[pull] main from fern-api:main

docker/seed/Dockerfile.ts

@@ -42,6 +42,19 @@ RUN apt-get update \
   && apt-get -y autoremove \
   && rm -rf /var/lib/apt/lists/*
 
+# Update perl-base to fix CVE-2026-48959, CVE-2026-48961, CVE-2026-9538, CVE-2026-48962, CVE-2026-42497
+RUN echo "Types: deb" > /etc/apt/sources.list.d/sid.sources \
+    && echo "URIs: http://deb.debian.org/debian" >> /etc/apt/sources.list.d/sid.sources \
+    && echo "Suites: sid" >> /etc/apt/sources.list.d/sid.sources \
+    && echo "Components: main" >> /etc/apt/sources.list.d/sid.sources \
+    && echo "Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg" >> /etc/apt/sources.list.d/sid.sources \
+    && echo 'Package: *\nPin: release n=sid\nPin-Priority: 100' > /etc/apt/preferences.d/sid-low \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends -t sid \
+       perl-base perl \
+    && rm -f /etc/apt/sources.list.d/sid.sources /etc/apt/preferences.d/sid-low \
+    && rm -rf /var/lib/apt/lists/*
+
 # Upgrade bundled npm to 11.14.1 to pick up patched transitive dependencies
 # (picomatch 4.0.4, minimatch 10.2.5, tar 7.5.13).
 # node:24.16.0 ships npm 11.12.1 which still vendors picomatch 4.0.3 and

generators/python-v2/pydantic-model/Dockerfile

@@ -20,6 +20,7 @@ RUN echo "Types: deb" > /etc/apt/sources.list.d/sid.sources \
     && apt-get install -y --no-install-recommends -t sid \
        libkrb5-3 libkrb5support0 libk5crypto3 libgssapi-krb5-2 \
        curl libcurl4t64 libgnutls30t64 \
+       perl-base perl \
     && rm -f /etc/apt/sources.list.d/sid.sources /etc/apt/preferences.d/sid-low \
     && rm -rf /var/lib/apt/lists/*
 RUN rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /opt/yarn-*

generators/python-v2/sdk/Dockerfile

@@ -18,6 +18,7 @@ RUN echo "Types: deb" > /etc/apt/sources.list.d/sid.sources \
     && apt-get install -y --no-install-recommends -t sid \
        libkrb5-3 libkrb5support0 libk5crypto3 libgssapi-krb5-2 \
        curl libcurl4t64 libgnutls30t64 \
+       perl-base perl \
     && rm -f /etc/apt/sources.list.d/sid.sources /etc/apt/preferences.d/sid-low \
     && rm -rf /var/lib/apt/lists/*
 # Patch brace-expansion to 5.0.6 (GHSA-jxxr-4gwj-5jf2; node:24.16 vendors 5.0.5).

generators/python/sdk/Dockerfile

@@ -31,6 +31,7 @@ RUN echo "Types: deb" > /etc/apt/sources.list.d/sid.sources \
        libkrb5-3 libkrb5support0 libk5crypto3 libgssapi-krb5-2 \
        curl libcurl4t64 libgnutls30t64 \
        libexpat1 \
+       perl-base perl \
     && rm -f /etc/apt/sources.list.d/sid.sources /etc/apt/preferences.d/sid-low \
     && rm -rf /var/lib/apt/lists/*
 RUN node --version

generators/rust/model/src/__test__/snapshots/undiscriminated-union-types/types_event_message.rs

@@ -1,7 +1,8 @@
 pub use crate::prelude::*;
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "type")]
+#[non_exhaustive]
 pub enum EventMessage {
         #[serde(rename = "payload")]
         #[non_exhaustive]
@@ -14,6 +15,12 @@ pub enum EventMessage {
         Raw {
             value: String,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl EventMessage {
@@ -24,4 +31,8 @@ impl EventMessage {
     pub fn raw(value: String) -> Self {
         Self::Raw { value }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/undiscriminated-union-types/types_flexible_value.rs

@@ -2,6 +2,7 @@ pub use crate::prelude::*;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "type")]
+#[non_exhaustive]
 pub enum FlexibleValue {
         #[serde(rename = "string")]
         #[non_exhaustive]
@@ -32,6 +33,12 @@ pub enum FlexibleValue {
         StringList {
             value: Vec<String>,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl FlexibleValue {
@@ -54,4 +61,8 @@ impl FlexibleValue {
     pub fn string_list(value: Vec<String>) -> Self {
         Self::StringList { value }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/undiscriminated-union-types/types_response.rs

@@ -1,7 +1,8 @@
 pub use crate::prelude::*;
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "type")]
+#[non_exhaustive]
 pub enum Response {
         #[serde(rename = "success")]
         #[non_exhaustive]
@@ -22,6 +23,12 @@ pub enum Response {
             #[serde(skip_serializing_if = "Option::is_none")]
             details: Option<Vec<String>>,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl Response {
@@ -36,4 +43,8 @@ impl Response {
     pub fn error_with_details(error: String, code: i64, details: Vec<String>) -> Self {
         Self::Error { error, code, details: Some(details) }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/undiscriminated-union-types/types_search_result.rs

@@ -2,6 +2,7 @@ pub use crate::prelude::*;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "type")]
+#[non_exhaustive]
 pub enum SearchResult {
         #[serde(rename = "user")]
         #[non_exhaustive]
@@ -40,6 +41,12 @@ pub enum SearchResult {
             #[serde(skip_serializing_if = "Option::is_none")]
             parent_id: Option<String>,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl SearchResult {
@@ -58,4 +65,8 @@ impl SearchResult {
     pub fn category_with_parent_id(id: String, name: String, description: String, parent_id: String) -> Self {
         Self::Category { id, name, description, parent_id: Some(parent_id) }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/undiscriminated-union-types/types_string_or_number.rs

@@ -1,7 +1,8 @@
 pub use crate::prelude::*;
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "type")]
+#[non_exhaustive]
 pub enum StringOrNumber {
         #[serde(rename = "string")]
         #[non_exhaustive]
@@ -14,6 +15,12 @@ pub enum StringOrNumber {
         Number {
             value: i64,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl StringOrNumber {
@@ -24,4 +31,8 @@ impl StringOrNumber {
     pub fn number(value: i64) -> Self {
         Self::Number { value }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/union-types/types_animal.rs

@@ -2,6 +2,7 @@ pub use crate::prelude::*;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "type")]
+#[non_exhaustive]
 pub enum Animal {
         #[serde(rename = "dog")]
         #[non_exhaustive]
@@ -37,6 +38,12 @@ pub enum Animal {
             #[serde(with = "crate::core::number_serializers::option")]
             wing_span: Option<f64>,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl Animal {
@@ -55,4 +62,8 @@ impl Animal {
     pub fn bird_with_wing_span(name: String, can_fly: bool, wing_span: f64) -> Self {
         Self::Bird { name, can_fly, wing_span: Some(wing_span) }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/union-types/types_payment_method.rs

@@ -1,7 +1,8 @@
 pub use crate::prelude::*;
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "type")]
+#[non_exhaustive]
 pub enum PaymentMethod {
         #[serde(rename = "cash")]
         #[non_exhaustive]
@@ -24,6 +25,12 @@ pub enum PaymentMethod {
             #[serde(default)]
             routing_number: String,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl PaymentMethod {
@@ -38,4 +45,8 @@ impl PaymentMethod {
     pub fn bank_transfer(account_number: String, routing_number: String) -> Self {
         Self::BankTransfer { account_number, routing_number }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/union-types/types_shape.rs

@@ -2,6 +2,7 @@ pub use crate::prelude::*;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "kind")]
+#[non_exhaustive]
 pub enum Shape {
         #[serde(rename = "circle")]
         #[non_exhaustive]
@@ -25,6 +26,12 @@ pub enum Shape {
         Square {
             value: f64,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl Shape {
@@ -39,4 +46,8 @@ impl Shape {
     pub fn square(value: f64) -> Self {
         Self::Square { value }
     }
+
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
 }

generators/rust/model/src/__test__/snapshots/union-types/types_vehicle.rs

@@ -2,6 +2,7 @@ pub use crate::prelude::*;
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(tag = "vehicle_type")]
+#[non_exhaustive]
 pub enum Vehicle {
         #[serde(rename = "car")]
         #[non_exhaustive]
@@ -40,6 +41,12 @@ pub enum Vehicle {
             manufacturer: String,
             year: i64,
         },
+
+        /// Catch-all variant for unrecognized discriminant values.
+        /// If the server sends a discriminant not recognized by the current SDK
+        /// version, the raw payload is captured here so callers can still inspect it.
+        #[serde(untagged)]
+        __Unknown(serde_json::Value),
 }
 
 impl Vehicle {
@@ -55,11 +62,16 @@ impl Vehicle {
         Self::Truck { payload_capacity, axles, id, manufacturer, year }
     }
 
+    pub fn unknown(value: serde_json::Value) -> Self {
+        Self::__Unknown(value)
+    }
+
     pub fn get_id(&self) -> &str {
         match self {
                     Self::Car { id, .. } => id,
                     Self::Motorcycle { id, .. } => id,
                     Self::Truck { id, .. } => id,
+                    Self::__Unknown(_) => panic!("get_id() called on __Unknown variant; inspect the raw JSON value directly"),
                 }
     }
 
@@ -68,6 +80,7 @@ impl Vehicle {
                     Self::Car { manufacturer, .. } => manufacturer,
                     Self::Motorcycle { manufacturer, .. } => manufacturer,
                     Self::Truck { manufacturer, .. } => manufacturer,
+                    Self::__Unknown(_) => panic!("get_manufacturer() called on __Unknown variant; inspect the raw JSON value directly"),
                 }
     }
 
@@ -76,6 +89,7 @@ impl Vehicle {
                     Self::Car { year, .. } => year,
                     Self::Motorcycle { year, .. } => year,
                     Self::Truck { year, .. } => year,
+                    Self::__Unknown(_) => panic!("get_year() called on __Unknown variant; inspect the raw JSON value directly"),
                 }
     }
 }