Pulumi Release Notes

3.268.0 (2026-10-07)

Features

• [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, and providers can process them, gated by a new accepts_outputs_in_invoke handshake capability #24953
• [auto] Add version to the generated automation APIs for NodeJS, Python and Go #24990
• [auto] Add whoami to the generated automation APIs for NodeJS, Python and Go #25024
• [auto] Add install to the generated automation APIs for NodeJS, Python and Go #25038

Bug Fixes

• [engine] Restore elided asset contents from prior state when a provider echoes assets back from refresh or update #24570
• [engine] Apply resource transforms declared on an ancestor component to resources parented under a resource read #24689
• [pcl] Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time #24805
• [sdkgen/nodejs] Link @pulumi/pulumi types in generated docs to their TypeDoc pages instead of missing anchors #24928 …

3.266.0 (2026-09-30)

Bug Fixes

• [sdk/go] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #24702
• [sdk/python] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #24702
• [pcl] Order the members of a union type by a fixed structural order rather than by their printed form, so that a recursive object type prints all of its properties and diagnostics list union members consistently #24804
• [cli/new] Avoid printing the provider docs link twice in the pulumi new credentials warning #24925

Improvements

• [cli/neo] Report the console URL and update identifiers in pulumi neo pulumi_preview/pulumi_up tool results #24721
• [sdkgen] Support #/provider doc references in schema descriptions #24918

Miscellaneous

• [sdk/go] Remove workspace.Credentials.AccessTokens and read stored logins only from the accounts object of credentials.json #24922
• [sdk/dotnet] Upgrade dotnet to v3.114.1 #24926 …

3.265.0 (2026-09-25)

Features

• [cli/auth] Add pulumi logout --all --delete-credentials-key to delete the key that encrypts stored credentials from the OS credential store #24764

Bug Fixes

• [programgen/python] Generate valid Python for output-dependent resource ranges #24474
• [cli/policy] Recover from partial installs & wait for parallel installs #24705
• [cli/install] Cancel cross-process waits with Ctrl-C #24711
• [engine] Report Unknown=true on the ReadResourceResponse when a Read is skipped because one of its dependencies failed during a --continue-on-error update, so SDKs can propagate unknowns to dependents rather than treating empty outputs as real #24747
• [cli/auth] Keep encrypted credentials in other PULUMI_HOME directories readable after pulumi logout --all or pulumi login in one of them #24764
• [engine] Report Unknown=true on the register response when an Import step is skipped because one of its dependencies failed during a --continue-on-error update, so SDKs propagate unknowns to dependents rather than treating empty outputs as real #24774 …

3.264.0 (2026-09-23)

Features

• [sdk/python] Add component state migration callbacks to ResourceOptions #24331
• [cli/deployment] Allow pulumi deployment settings edit to configure git authentication, dependency caching, template sources and drift remediation #24528
• [cli/deployment] Allow pulumi deployment settings edit to configure tag triggers, review stack labels and the version control integration #24527
• [backend/service] Enable component state migrations for Pulumi Cloud updates using journal v2 #24458
• [sdk/go] Add component state migration callbacks to resource options #24519
• [sdk/nodejs] Add component state migration callbacks to resource options #24715

Bug Fixes

• [sdk/python] Discover plugins from the current uv workspace member’s dependencies #24706
• [cli] Suppress the Neo diagnostic help prompt for informational messages #24743
• [cli] Run the pulumi new credentials preflight for parameterized providers #24669 …

3.263.0 (2026-09-15)

Bug Fixes

• [cli/deployment] Stop pulumi deployment settings edit overwriting the source of stacks that use a provider other than GitHub, take --path-filter once per filter rather than splitting it on commas, and report an unconfigured stack from get instead of failing #24526
• [engine] Fix remote component provider state migrations being skipped when the caller also supplies migrations #24620
• [engine] Forward caller error hooks to remote component providers #24622
• [cli/do] Error sooner if string values can't be cast to numeric/boolean inputs #24643
• [build] Restore pr#<number> based downloads #24649
• [sdk/nodejs] Fix a panic in the pnpm package manager when pnpm config get allowBuilds prints null #24674

Improvements

• [cli] Document automatic plugin installation and list the valid KIND values in pulumi plugin install --help #24630
• [cli/plugin] Describe what pulumi plugin ls does and does not list in its help text #24631 …

3.262.0 (2026-09-10)

Features

• [engine] Support importing a pulumi:index:Stash resource. The stash adopts the given id and holds a null value, and the program's configured input then applies as an update #24544

Bug Fixes

• [auto/go] Match wrapped errors in the Automation API error predicates, and unwrap the underlying cause #24197
• [cli/deployment] Stop pulumi deployment settings edit clearing settings it was not asked to change, let --branch and --commit replace one another rather than be combined, and reject --oidc-*-clear=false instead of ignoring it #24525
• [cli] Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever #24495
• [cli] Verify TLS certificates when downloading a template from a URL outside the configured service #24504
• [engine] Propagate --target-dependents and --exclude-dependents through resources read with .get() #24538
• [engine] Run state migrations for aliased remote components #24545
• [engine] Sort resources deterministically when repairing a snapshot #24551 …

3.261.0 (2026-09-02)

Features

• [engine] Support state migration callbacks on resource registrations #24328
• [cli/env] Add pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create the ESC environments that use it #23911

Bug Fixes

• [engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID #24438
• [cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials #24476
• [pcl] Fix a crash when binding a schema property with an integer constant value #24480
• [cli/policy] Avoid hanging when policy pack fails to start up #24492
• [pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version #24499
• [sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL #24500
• [engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans #24532

Improvements …

3.260.0 (2026-08-28)

Features

• [cli/deployment] Make pulumi deployment settings get render every source kind and show environment variable values, changing the --output=json shape of environmentVariables from a list of names to a list of objects #24284
• [sdk/go] Support Go 1.27 #24401
• [cli/state] Add pulumi state promote to turn stateful snippets into Pulumi program code #24453

Bug Fixes

• [engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state #23818
• [sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs #24246
• [cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish #24268
• [programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting #24300
• [programgen/go] Generate valid struct field names for properties whose names contain hyphens #24300 …

3.259.0 (2026-08-19)

Features

• [cli/new] Show a single confirmation of project, stack, and config defaults in interactive pulumi new instead of prompting for each value #24223
• [cli] Introduce PULUMI_DEFAULT_ORGANIZATION to be able to set the default org #24384

Bug Fixes

• [cli/stack] Announce Created stack when creating a stack against the Pulumi Cloud backend #24280
• [cli] Retry pulumi neo cancellation requests that the service rejects and keep Esc responsive instead of showing "Cancelling..." forever #24267
• [cli/import] Generate a component resource definition when importing local components #24294
• [auto/nodejs] Remove Node.js Automation API output buffer limit #24333
• [sdk/go] Always emit the value and environment keys when serializing esc.Value and esc.Range, matching the fields the ESC OpenAPI contract marks required #24346
• [engine] Fix the engine returning extension package refs for non-parameterised packages against the same base #24347 …

3.258.0 (2026-08-17)

Features

• [cli] Add opt-in encryption of stored credentials with a key protected by the operating system, selected with PULUMI_CREDENTIAL_STORE #24212
• [cli/new] Ask for a cloud provider and language in interactive pulumi new instead of listing every template #24226
• [sdk/go] Add policyx.NewStackValidationPolicy and wire up the analyzer's AnalyzeStack RPC so Go policy packs can validate the full stack #24232

Bug Fixes

• [sdkgen/go] Generate valid Go package clauses for schema modules whose names contain hyphens #24288
• [sdkgen/nodejs] Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces #24288
• [cli/import] pulumi preview --import-file no longer emits unknown values, and pulumi import rejects files that contain them #24261
• [auto/python] Add missing program argument on preview_refresh and preview_destroy stack methods #24274
• [cli/new] Fix cloning templates and repositories into paths containing symlinks with absolute targets #24329 …

3.257.0 (2026-08-13)

Features

• [cli] Offer to create a first project after logging in to an account with no stacks #24133
• [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
• [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
• [cli/state] Implement pulumi state get to show individual resources #24191
• [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

Bug Fixes

• [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
• [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111 …

3.256.0 (2026-08-04)

Features

• [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #24053
• [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #24055
• [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #24107

Bug Fixes

• [backend/service] Fix pulumi login --insecure not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates #24134
• [cli] Scope current stack selection to the active backend so switching backends no longer surfaces stale stack errors #23974
• [programgen/go] Parent an invoke written inside a component to that component, lower a component's outputs, and only import fmt when a component needs it #24019 …

3.255.0 (2026-07-28)

Features

• [cli] Add an --extension flag to package commands for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install
• [cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment #23993
• [engine] Resolve an invoke's provider from the providers option of the parent named on the request, matching the resolution applied to resource registrations #24016
• [cli/do] Add --resources to refer to existing resources in state in do input expressions #24037

Bug Fixes

• [programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers #24017
• [pcl] Apply the providers option of a component block to the resources and invokes it declares #24016
• [cli/import] Fix import file generation when parent resources share names #24069
• [cli] Fix parallel pulumi install processes sharing a PULUMI_HOME intermittently failing with a missing provider executable error #24080 …

3.254.0 (2026-07-23)

Features

• [cli] Add pulumi logs share command for sharing logs with Pulumi #22546
• [cli] Add pulumi stack migrate to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider #22902
• [cli/config] Add an --override-env flag to up, preview, destroy, and refresh to substitute imported environments for a single run without editing the stack config #23562
• [cli] Add pulumi neo acp to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options #23886
• [cli/neo] Retry transient pulumi neo stream and message-send failures, and add pulumi neo resume with chat history #23835
• [cli/neo] Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in pulumi neo #23932
• [cli/do] Add upsert to do, allowing resources to be statefully created or updated in a stack #23813 …

3.253.0 (2026-07-14)

Features

• [auto/go] Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations #23833

Bug Fixes

• [sdk] Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames #23566
• [cli] Respect the -v log level again so that without -v only warnings and errors are written to stderr #23910
• [codegen] Correctly generate provider resources declared inside PCL components for Node.js, Python and Go #23904

Improvements

• [cli] Add a --version flag to the pulumi command that prints the version, same as pulumi version #23898
• [cli] Align env commands with the CLI naming guidelines, making list, remove and move the canonical names with ls, rm, delete and mv kept as aliases #23901

3.252.0 (2026-07-13)

Features

• [auto] Add import to the generated automation APIs for NodeJS, Python and Go #23876
• [cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud #23811
• [cli] Show command name for cli commands when running any command that lists logs #23889
• [cli/display] Render strings containing non-UTF8 bytes as b"<base64>" in diffs and JSON output #23870
• [cli/env] Add a --reason flag to pulumi env open-request to explain the request to approvers #23802
• [cli/state] Improve the error message when a resource URN is not found in the state for pulumi state commands, suggesting close-matching URNs and how to list the URNs in the stack #23812
• [pcl] Allow binding hooks to a resource's onError option #23838
• [sdk/nodejs] Add a production runtime option for Node.js projects. When set to true in Pulumi.yaml, pulumi install skips devDependencies (npm --production, pnpm --production, yarn --production). #23849

Bug Fixes …

3.251.0 (2026-07-08)

Bug Fixes

• [cli] Show a retain marker for retain-on-delete resources in --diff output #23754
• [cli] Don't miscopy out archives #23798

Miscellaneous

• [cli] Add pulumi neo --debug-update and pulumi neo --debug-preview flags to investigate a failed update or preview, suggested in the failure output #23499

Improvements

• [cli/convert] Add an ecosystem field to converter mapping requests so a converter can request mappings for the ecosystem it consumes rather than its own name #23804
• [cli/deployment] pulumi deployment settings no longer writes the local Pulumi.<stack>.deploy.yaml file: the experimental init, pull, configure, and env subcommands have been removed, and the CLI no longer calls the deployment-settings encrypt endpoint. get/edit/destroy continue to manage settings directly in Pulumi Cloud #23480 …