fix(deps): update module github.com/pulumi/pulumi/pkg/v3 to v3.270.0

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/pulumi/pulumi/pkg/v3	v3.11.0 → v3.270.0

---

Release Notes

pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)

v3.270.0

Compare Source

3.270.0 (2026-10-16)

Bug Fixes

• [cli/env] Fix pulumi env edit, env set, env rm and env provider overwriting changes made after they read the environment; on a conflict, env edit reopens the editor with your edits and the current definition, and the others fail #​24983
• [cli] Report an unknown drift status in pulumi stack drift status when drift detection has never run #​25172

v3.269.0

Compare Source

v3.268.0

Compare Source

3.268.0 (2026-10-07)

Features

• [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, and providers can process them, gated by a new accepts_outputs_in_invoke handshake capability #​24953
• [auto] Add version to the generated automation APIs for NodeJS, Python and Go #​24990
• [auto] Add whoami to the generated automation APIs for NodeJS, Python and Go #​25024
• [auto] Add install to the generated automation APIs for NodeJS, Python and Go #​25038

Bug Fixes

• [engine] Restore elided asset contents from prior state when a provider echoes assets back from refresh or update #​24570
• [engine] Apply resource transforms declared on an ancestor component to resources parented under a resource read #​24689
• [pcl] Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time #​24805
• [sdkgen/nodejs] Link @pulumi/pulumi types in generated docs to their TypeDoc pages instead of missing anchors #​24928
• [engine] Fix snapshot integrity error when untargeted steps change dependencies in the program #​24801
• [sdk/nodejs] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #​24977
• [sdk/python] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #​24977
• [cli/package] Download plugins from Git repositories whose version tags have no v prefix #​24986
• [engine] Fix a language host process leak when the schema loader boots a plugin that runs in a language host #​25002
• [sdkgen] Reject schemas that define a resource named provider in the root module through moduleFormat, instead of panicking during SDK generation #​25020
• [engine] Shut down plugins in parallel to avoid timeouts #​25026
• [cli/plugin] Fix plugin checksum verification rejecting valid downloads over HTTP/1.1 and ignoring data at the end of the archive #​25032
• [cli/new] Fix spurious provider "exited prematurely" error from the pulumi new credentials check, which no longer has a timeout #​25030
• [auto] Fix project settings in projects that live in symlinked directories #​25046

Improvements

• [backend/service] Send the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set #​25009

Miscellaneous

• [java] Upgrade java to v1.37.4 #​25027
• [yaml] Upgrade yaml to v1.38.9 #​25027
• [hcl] Upgrade hcl to v0.18.4 #​25027
• [sdk/dotnet] Upgrade dotnet to v3.114.2 #​25034

v3.267.0

Compare Source

3.267.0 (2026-10-01)

Bug Fixes

• [cli/new] Fix concurrent pulumi new runs failing to clone the templates repository #​24939
• [sdk/python] Fix pulumi install for Python plugins and policy packs that use the uv toolchain and a [build-system] table #​24951

v3.266.0

Compare Source

3.266.0 (2026-09-30)

Bug Fixes

• [sdk/go] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #​24702
• [sdk/python] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #​24702
• [pcl] Order the members of a union type by a fixed structural order rather than by their printed form, so that a recursive object type prints all of its properties and diagnostics list union members consistently #​24804
• [cli/new] Avoid printing the provider docs link twice in the pulumi new credentials warning #​24925

Improvements

• [cli/neo] Report the console URL and update identifiers in pulumi neo pulumi_preview/pulumi_up tool results #​24721
• [sdkgen] Support #/provider doc references in schema descriptions #​24918

Miscellaneous

• [sdk/go] Remove workspace.Credentials.AccessTokens and read stored logins only from the accounts object of credentials.json #​24922
• [sdk/dotnet] Upgrade dotnet to v3.114.1 #​24926
• [java] Upgrade java to v1.37.3 #​24926
• [yaml] Upgrade yaml to v1.38.8 #​24926
• [hcl] Upgrade hcl to v0.18.3 #​24926

v3.265.0

Compare Source

3.265.0 (2026-09-25)

Features

• [cli/auth] Add pulumi logout --all --delete-credentials-key to delete the key that encrypts stored credentials from the OS credential store #​24764

Bug Fixes

• [programgen/python] Generate valid Python for output-dependent resource ranges #​24474
• [cli/policy] Recover from partial installs & wait for parallel installs #​24705
• [cli/install] Cancel cross-process waits with Ctrl-C #​24711
• [engine] Report Unknown=true on the ReadResourceResponse when a Read is skipped because one of its dependencies failed during a --continue-on-error update, so SDKs can propagate unknowns to dependents rather than treating empty outputs as real #​24747
• [cli/auth] Keep encrypted credentials in other PULUMI_HOME directories readable after pulumi logout --all or pulumi login in one of them #​24764
• [engine] Report Unknown=true on the register response when an Import step is skipped because one of its dependencies failed during a --continue-on-error update, so SDKs propagate unknowns to dependents rather than treating empty outputs as real #​24774
• [sdkgen/nodejs] Fix generated Node.js SDK compilation for self-referencing resource inputs #​24752
• [pcl] Fix a panic when a PCL program indexes a tuple literal with an index equal to its length #​24755
• [pcl] Fix a binder panic on nested tuple literals of different shapes, and unify collection literals that hold different constants into one collection type so they can be iterated #​24756
• [pcl] Fix the length built-in in the PCL interpreter to accept objects and maps #​24757
• [pcl] Add the range built-in to the PCL interpreter #​24758
• [pcl] Type min and max as number when any argument is a non-integer literal #​24759
• [pcl] Report an error when a number or bool literal is assigned to a property whose schema constant or enum does not admit it #​24761
• [pcl] Report a type mismatch on a resource input property that the resource does not also declare as an output #​24765
• [pcl] Allow a resource to be assigned to a plain property typed as a reference to its resource type #​24763
• [pcl] Type a quoted string with no interpolation as a constant so string constants and string enums are validated at bind time #​24766
• [programgen] Fix length on output values in generated programs, and count the keys of maps and objects in generated Node.js programs #​24757
• [sdk/go] Fix policy analyzer config schema serialization for Go analyzers #​24775
• [programgen] Fill the lists that range produces in Node.js programs #​24758
• [pcl] Fix PCL type conversion checks whose result depended on whether the same types had been unified first #​24793
• [sdk/nodejs] Fix closure serialization for __importStar-wrapped cached modules #​24797

Improvements

• [pcl] Name the constant or the enum members a resource property admits when a literal does not match it #​24770
• [cli/install] Authenticode-sign the Windows CLI and language host binaries #​24785

v3.264.0

Compare Source

3.264.0 (2026-09-23)

Features

• [sdk/python] Add component state migration callbacks to ResourceOptions #​24331
• [cli/deployment] Allow pulumi deployment settings edit to configure git authentication, dependency caching, template sources and drift remediation #​24528
• [cli/deployment] Allow pulumi deployment settings edit to configure tag triggers, review stack labels and the version control integration #​24527
• [backend/service] Enable component state migrations for Pulumi Cloud updates using journal v2 #​24458
• [sdk/go] Add component state migration callbacks to resource options #​24519
• [sdk/nodejs] Add component state migration callbacks to resource options #​24715

Bug Fixes

• [sdk/python] Discover plugins from the current uv workspace member’s dependencies #​24706
• [cli] Suppress the Neo diagnostic help prompt for informational messages #​24743
• [cli] Run the pulumi new credentials preflight for parameterized providers #​24669
• [cli/env] Reference pulumi env rather than the retired standalone esc CLI in pulumi env messages and help text #​24699
• [cli/deployment] Allow pulumi deployment settings edit to move a stack configured against a repository URL onto a version control integration #​24529
• [cli/deployment] Stop pulumi deployment settings get padding its output for labels it does not print #​24448
• [sdk/go] Serialize ESC boolean schemas as their equivalent object forms ({} for "always", {"not":{}} for "never") instead of bare JSON booleans, so schema-carrying payloads are valid instances of the OpenAPI models that describe them #​24613
• [sdk/go] Run Go policy remediations only at the remediate enforcement level #​24647
• [engine] Avoid trying to delete resources PendingReplacement #​24588
• [backend/diy] Fix path handling with absolute paths #​24628
• [pkg] Interpret documentation references on lazily-loaded packages after they are fully bound, and resolve references to members that have not been loaded yet #​24682
• [engine] Update the partially created resource instead of creating another one when an OnError hook retries a create #​24684
• [engine] Preserve root-first state ordering between chained state migration callbacks #​24695
• [sdk/go] Propagate the dependsOn resource option on ReadResource calls #​24725
• [pcl] Propagate the dependsOn resource option on read blocks #​24725
• [cli/neo] Skip the redundant preview step when pulumi neo runs the pulumi_up tool #​24719
• [sdkgen/go] Set the default plugin version when the schema sets a Go language option #​24733
• [cli/package] Stop leaking package processes from pulumi package get-schema #​24741
• [cli] Remove the prompt to create a first project after an interactive login #​24742
• [engine] When a Read is skipped because one of its dependencies failed during a --continue-on-error update, return the resource's last-known outputs to the SDK if it is already present in state, rather than an empty output map #​24745

Improvements

• [backend/service] Improve startup performance #​24417
• [sdk/go] Remove policyx.ResourceValidationArgs.DryRun as it was never correctly set #​24673
• [engine] Report planned and applied state migrations through user-facing diagnostics #​24713
• [cli] Make all commands start slightly faster #​24736

Miscellaneous

• [engine] Retire the SKIP value from the RegisterResourceResponse.Result protobuf enum; dependency-skipped resources now report FAIL to the SDK, which matches how every language SDK already interpreted SKIP #​24688
• [java] Upgrade java to v1.37.2 #​24729
• [hcl] Upgrade hcl to v0.18.1 #​24729
• [yaml] Upgrade yaml to v1.38.7 #​24735
• [hcl] Upgrade hcl to v0.18.2 #​24735
• [sdk/dotnet] Upgrade dotnet to v3.114.0 #​24737
• [yaml] Upgrade yaml to v1.38.7 #​24737
• [hcl] Upgrade hcl to v0.18.2 #​24737

v3.263.0

Compare Source

3.263.0 (2026-09-15)

Bug Fixes

• [cli/deployment] Stop pulumi deployment settings edit overwriting the source of stacks that use a provider other than GitHub, take --path-filter once per filter rather than splitting it on commas, and report an unconfigured stack from get instead of failing #​24526
• [engine] Fix remote component provider state migrations being skipped when the caller also supplies migrations #​24620
• [engine] Forward caller error hooks to remote component providers #​24622
• [cli/do] Error sooner if string values can't be cast to numeric/boolean inputs #​24643
• [build] Restore pr# based downloads #​24649
• [sdk/nodejs] Fix a panic in the pnpm package manager when pnpm config get allowBuilds prints null #​24674

Improvements

• [cli] Document automatic plugin installation and list the valid KIND values in pulumi plugin install --help #​24630
• [cli/plugin] Describe what pulumi plugin ls does and does not list in its help text #​24631
• [cli] Reframe pulumi plugin help around automatic plugin installation and link the plugin-authoring docs #​24632
• [cli] Protect resources retained by pulumi state promote so a subsequent update cannot delete them before the generated code is added to the program #​24640
• [cli/env] Prompt for the ESC project and environment names in pulumi env setup, ask how to authenticate before choosing an access level, and print a success message when setup completes #​24662

Miscellaneous

• [java] Upgrade java to v1.37.1 #​24659
• [hcl] Upgrade hcl to v0.18.0 #​24659
• [yaml] Upgrade yaml to v1.38.6 #​24661
• [sdk/dotnet] Upgrade dotnet to v3.113.3 #​24672

v3.262.0

Compare Source

3.262.0 (2026-09-10)

Features

• [engine] Support importing a pulumi:index:Stash resource. The stash adopts the given id and holds a null value, and the program's configured input then applies as an update #​24544

Bug Fixes

• [auto/go] Match wrapped errors in the Automation API error predicates, and unwrap the underlying cause #​24197
• [cli/deployment] Stop pulumi deployment settings edit clearing settings it was not asked to change, let --branch and --commit replace one another rather than be combined, and reject --oidc-*-clear=false instead of ignoring it #​24525
• [cli] Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever #​24495
• [cli] Verify TLS certificates when downloading a template from a URL outside the configured service #​24504
• [engine] Propagate --target-dependents and --exclude-dependents through resources read with .get() #​24538
• [engine] Run state migrations for aliased remote components #​24545
• [engine] Sort resources deterministically when repairing a snapshot #​24551
• [engine] Fix state migration ordering for components interleaved with other resources #​24552
• [sdk] Allow Automation API project settings to use any language runtime #​24559
• [engine] Redact secret property values in violates plan error messages unless --show-secrets is passed #​24567
• [cli] Treat a resource provider attached through PULUMI_DEBUG_PROVIDERS as installed, so package installation does not try to download it #​24572
• [cli] Install the packages a local plugin directory requires before the plugin is installed and run #​24576
• [engine] Avoid a deadlock when a resource provider asks the engine to load another plugin while it boots #​24571
• [engine] Allow component state migrations to split managed state using compatible existing resource identities #​24582
• [sdk/go] Allow outputs and prompt values to be marshalled into fields typed as input interfaces, such as pulumi.StringInput #​24577
• [backend/diy] Make sure disableSSL doesn't override explicitly specified protocols #​24593
• [cli] Fix pulumi install for a project that requires a resource provider attached through PULUMI_DEBUG_PROVIDERS #​24604
• [cli] Resolve a project's relative plugin and package paths against the project directory when a plugin starts from a subdirectory of the project #​24596
• [sdk/go] Report the source position of the user code that calls a generated resource getter instead of the getter body #​24602
• [engine] Normalize successor references between chained component state migration callbacks #​24598
• [cli/new] Error out on ambiguous template names instead of failing silently #​24607

Improvements

• [cli/plugin] Correct pulumi plugin rm help text to note that the CLI re-downloads removed plugins automatically #​24618
• [cli] Add --filter to pulumi api list to filter endpoints by keyword #​24594
• [cli/new] Warn in interactive pulumi new when cloud credentials are missing or invalid for providers that opt in via the new validateCredentialsOnNew and configurationDocsUrl schema fields #​24456
• [sdk/nodejs] Add helper methods to transform ResourceOptions to InvokeOptions #​24534
• [cli] Read stack outputs for stack references through the Pulumi Cloud stack outputs endpoint when the service advertises it, instead of exporting the whole deployment #​24554
• [sdkgen/python] Replace parver with packaging in generated Python SDKs #​24585
• [ci] Skip the unconsumed release-binary rebuild on pull requests #​24595
• [engine] Run provider configuration as part of provider create steps so errors are returned associated with the provider resource, not the first resource that uses it #​24556
• [backend/service] Improve error messages if default org is invalid #​24605

Miscellaneous

• [sdk/dotnet] Upgrade dotnet to v3.113.2 #​24590
• [java] Upgrade java to v1.37.0 #​24590
• [hcl] Upgrade hcl to v0.17.0 #​24590

v3.261.0

Compare Source

3.261.0 (2026-09-02)

Features

• [engine] Support state migration callbacks on resource registrations #​24328
• [cli/env] Add pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create the ESC environments that use it #​23911

Bug Fixes

• [engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID #​24438
• [cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials #​24476
• [pcl] Fix a crash when binding a schema property with an integer constant value #​24480
• [cli/policy] Avoid hanging when policy pack fails to start up #​24492
• [pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version #​24499
• [sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL #​24500
• [engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans #​24532

Improvements

• [sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed Sequence[Any] and a scalar union Any, while the matching getters on the generated Args classes were already typed #​24485
• [sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names #​24484
• [sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error #​24507
• [engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability #​24524
• [sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions #​24533

Miscellaneous

• [java] Upgrade java to v1.36.3 #​24509
• [yaml] Upgrade yaml to v1.38.5 #​24509
• [sdk/dotnet] Upgrade dotnet to v3.113.1 #​24512

v3.260.0

Compare Source

3.260.0 (2026-08-28)

Features

• [cli/deployment] Make pulumi deployment settings get render every source kind and show environment variable values, changing the --output=json shape of environmentVariables from a list of names to a list of objects #​24284
• [sdk/go] Support Go 1.27 #​24401
• [cli/state] Add pulumi state promote to turn stateful snippets into Pulumi program code #​24453

Bug Fixes

• [engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state #​23818
• [sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs #​24246
• [cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish #​24268
• [programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting #​24300
• [programgen/go] Generate valid struct field names for properties whose names contain hyphens #​24300
• [sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them #​24300
• [cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked #​24318
• [sdk/go] Use resolved environment names when evaluating ESC imports #​24375
• [codegen/pcl] Allow output-typed values for the id attribute of a read resource #​24386
• [sdkgen/nodejs] Register resolvers for output-only properties in generated Resource.get so they resolve as unknown during preview when the id is unknown #​24386
• [engine] Avoid replacing imported resources when an input changes from plain to a secret or output-wrapped value with the same inner value #​24387
• [backend/diy] Keep DIY backend stacks readable when checkpoint compression transitions fail #​24383
• [cli/stack] Give a clearer error message when selecting a stack by name outside a directory with a Pulumi.yaml project file #​24394
• [sdk/python] Propagate runtime context across thread boundaries #​24403
• [programgen/python] Name plain function input object types without the Args suffix, matching the name the generated SDK exports #​24440
• [cli/new] Reject zip template entries that resolve outside the extraction directory #​24447
• [cli/package] Keep a package's pluginDownloadURL in SDKs regenerated by pulumi install #​24432
• [sdk/python] Preserve all providers passed to remote components in Python programs #​24443
• [sdkgen] Apply schema defaults to generated Python and Node.js function inputs #​24452
• [programgen/python] Mark required component inputs as required in generated Python TypedDicts #​24459
• [programgen/python] Add type annotations for config variables default values coming from invokes #​24464
• [programgen/python] Generate valid Python when a component with inputs instantiates another component #​24466
• [cli/neo] Stop the running local tool immediately when a Neo task is cancelled and report it as cancelled #​24470
• [programgen/python] Support final argument expansion for min and max in Python programs #​24471

Improvements

• [cli] Treat adjacent character swaps as a single typo when suggesting commands #​23899
• [sdk/python] Correctly resolve discriminated unions by their tag #​24352
• [sdk/python] Allow transforms to be mocked #​24406
• [sdk/nodejs] Allow transforms to be mocked #​24415
• [sdk/go] Allow transforms to be mocked #​24416
• [sdkgen] Allow hyphens in the member segment of tokens, so resource, object type and function names can be kebab-case #​24440
• [cli] Print secret provider information with other stack information #​24430
• [auto/python] Allow refresh, preview_refresh, and preview_destroy to request rich diffs #​24445
• [engine] Cache provider mapping results on disk so repeated plans do not boot a provider to re-fetch an unchanged mapping #​24462
• [sdk/python] Improve stack traces for providers #​24465

Miscellaneous

• [sdk/dotnet] Upgrade dotnet to v3.113.0 #​24441
• [java] Upgrade java to v1.36.2 #​24441
• [yaml] Upgrade yaml to v1.38.4 #​24441

v3.259.0

Compare Source

3.259.0 (2026-08-19)

Features

• [cli/new] Show a single confirmation of project, stack, and config defaults in interactive pulumi new instead of prompting for each value #​24223
• [cli] Introduce PULUMI_DEFAULT_ORGANIZATION to be able to set the default org #​24384

Bug Fixes

• [cli/stack] Announce Created stack when creating a stack against the Pulumi Cloud backend #​24280
• [cli] Retry pulumi neo cancellation requests that the service rejects and keep Esc responsive instead of showing "Cancelling..." forever #​24267
• [cli/import] Generate a component resource definition when importing local components #​24294
• [auto/nodejs] Remove Node.js Automation API output buffer limit #​24333
• [sdk/go] Always emit the value and environment keys when serializing esc.Value and esc.Range, matching the fields the ESC OpenAPI contract marks required #​24346
• [engine] Fix the engine returning extension package refs for non-parameterised packages against the same base #​24347
• [cli/neo] Fix approval replies and mode changes being silently dropped when the outbound event queue is full #​24370
• [codegen/go] Fix nondeterministic Go program codegen for objects that mix null and typed properties #​24366
• [cli/do] Keep snippets when delete fails, so delete can be retried #​24271
• [cli/package] Report every schema validation error when pulumi package add fails to bind a package schema #​24367
• [programgen/python] Fix casing of local component outputs #​24379
• [cli/policy] Make policy group ls respect the default org #​24385

Improvements

• [cli] Explain which state backend pulumi login failed against, where that backend was configured, and how to change it #​24322
• [backend/diy] Report the state backend URL as configured when it cannot be opened, adding the resolved form when normalization changed it, and name a local path a state directory rather than a bucket #​24335
• [sdkgen/python] Type constant properties as Literal[value] instead of their primitive type #​24358
• [cli/plugin] Add --parallel flag to pulumi plugin install #​24369
• [cli] Fix progress bar rendering for parallel plugin installs #​24372

v3.258.0

Compare Source

3.258.0 (2026-08-17)

Features

• [cli] Add opt-in encryption of stored credentials with a key protected by the operating system, selected with PULUMI_CREDENTIAL_STORE #​24212
• [cli/new] Ask for a cloud provider and language in interactive pulumi new instead of listing every template #​24226
• [sdk/go] Add policyx.NewStackValidationPolicy and wire up the analyzer's AnalyzeStack RPC so Go policy packs can validate the full stack #​24232

Bug Fixes

• [sdkgen/go] Generate valid Go package clauses for schema modules whose names contain hyphens #​24288
• [sdkgen/nodejs] Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces #​24288
• [cli/import] pulumi preview --import-file no longer emits unknown values, and pulumi import rejects files that contain them #​24261
• [auto/python] Add missing program argument on preview_refresh and preview_destroy stack methods #​24274
• [cli/new] Fix cloning templates and repositories into paths containing symlinks with absolute targets #​24329
• [cli/do] Fix global project lookup #​24334

Improvements

• [sdk/python] Use the resource monitor's advertised feature set consistently throughout the Python SDK #​24308

Miscellaneous

• [cli] Rewrite the pulumi login and pulumi logout help text to cover all supported state backends and document PULUMI_ACCESS_TOKEN, --default-org, and --interactive #​24319

v3.257.0

Compare Source

3.257.0 (2026-08-13)

Features

• [cli] Offer to create a first project after logging in to an account with no stacks #​24133
• [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #​24184
• [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #​24295
• [cli/state] Implement pulumi state get to show individual resources #​24191
• [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #​24231

Bug Fixes

• [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #​24060
• [cli] Make 'pulumi stack history events --summary report the program errors from the language host #​24111
• [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #​24180
• [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #​24189
• [sdk/go] Fix panics in hooks to not crash the entire process #​24218
• [programgen/go] for expressions are now generated as Go loops #​24228
• [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #​24227
• [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #​24230
• [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #​24236
• [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #​24235
• [cli/display] Show the value being added when a refresh or provider diff reports an added property #​24245
• [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #​24251
• [engine] Show secrets in diff display when --show-secrets is passed #​24253
• [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #​24276

Improvements

• [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits #​24082
• [cli] Pass the invoked command (e.g. pulumi new) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them #​24192

Miscellaneous

• [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's #​24143
• [java] Upgrade java to v1.35.0 #​24202
• [backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. #​24216
• [java] Upgrade java to v1.36.0 #​24243
• [sdk/dotnet] Upgrade dotnet to v3.111.1 #​24249

v3.256.0

Compare Source

3.256.0 (2026-08-04)

Features

• [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #​24053
• [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #​24055
• [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #​24107

Bug Fixes

• [backend/service] Fix pulumi login --insecure not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates #​24134
• [cli] Scope current stack selection to the active backend so switching backends no longer surfaces stale stack errors #​23974
• [programgen/go] Parent an invoke written inside a component to that component, lower a component's outputs, and only import fmt when a component needs it #​24019
• [programgen/python] Parent an invoke written inside a component to that component, so it resolves the component's providers #​24018
• [sdk/nodejs] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine #​24042
• [engine] Gate invokes on the created-ness of their declared dependencies, including the children of remote components, resolving them as unknown during previews that still have to create them #​24040
• [sdk/go] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine #​24044
• [pcl] Declare invoke dependencies to the engine so invokes that depend on pending resources, including remote components, resolve as unknown during previews #​24041
• [sdk/python] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine #​24043
• [cli/env] env provider no longer writes a new environment revision when the resulting definition is unchanged #​24055
• [sdk/go] Output-form invokes now infer their resource dependencies from their arguments, so they are skipped during preview while a dependent resource is pending creation and their results carry those dependencies #​24054
• [sdkgen/go] Fixes nested optional output conversions #​24096
• [engine] Fix a plugin process leak in NewPolicyAnalyzer when ConfigureStack fails after the plugin has booted #​24106
• [programgen/go] Avoid redundant applies when projecting properties from generated Go object outputs #​24112
• [backend/diy] Fix 403 errors writing to third-party S3-compatible backends (e.g. IBM COS, MinIO) by defaulting request_checksum_calculation to when_required when the s3:// backend URL sets a custom endpoint #​24109
• [programgen/nodejs] Avoid redundant applies when projecting properties from Node.js outputs #​24119
• [programgen/python] Avoid redundant applies when projecting properties from Python outputs #​24120
• [sdk] Fix apply erroring for skipped resources #​24108
• [cli] Retry rate-limited (HTTP 429) API requests when they are safe to retry, honoring the server's Retry-After header #​24131
• [cli] Exit non-zero from remote operations (pulumi up --remote, pulumi deployment run) when the deployment fails #​24155
• [cli/new] Resolve and install packages required by the program during pulumi new, as pulumi install does #​24126
• [cli] Make --remote not require a Pulumi.yaml file to be present #​24128
• [cli/import] Generate explicit providers in the import file resources #​24135
• [sdk/nodejs] Fix trustedDependencies parsing for bun #​24145
• [auto/go] ImportResources no longer leaks --stack into the converter's arguments when converter args are passed #​24146
• [auto/go] Fix ImportResources when GenerateCode(false) is set #​24147
• [sdk/go] Fix hooks and transforms causing panics with mocks #​24161
• [programgen/go] Fix plain invokes emitting nonexistent ...ArgsArgs argument types #​24172

Improvements

• [cli/import] Error when running pulumi import --from terraform in a Pulumi HCL project #​23744
• [programgen] Add ID type to PCL #​22702
• [engine] Give the resource monitor's Invoke its own response message, separating it from the one a provider returns #​24100
• [cli/do] Allow stateful resources to register their own provider resources based on provider inputs on the command line #​24098
• [cli] Refresh the first-login welcome message to link your Pulumi Cloud console and the Pulumi changelog #​24122
• [cli/do] Add suppor

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 38 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.17 -> 1.24.7
github.com/pulumi/pulumi/sdk/v3	v3.11.0 -> v3.210.0
github.com/spf13/afero	v1.6.0 -> v1.9.5
cloud.google.com/go	v0.81.0 -> v0.112.1
github.com/Azure/go-ansiterm	v0.0.0-20170929234023-d6e3b3328b78 -> v0.0.0-20210617225240-d185dfc1b5a1
github.com/djherbis/times	v1.2.0 -> v1.5.0
github.com/dustin/go-humanize	v1.0.0 -> v1.0.1
github.com/gofrs/uuid	v3.3.0+incompatible -> v4.2.0+incompatible
github.com/gogo/protobuf	v1.3.1 -> v1.3.2
github.com/golang/glog	v0.0.0-20160126235308-23def4e6c14b -> v1.2.4
github.com/golang/protobuf	v1.5.2 -> v1.5.4
github.com/golang/snappy	v0.0.3 -> v0.0.4
github.com/google/go-cmp	v0.5.5 -> v0.7.0
github.com/google/go-querystring	v1.0.0 -> v1.1.0
github.com/google/wire	v0.5.0 -> v0.6.0
github.com/hashicorp/go-retryablehttp	v0.7.0 -> v0.7.7
github.com/hashicorp/go-sockaddr	v1.0.2 -> v1.0.6
github.com/hashicorp/vault/api	v1.1.0 -> v1.12.0
github.com/inconshreveable/mousetrap	v1.0.0 -> v1.1.0
github.com/json-iterator/go	v1.1.9 -> v1.1.12
github.com/kevinburke/ssh_config	v0.0.0-20190725054713-01f96b0aa0cd -> v1.2.0
github.com/mattn/go-colorable	v0.1.6 -> v0.1.13
github.com/mattn/go-isatty	v0.0.12 -> v0.0.20
github.com/modern-go/reflect2	v1.0.1 -> v1.0.2
github.com/sabhiram/go-gitignore	v0.0.0-20180611051255-d3107576ba94 -> v0.0.0-20210923224102-525f6e181f06
github.com/sergi/go-diff	v1.1.0 -> v1.4.0
github.com/texttheater/golang-levenshtein	v0.0.0-20191208221605-eb6844b05fc6 -> v1.0.1
github.com/uber/jaeger-client-go	v2.22.1+incompatible -> v2.30.0+incompatible
github.com/uber/jaeger-lib	v2.2.0+incompatible -> v2.4.1+incompatible
github.com/xanzy/ssh-agent	v0.2.1 -> v0.3.3
go.opencensus.io	v0.23.0 -> v0.24.0
go.uber.org/atomic	v1.7.0 -> v1.9.0
gocloud.dev	v0.23.0 -> v0.37.0
gocloud.dev/secrets/hashivault	v0.23.0 -> v0.37.0
golang.org/x/crypto	v0.0.0-20210506145944-38f3c27a63bf -> v0.45.0
golang.org/x/net	v0.0.0-20210505214959-0714010a04ed -> v0.47.0
golang.org/x/oauth2	v0.0.0-20210427180440-81ed05c6b58c -> v0.30.0
golang.org/x/sync	v0.0.0-20210220032951-036812b2e83c -> v0.18.0
gopkg.in/yaml.v3	v3.0.0-20210107192922-496545a6307b -> v3.0.1

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 28 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.17 -> 1.26.6
github.com/pulumi/pulumi/sdk/v3	v3.11.0 -> v3.270.0
github.com/spf13/afero	v1.6.0 -> v1.15.0
cloud.google.com/go	v0.81.0 -> v0.123.0
github.com/Azure/go-ansiterm	v0.0.0-20170929234023-d6e3b3328b78 -> v0.0.0-20210617225240-d185dfc1b5a1
github.com/djherbis/times	v1.2.0 -> v1.5.0
github.com/dustin/go-humanize	v1.0.0 -> v1.0.1
github.com/gofrs/uuid	v3.3.0+incompatible -> v4.2.0+incompatible
github.com/gogo/protobuf	v1.3.1 -> v1.3.2
github.com/golang/glog	v0.0.0-20160126235308-23def4e6c14b -> v1.2.5
github.com/golang/protobuf	v1.5.2 -> v1.5.4
github.com/golang/snappy	v0.0.3 -> v0.0.4
github.com/google/go-cmp	v0.5.5 -> v0.7.0
github.com/google/go-querystring	v1.0.0 -> v1.1.0
github.com/hashicorp/go-retryablehttp	v0.7.0 -> v0.7.8
github.com/hashicorp/go-sockaddr	v1.0.2 -> v1.0.7
github.com/hashicorp/hcl	v1.0.0 -> v1.0.1-vault-7
github.com/inconshreveable/mousetrap	v1.0.0 -> v1.1.0
github.com/json-iterator/go	v1.1.9 -> v1.1.12
github.com/kevinburke/ssh_config	v0.0.0-20190725054713-01f96b0aa0cd -> v1.6.0
github.com/mattn/go-colorable	v0.1.6 -> v0.1.14
github.com/modern-go/reflect2	v1.0.1 -> v1.0.3-0.20250322232337-35a7c28c31ee
github.com/sabhiram/go-gitignore	v0.0.0-20180611051255-d3107576ba94 -> v0.0.0-20210923224102-525f6e181f06
github.com/sergi/go-diff	v1.1.0 -> v1.4.0
github.com/texttheater/golang-levenshtein	v0.0.0-20191208221605-eb6844b05fc6 -> v1.0.1
github.com/uber/jaeger-client-go	v2.22.1+incompatible -> v2.30.0+incompatible
github.com/uber/jaeger-lib	v2.2.0+incompatible -> v2.4.1+incompatible
go.opencensus.io	v0.23.0 -> v0.24.0
gopkg.in/yaml.v3	v3.0.0-20210107192922-496545a6307b -> v3.0.1