[pull] main from fern-api:main

.github/workflows/fix-lint.yml

@@ -53,29 +53,12 @@ jobs:
         id: cpr
         uses: peter-evans/create-pull-request@v8
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.FERN_SUPPORT_GH_ACTIONS_PAT }}
           commit-message: "fix(lint): auto-fix lint issues"
           title: "fix(lint): auto-fix lint issues"
           branch: automated-lint-fixes
           delete-branch: true
 
-      # GITHUB_TOKEN does not trigger pull_request events, so we re-trigger
-      # CI on the PR branch using a PAT so required checks can run.
-      - name: Trigger CI on PR branch
-        if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.FERN_SUPPORT_GH_ACTIONS_PAT }}
-        run: |
-          gh workflow run "CI" --ref automated-lint-fixes
-
-      # Give the dispatched workflow time to register check runs on the PR
-      # before the auto-approve action starts polling.
-      - name: Wait for CI checks to register
-        if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
-        shell: bash
-        run: sleep 60
-
       - name: Enable Pull Request Automerge
         if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
         uses: peter-evans/enable-pull-request-automerge@v3
@@ -88,7 +71,7 @@ jobs:
         if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
         uses: ./.github/actions/auto-approve
         with:
-          approver-gh-token: ${{ secrets.FERN_SUPPORT_GH_ACTIONS_PAT }}
+          approver-gh-token: ${{ secrets.GITHUB_TOKEN }}
           pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
           enforced-checks: lint
           enforce-checks: "true"

.github/workflows/update-seed.yml

@@ -1109,7 +1109,7 @@ jobs:
         id: cpr
         uses: peter-evans/create-pull-request@v8
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.FERN_SUPPORT_GH_ACTIONS_PAT }}
           commit-message: "chore(seed): update all seed snapshots"
           title: "chore(seed): update all seed snapshots"
           branch: update-all-seed
@@ -1132,17 +1132,6 @@ jobs:
         run: |
           echo "PR Created: ${{ steps.cpr.outputs.pull-request-url }}"
 
-      # GITHUB_TOKEN does not trigger pull_request events, so we re-trigger
-      # CI on the PR branch using a PAT so required checks can run.
-      - name: Trigger CI on PR branch
-        if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.FERN_SUPPORT_GH_ACTIONS_PAT }}
-        run: |
-          gh workflow run "CI" --ref update-all-seed
-          gh workflow run "Seed Snapshot Tests" --ref update-all-seed
-
       - name: Enable Pull Request Automerge
         if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
         uses: peter-evans/enable-pull-request-automerge@v3
@@ -1155,5 +1144,5 @@ jobs:
         if: steps.cpr.outputs.pull-request-operation == 'created' || steps.cpr.outputs.pull-request-operation == 'updated'
         uses: ./.github/actions/auto-approve
         with:
-          approver-gh-token: ${{ secrets.FERN_SUPPORT_GH_ACTIONS_PAT }}
+          approver-gh-token: ${{ secrets.GITHUB_TOKEN }}
           pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}

generators/python/sdk/changes/5.14.19/bump-aiohttp-3.14.1.yml

@@ -0,0 +1,3 @@
+- summary: |
+    Bump aiohttp lower bound from >=3.14.0 to >=3.14.1 to fix CVE-2026-54274.
+  type: fix

generators/python/sdk/versions.yml

@@ -1,4 +1,11 @@
 # yaml-language-server: $schema=../../../fern-versions-yml.schema.json
+- version: 5.14.19
+  changelogEntry:
+    - summary: |
+        Bump aiohttp lower bound from >=3.14.0 to >=3.14.1 to fix CVE-2026-54274.
+      type: fix
+  createdAt: "2026-06-16"
+  irVersion: 67
 - version: 5.14.18
   changelogEntry:
     - summary: |

generators/python/src/fern_python/generators/sdk/sdk_generator.py

@@ -151,7 +151,7 @@ def run(
             dependency=AST.Dependency(name="httpx-aiohttp", version="0.1.8", optional=True, python=">=3.10")
         )
         project.add_dependency(
-            dependency=AST.Dependency(name="aiohttp", version=">=3.14.0,<4", optional=True, python=">=3.10")
+            dependency=AST.Dependency(name="aiohttp", version=">=3.14.1,<4", optional=True, python=">=3.10")
         )
 
         for dep, bas_dep_value in custom_config.extra_dev_dependencies.items():

generators/typescript/sdk/changes/3.72.5/bump-form-data-4.0.6.yml

@@ -0,0 +1,4 @@
+- summary: |
+    Bump form-data dependency from ^4.0.4 to ^4.0.6 in generated SDKs to fix
+    CRLF injection vulnerability (CVE-2026-12143).
+  type: chore

generators/typescript/sdk/versions.yml

@@ -1,4 +1,12 @@
 # yaml-language-server: $schema=../../../fern-versions-yml.schema.json
+- version: 3.72.5
+  changelogEntry:
+    - summary: |
+        Bump form-data dependency from ^4.0.4 to ^4.0.6 in generated SDKs to fix
+        CRLF injection vulnerability (CVE-2026-12143).
+      type: chore
+  createdAt: "2026-06-16"
+  irVersion: 67
 - version: 3.72.4
   changelogEntry:
     - summary: |

generators/typescript/utils/commons/src/core-utilities/Fetcher.ts

@@ -172,7 +172,7 @@ export const MANIFEST: CoreUtility.Manifest = {
     pathInCoreUtilities: { nameOnDisk: "fetcher", exportDeclaration: { exportAll: true } },
     addDependencies: (dependencyManager: DependencyManager, { formDataSupport, streamType, fetchSupport }): void => {
         if (formDataSupport === "Node16") {
-            dependencyManager.addDependency("form-data", "^4.0.4");
+            dependencyManager.addDependency("form-data", "^4.0.6");
             dependencyManager.addDependency("formdata-node", "^6.0.3");
         }
 

generators/typescript/utils/commons/src/core-utilities/FormDataUtils.ts

@@ -28,7 +28,7 @@ export const MANIFEST: CoreUtility.Manifest = {
     pathInCoreUtilities: { nameOnDisk: "form-data-utils", exportDeclaration: { exportAll: true } },
     addDependencies: (dependencyManager: DependencyManager, { formDataSupport }): void => {
         if (formDataSupport === "Node16") {
-            dependencyManager.addDependency("form-data", "^4.0.4");
+            dependencyManager.addDependency("form-data", "^4.0.6");
             dependencyManager.addDependency("formdata-node", "^6.0.3");
             dependencyManager.addDependency("form-data-encoder", "^4.1.0");
         }

package.json

@@ -139,6 +139,11 @@
     "nanoid": "3.3.8",
     "yaml": "2.8.3"
   },
+  "pnpm": {
+    "overrides": {
+      "js-yaml@4.1.1": "4.2.0"
+    }
+  },
   "workspaces": [
     "packages/**",
     "generators/**",