestedAllOf recursive so deeply-nested allOf structures are fully
expanded. Add oneOf/anyOf to SKIP_FROM_CHILDREN so composition keywords
from resolved child schemas don't leak into the merged result and
erroneously trigger union conversion. Propagate outer schema metadata
(description, deprecated) through the single-element allOf path for
non-object types.

* Revert seed output changes to reduce diff

---------

Co-authored-by: jsklan <jsklan.development@gmail.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: bot_apk <apk@cognition.ai>
Co-authored-by: jsklan <jsklan@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
* wire bump

* release 4.2.0-rc.2
Swimburger and others added 16 commits April 15, 2026 16:25
…#15028)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…endpoints (#15048)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* release 5.4.0-rc.1

* Delete generators/python/sdk/changes/unreleased/fix-header-auth-with-oauth.yml
Co-authored-by: Swimburger <3382717+Swimburger@users.noreply.github.com>
Co-authored-by: Swimburger <3382717+Swimburger@users.noreply.github.com>
Co-authored-by: Swimburger <3382717+Swimburger@users.noreply.github.com>
Co-authored-by: patrickthornton <70873350+patrickthornton@users.noreply.github.com>
Co-authored-by: patrickthornton <70873350+patrickthornton@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
Co-authored-by: dsinghvi <10870189+dsinghvi@users.noreply.github.com>
@pull pull Bot locked and limited conversation to collaborators Apr 15, 2026
@pull pull Bot added the ⤵️ pull label Apr 15, 2026
@pull pull Bot merged commit a308fbf into code:main Apr 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants