3.274.0 (2026-11-03) Features [cli/policy] Add pulumi policy get to show a policy pack's policies #25297 [cli/policy] Add --output json to pulumi policy publish, enable, disable, rm and validate-config, and print the updated policy group after enable and disable #25347 [cli/policy] Add --stack-rule and --account-rule to pulumi policy group new and edit, and show match rules in policy group console…
Harvest propertyDependencies from OutputValue inputs on RegisterResou…
Harvest propertyDependencies from OutputValue inputs on RegisterResou…
Co-authored-by: github-actions github-actions@github.com
3.273.0 (2026-10-28) Features [auto] Add up to the generated automation APIs for NodeJS, Python and Go #25055 [auto] Add logs commands to the generated automation APIs for NodeJS, Python and Go #25065 [pcl] Add a resourceExists builtin that checks whether a resource with a given ID exists without adopting it into the stack #25321 [sdkgen/nodejs] Generate static exists methods that check whether a…
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | golang.org/x/net | v0.60.0 → v0.62.0 | | | | golang.org/x/net | v0.61.0 → v0.62.0 | | | WarningSome dependencies could not be looked up. Check the Dependency Dashboard for more information. Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net CVE-2026-78661 / GO-2026-686…
Co-authored-by: github-actions github-actions@github.com
3.272.0 (2026-10-22) Features [cli/display] Collapse policy violations that an exception exempts under Policies: into one line per policy, and add --show-policy-exceptions to up and preview to list them with their exceptions #25290 [engine] Add an AwaitError provider protocol error indicating an operation needs to be awaited; the deployment continues, the resource's outputs are unknown, and the CL…
A remote component's output that depends on a child resource that's awaiting (or failed, or skipped) is unknown during an update, but the calling program saw it as an empty value, so apply callbacks and dependent resources ran too early with the wrong value. The unknown was lost in four places: The Go provider SDK only kept unknowns in its Construct response during previews. The engine only kept u…
Co-authored-by: github-actions github-actions@github.com
3.271.0 (2026-10-21) Features [engine] Add an id field to ReadResourceResponse so providers can return a resolved id that differs from the one supplied on the request; SDKs now surface this id via .id and resolve it as unknown when empty during preview #25228 [cli/policy] Create version 2 of the --policy-pack-config format, nesting policy configs under policies and adding an exceptions field #2528…
Remove the env exclusion from automation-overrides.json and regenerate the NodeJS, Python and Go automation APIs. 🤖 Generated with Claude Code Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
Co-authored-by: github-actions github-actions@github.com
3.270.0 (2026-10-16) Bug Fixes [cli/env] Fix pulumi env edit, env set, env rm and env provider overwriting changes made after they read the environment; on a conflict, env edit reopens the editor with your edits and the current definition, and the others fail #24983 [cli] Report an unknown drift status in pulumi stack drift status when drift detection has never run #25172
Restores 3.270.0 but doesn't add the lock file, so doesn't trigger a release. 🤖 Generated with Claude Code Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
Co-authored-by: github-actions github-actions@github.com
Reverts #25245 🤖 Generated with Claude Code Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
Reverts #25245 🤖 Generated with Claude Code Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
Co-authored-by: github-actions github-actions@github.com Co-authored-by: Thomas Gummerer t.gummerer@gmail.com Co-authored-by: Claude Opus 5.5 (1M context) noreply@anthropic.com
3.268.0 (2026-10-07) Features [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, and providers can process them, gated by a new accepts_outputs_in_invoke handshake capability #24953 [auto] Add version to the generated automation APIs for NodeJS, Python and Go #24990 [auto] Add whoami to the generated automation APIs for N…
Maven 3.10 has a bug, where it ignores -Dorg.slf4j.simpleLogger.logFile=System.err, and thus writes everything to stdout. This breaks pulumi-java plugin downloads, as the JSON is now mixed with the regular output and we can't parse it properly. I've reported the bug upstream in apache/maven#13380. If we can't get it fixed upstream, we can patch pulumi-java to just not show any output, but I think…
Co-authored-by: github-actions github-actions@github.com
3.267.0 (2026-10-01) Bug Fixes [cli/new] Fix concurrent pulumi new runs failing to clone the templates repository #24939 [sdk/python] Fix pulumi install for Python plugins and policy packs that use the uv toolchain and a [build-system] table #24951
There are no actual changes to the actual tests Move TestGetCurrentCloudURL… tests move from pkg/cmd/pulumi/backend/backend_test.go to pkg/workspace/creds_test.go, since they test GetCurrentCloudURLWithAgentFallback from pkg/workspace/creds.go Split login tests out of pkg/backend/httpstate/backend_test.go into login_{,refresh,agent,oidcs}_test.go
Co-authored-by: github-actions github-actions@github.com
3.266.0 (2026-09-30) Bug Fixes [sdk/go] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #24702 [sdk/python] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #24702 [pcl] Order the members of a union type by a fixed structural order rather than by their printed form, so tha…
Continuing the property.Map migration.
Co-authored-by: github-actions github-actions@github.com
3.265.0 (2026-09-25) Features [cli/auth] Add pulumi logout --all --delete-credentials-key to delete the key that encrypts stored credentials from the OS credential store #24764 Bug Fixes [programgen/python] Generate valid Python for output-dependent resource ranges #24474 [cli/policy] Recover from partial installs & wait for parallel installs #24705 [cli/install] Cancel cross-process waits with Ct…
Part of IAC-4046 None of the .exe files we ship for Windows have ever been Authenticode-signed. Only the winget MSI container is, and it wraps the same unsigned zip. Defender is now quarantining pulumi-language-bun.exe as a trojan for customers. It's a false positive (the binary reproduces byte-for-byte from source), but it will keep happening to small unsigned launchers until we sign them. The an…