[pull] main from fern-api:main

.github/dependabot.yml

@@ -55,3 +55,9 @@ updates:
     directory: "/generators/go"
     schedule:
       interval: "weekly"
+  # The CLI generator vendors a Rust SDK whose Cargo.lock ships verbatim into
+  # every generated CLI, so an advisory here reaches every consumer.
+  - package-ecosystem: "cargo"
+    directory: "/generators/cli/sdk"
+    schedule:
+      interval: "weekly"

generators/cli/changes/0.35.2/refresh-vendored-lock-and-rerunnable-releases.yml

@@ -0,0 +1,14 @@
+# yaml-language-server: $schema=../../../../fern-changes-yml.schema.json
+
+- summary: |
+    Refresh the vendored Cargo.lock to clear two advisories that shipped into
+    every generated CLI: h2 0.4.15 -> 0.4.16 (RUSTSEC-2026-0258) and
+    webbrowser 1.2.1 -> 1.2.4 (RUSTSEC-2026-0257).
+  type: fix
+- summary: |
+    Make the generated release workflow re-runnable. The final step ran a bare
+    `gh release create`, so a release that already existed for the tag - cut
+    from the GitHub UI, or a re-run of a failed `host` job - failed the release
+    after every build had already succeeded. It now edits and re-uploads into
+    an existing release, and only creates when there is none.
+  type: fix

generators/cli/changes/0.35.3/auto-propagated-from-rust-0.46.1.yml

@@ -0,0 +1,3 @@
+- summary: |
+    Includes Rust SDK Generator 0.46.1 updates.
+  type: fix

generators/cli/changes/0.35.4/auto-propagated-from-rust-0.46.2.yml

@@ -0,0 +1,3 @@
+- summary: |
+    Includes Rust SDK Generator 0.46.2 updates.
+  type: fix

generators/cli/src/__test__/emitReleaseWorkflow.test.ts

@@ -59,6 +59,24 @@ describe("constructReleaseWorkflowYaml", () => {
         expect(yaml).not.toContain("HOMEBREW_TAP_TOKEN");
     });
 
+    it("updates an existing GitHub release and overwrites its assets", () => {
+        const yaml = constructReleaseWorkflowYaml({});
+        const releaseStep = yaml.slice(yaml.indexOf("gh release view"));
+
+        expect(releaseStep).toContain('gh release view "${{ needs.plan.outputs.tag }}"');
+        expect(releaseStep).toContain("gh release edit");
+        expect(releaseStep).toContain("--prerelease=false");
+        // A release drafted in the UI must be published, not just filled in —
+        // and its tag must land on the commit that was actually built.
+        expect(releaseStep).toContain("--draft=false");
+        for (const edit of releaseStep.split("\n").filter((line) => line.includes("gh release edit"))) {
+            expect(edit).toContain('--target "$RELEASE_COMMIT"');
+        }
+        expect(releaseStep).toContain("gh release upload");
+        expect(releaseStep).toContain("--clobber");
+        expect(releaseStep).toContain("gh release create");
+    });
+
     describe("with homebrew configured", () => {
         const yaml = constructReleaseWorkflowYaml({ homebrew: { tap: "acme/homebrew-tap" } });
 

generators/cli/src/emitReleaseWorkflow.ts

@@ -626,5 +626,20 @@ jobs:
           # Write and read notes from a file to avoid quoting breaking things
           echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
 
-          gh release create "\${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
+          # Re-runs and pre-created releases must not fail after a successful build.
+          # --draft=false publishes a release that was drafted in the UI:
+          # gh release view finds drafts, so without it the assets upload into
+          # a release nobody can see and the job still reports success. A draft
+          # has no tag yet, so --target decides where that tag lands; for an
+          # already-published release the tag exists and GitHub ignores it.
+          if gh release view "\${{ needs.plan.outputs.tag }}" > /dev/null 2>&1; then
+            if [[ -n "$PRERELEASE_FLAG" ]]; then
+              gh release edit "\${{ needs.plan.outputs.tag }}" --title "$ANNOUNCEMENT_TITLE" --target "$RELEASE_COMMIT" --notes-file "$RUNNER_TEMP/notes.txt" --draft=false --prerelease
+            else
+              gh release edit "\${{ needs.plan.outputs.tag }}" --title "$ANNOUNCEMENT_TITLE" --target "$RELEASE_COMMIT" --notes-file "$RUNNER_TEMP/notes.txt" --draft=false --prerelease=false
+            fi
+            gh release upload "\${{ needs.plan.outputs.tag }}" artifacts/* --clobber
+          else
+            gh release create "\${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
+          fi
 `;

generators/cli/versions.yml

@@ -1,4 +1,34 @@
 # yaml-language-server: $schema=../../fern-versions-yml.schema.json
+- version: 0.35.4
+  changelogEntry:
+    - summary: |
+        Includes Rust SDK Generator 0.46.2 updates.
+      type: fix
+  createdAt: "2026-08-20"
+  irVersion: 67
+- version: 0.35.3
+  changelogEntry:
+    - summary: |
+        Includes Rust SDK Generator 0.46.1 updates.
+      type: fix
+  createdAt: "2026-08-20"
+  irVersion: 67
+- version: 0.35.2
+  changelogEntry:
+    - summary: |
+        Refresh the vendored Cargo.lock to clear two advisories that shipped into
+        every generated CLI: h2 0.4.15 -> 0.4.16 (RUSTSEC-2026-0258) and
+        webbrowser 1.2.1 -> 1.2.4 (RUSTSEC-2026-0257).
+      type: fix
+    - summary: |
+        Make the generated release workflow re-runnable. The final step ran a bare
+        `gh release create`, so a release that already existed for the tag - cut
+        from the GitHub UI, or a re-run of a failed `host` job - failed the release
+        after every build had already succeeded. It now edits and re-uploads into
+        an existing release, and only creates when there is none.
+      type: fix
+  createdAt: "2026-08-20"
+  irVersion: 67
 - version: 0.35.1
   changelogEntry:
     - summary: |

generators/csharp/base/src/asIs/BaseRequest.Template.cs

@@ -22,6 +22,13 @@ internal abstract record BaseRequest
     internal Dictionary<string, string> Headers { get; init; } = new(StringComparer.OrdinalIgnoreCase);
 
     internal IRequestOptions? Options { get; init; }
+<% if (hasRetriesDisabledEndpoints) { %>
+
+    /// <summary>
+    /// Whether retries are disabled for this request, regardless of the client or request options.
+    /// </summary>
+    internal bool RetriesDisabled { get; init; }
+<% } %>
 
     internal abstract HttpContent? CreateContent();
 

generators/csharp/base/src/asIs/RawClient.Template.cs

@@ -45,14 +45,15 @@ internal partial class RawClient(ClientOptions clientOptions)
 
         var httpRequest = await CreateHttpRequestAsync(request).ConfigureAwait(false);
         // Send the request.
-        return await SendWithRetriesAsync(httpRequest, request.Options, cts.Token)
+        return await SendWithRetriesAsync(httpRequest, request.Options, cts.Token<% if (hasRetriesDisabledEndpoints) { %>, request.RetriesDisabled<% } %>)
             .ConfigureAwait(false);
     }
 
     internal async global::System.Threading.Tasks.Task<global::<%= namespace%>.ApiResponse> SendRequestAsync(
         HttpRequestMessage request,
         IRequestOptions? options,
-        CancellationToken cancellationToken = default
+        CancellationToken cancellationToken = default<% if (hasRetriesDisabledEndpoints) { %>,
+        bool retriesDisabled = false<% } %>
     )
     {
         // Apply the request timeout.
@@ -61,7 +62,7 @@ internal partial class RawClient(ClientOptions clientOptions)
         cts.CancelAfter(timeout);
 
         // Send the request.
-        return await SendWithRetriesAsync(request, options, cts.Token).ConfigureAwait(false);
+        return await SendWithRetriesAsync(request, options, cts.Token<% if (hasRetriesDisabledEndpoints) { %>, retriesDisabled<% } %>).ConfigureAwait(false);
     }
 
     private static async global::System.Threading.Tasks.Task<HttpRequestMessage> CloneRequestAsync(
@@ -142,11 +143,12 @@ internal partial class RawClient(ClientOptions clientOptions)
     private async global::System.Threading.Tasks.Task<global::<%= namespace%>.ApiResponse> SendWithRetriesAsync(
         HttpRequestMessage request,
         IRequestOptions? options,
-        CancellationToken cancellationToken
+        CancellationToken cancellationToken<% if (hasRetriesDisabledEndpoints) { %>,
+        bool retriesDisabled<% } %>
     )
     {
         var httpClient = options?.HttpClient ?? Options.HttpClient;
-        var maxRetries = Math.Max(0, options?.MaxRetries ?? Options.MaxRetries);
+        var maxRetries = <% if (hasRetriesDisabledEndpoints) { %>retriesDisabled ? 0 : <% } %>Math.Max(0, options?.MaxRetries ?? Options.MaxRetries);
         var isRetryableContent = IsRetryableContent(request);
 
         if (!isRetryableContent || maxRetries == 0)

generators/csharp/base/src/asIs/test/RawClientTests/RetriesTests.Template.cs

@@ -516,6 +516,38 @@ public async SystemTask SendRequestAsync_ShouldRetry_WhenHandlerDisposesRequestC
         }
     }
 
+<% if (hasRetriesDisabledEndpoints) { %>
+    [Test]
+    public async SystemTask SendRequestAsync_ShouldNotRetry_WhenRetriesDisabledForEndpoint()
+    {
+        _server
+            .Given(WireMockRequest.Create().WithPath("/test").UsingGet())
+            .RespondWith(
+                WireMockResponse
+                    .Create()
+                    .WithStatusCode(<%= retryStatusCodes === "recommended" ? 503 : 500 %>)
+                    .WithBody("Failure")
+            );
+
+        var request = new <%= namespaces.qualifiedCore %>.EmptyRequest
+        {
+            BaseUrl = _baseUrl,
+            Method = HttpMethod.Get,
+            Path = "/test",
+            Options = new global::<%= namespace%>.RequestOptions { MaxRetries = MaxRetries },
+            RetriesDisabled = true,
+        };
+
+        var response = await _rawClient.SendRequestAsync(request);
+
+        using (Assert.EnterMultipleScope())
+        {
+            Assert.That(response.StatusCode, Is.EqualTo(<%= retryStatusCodes === "recommended" ? 503 : 500 %>));
+            Assert.That(_server.LogEntries, Has.Count.EqualTo(1));
+        }
+    }
+<% } %>
+
     [TearDown]
     public void TearDown()
     {

generators/csharp/base/src/context/GeneratorContext.ts

@@ -392,6 +392,23 @@ export abstract class GeneratorContext extends AbstractGeneratorContext {
         );
     }
 
+    /**
+     * Checks if the API has any endpoints that disable retries.
+     * @returns True if the API has any endpoints configured with `retries: { disabled: true }`.
+     */
+    public get hasRetriesDisabledEndpoints(): boolean {
+        return Object.values(this.ir.services).some((service) =>
+            service.endpoints.some((endpoint) => this.areRetriesDisabled(endpoint))
+        );
+    }
+
+    /**
+     * Checks if the endpoint disables retries, regardless of the client or per-request options.
+     */
+    public areRetriesDisabled(endpoint: HttpEndpoint): boolean {
+        return endpoint.retries?.disabled === true;
+    }
+
     /**
      * Checks if the endpoint has a resumable SSE streaming result.
      */