npm / @pulumi/pulumi
@pulumi/pulumi
What changed in @pulumi/pulumi 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
@pulumi/pulumi 3883 changes
Breaking changes 78
pulumi logs now errors by default ahead of its removal.
pulumi watch now errors by default ahead of its removal.
Schemas defining a root-module resource named provider are rejected during SDK generation instead of causing a panic.
Go and Python SDK resources from extension packages now use an explicit provider instead of falling back to a default provider.
workspace.Credentials.AccessTokens was removed; stored logins are now read only from the accounts object of credentials.json.
PCL reports a type mismatch when a resource input property is not also declared as an output.
PCL reports errors when number or bool literals are not admitted by a property's schema constant or enum.
Go policy remediations now run only at the remediate enforcement level.
policyx.ResourceValidationArgs.DryRun has been removed because it was never correctly set.
Accepts --path-filter once per filter instead of splitting filter values on commas.
Errors sooner when string values cannot be cast to numeric or boolean inputs.
The branch and commit settings now replace one another instead of being combined.
The command now rejects
--oidc-*-clear=falseinstead of silently ignoring it.pulumi new now errors on ambiguous template names instead of failing silently.
Templates downloaded from URLs outside the configured service now have their TLS certificates verified.
The --output=json value changes from a list of names to objects containing environment variable values.
Generated Python names plain function input object types without the Args suffix, matching exported SDK names.
Typed object stack outputs now use camelCase wire-format property names, matching other language SDKs.
Zip template entries resolving outside the extraction directory are rejected.
pulumi importnow rejects files that contain unknown values.Repeated header values with the same name are all sent instead of silently overwriting the last value.
The DIY backend deprecation warning became an error, and the environment variable was renamed accordingly.
Generated SDKs now require pulumi SDK v3.255.0 or later because output-form invoke arguments are passed without resolving them first.
A Python resource depending on its own parent now reports an error instead of hanging.
Extension-parameterized packages namespace resource and function tokens under their own package name instead of the base provider's.
Now exits non-zero when the deployment fails.
Now errors when run in a Pulumi HCL project.
The Pulumi AI mode and its --ai flag are retired because the backing service has been shut down; use pulumi neo instead.
The --language flag associated with Pulumi AI mode is retired because the backing service has been shut down; use pulumi neo instead.
Now exits non-zero when the remote deployment fails.
Unknown or missing subcommands now produce a non-zero exit code.
Failed resource registrations now return faulted outputs instead of unknown outputs.
The deployment settings configuration file flag was removed.
SDK helpers that read the deployment settings file were removed.
The experimental init, pull, configure, and env subcommands were removed, and settings commands no longer write the local deployment settings file.
The experimental push command and its update/up aliases were removed.
The deployment settings file was removed; manage settings directly in Pulumi Cloud.
The Node.js SDK now requires Node.js 22 or later.
Diffs in Output values are no longer ignored.
Converting a Terraform program to the hcl language now produces an error.
Callers must pass an explicit schema loader when binding PCL programs and package schemas.
Schema modules can no longer be nested under the index module; such nesting is now a strict bind error.
plugin.Host is stateless regarding workspaces; plugin.Context carries workspace state and closing it no longer closes a constructed host.
Logging out now deletes all backend configuration.
Removes the experimental pulumi ai web command.
Adds --stateless; create, patch, and delete require it for existing direct-provider behavior while stateful engine-driven behavior is planned as the future default.
Schema names containing whitespace or control characters are rejected.
Go Configure calls now require Type.
Go DiffConfig calls now require Type.
The Go SDK no longer accepts name in plugin loading functions.
The stack initialization command is renamed from pulumi stack init to pulumi stack new.
PCL no longer silently ignores ... in function arguments.
The plugin ls command is renamed to pulumi plugin list.
The plugin rm command is renamed to pulumi plugin remove.
Non-interactive destructive commands now require --yes for confirmation.
Shows a clear error when --all targets a non-paginatable endpoint instead of emitting an empty array.
Deployments now fail when an after hook fails.
Renames the --format flag to --output on pulumi api and its subcommands.
Renames the pulumi cloud api command to pulumi api.
Schema generation now reports errors eagerly for schemas containing unconstructable types.
Generated Go option helpers now omit the With prefix to match existing optXxx package naming.
Changes verbosity checks to require calling Enabled() on the result of logging.V(x).
Rejects id in state inputs with an error.
The PCL element builtin now accepts integer parameters rather than number parameters.
PCL list and tuple indices are now typed as integers rather than numbers.
The PCL range builtin now accepts integer parameters rather than number parameters.
mimeType is removed from PCL in program generation.
readDir is removed from PCL in program generation.
PCL now types integer literals as integers rather than numbers.
PCL programs now typecheck component inputs.
Generated Go SDK go.mod files now target Go 1.25 instead of Go 1.20.
Invoke outputs are automatically marked secret when they have a secret input and the invoke provider lacks secret support.
pulumiVersionRange was renamed to requiredPulumiVersion in PulumiPlugin.yaml.
PulumiPlugin.yaml now uses requiredPulumiVersion instead of pulumiVersionRange.
At verbosity level 1 or higher, the logfile location is written to stderr instead of stdout.
ProviderHandshakeResponse no longer includes pulumi_version_range.
Python 3.14 now requires grpcio version 1.75.1 or newer.
The import command now returns errors when an import fails.
Security 11
Secrets carried on output values are redacted in plaintext logs and shared logs.
Windows CLI and language host binaries are now Authenticode-signed.
Secret property values are redacted in violates-plan errors unless
--show-secretsis passed.Adds opt-in encryption for stored credentials using a key protected by the operating system.
Property values in CLI logs now redact secrets.
Rejects archive entries containing path traversal components during extraction.
Logging out now deletes shared temporary agent credentials.
Encrypted logging can be enabled for logs stored under ~/.pulumi/logs using this feature flag.
The about command no longer displays the access token in plain text.
Node.js resource hooks now receive secret values as Output objects, preserving their secretness.
Python resource hooks now receive secret values as Output objects, preserving their secretness.
Deprecations 3
Non-project mode for DIY backends is beginning its deprecation process.
Labels on package blocks are deprecated.
The .NET codegen package is deprecated in favor of the pulumi-language-dotnet package and will be removed soon.
New APIs and options 277
Generated Node.js, Python, and Go automation APIs now expose about commands.
Generated Node.js, Python, and Go automation APIs now expose config commands.
Generated Node.js, Python, and Go automation APIs now expose convert operations.
OPA policy packs run through the language plugin, which the CLI downloads on demand.
pulumi env commands supporting --draft can set the change request description with --reason.
The PCL interpreter can recover from failed function calls with recover.
Generated Node.js, Python, and Go automation APIs now expose refresh operations.
Go, Node.js, and Python SDKs can check whether a resource ID exists without adopting the resource into the stack.
Invoke can negotiate dependency-carrying OutputValues in arguments and responses when the provider accepts the new handshake capability.
Generated NodeJS, Python, and Go automation APIs now expose install.
Generated NodeJS, Python, and Go automation APIs now expose version.
Generated NodeJS, Python, and Go automation APIs now expose whoami.
Schema descriptions now support #/provider documentation references.
Adds an option to delete the key encrypting stored credentials from the OS credential store.
Adds the range built-in to the PCL interpreter.
The command can configure git authentication, dependency caching, template sources and drift remediation.
The command can configure tag triggers, review stack labels and the version control integration.
Python ResourceOptions now support component state migration callbacks.
Go resource options now support component state migration callbacks.
Node.js resource options now support component state migration callbacks.
Provider schemas can specify a configuration documentation URL used during credential warnings in interactive pulumi new.
pulumi api list now supports filtering endpoints by keyword.
The engine now supports importing a Stash resource, adopting the given ID and applying the configured program input as an update.
The Node.js SDK adds helper methods for transforming ResourceOptions into InvokeOptions.
Provider schemas can opt interactive pulumi new into cloud credential validation.
Adds a command to configure cloud OIDC trust and create ESC environments for AWS, Azure, or GCP.
Python adds helper methods for transforming ResourceOptions into InvokeOptions.
Providers can opt into receiving previously persisted outputs during Check on update through a new handshake capability.
Resource registrations can support state migration callbacks.
Python Automation API preview_destroy can request rich diffs.
Python Automation API preview_refresh can request rich diffs.
Adds a command that turns stateful snippets into Pulumi program code.
Python Automation API refresh can request rich diffs.
Python transforms can be mocked.
Sets the default organization used by Pulumi CLI operations.
Supports parallel plugin installation through the new --parallel flag.
Adds a Go policy helper and connects stack analysis so policy packs can validate the full stack.
Python stack method
preview_destroynow includes the missingprogramargument.Python stack method
preview_refreshnow includes the missingprogramargument.Existing stack resources in pulumi do input expressions receive automatic identifiers, which can be listed with show-resources.
Adds a command to show individual resources from state.
PCL now provides an ID type.
Stateful operations support the --provider argument, allowing provider selection for those operations.
Can also set standard SDK environment variables referencing login outputs; the option also applies to Azure and GCP login commands.
Skips package resolution and uses the supplied URL as the plugin download URL; also applies to related package, schema, and SDK commands.
Allows deleting protected resources without unprotecting them in state first; also available on preview and destroy.
Can register their own provider resources based on provider inputs supplied on the command line.
OTel traces can be sent over HTTPS.
Policy packs can point to executable binaries as well as script folders.
The do command can refer to existing resources in state from input expressions.
Package commands accept extension-parameterized packages, which are reinstalled from Pulumi.yaml during pulumi install.
Past update events can be reduced to the summary shape used by live pulumi up --output json, including diagnostics and failed-resource markers.
State converters can declare explicit providers and attach imported resources to them.
Resources in import files can supply inputs and outputs, allowing direct state import without a provider read when outputs are provided.
Generated Go, NodeJS, and Python programs and the PCL runtime support resource hooks that retry failed operations after successful hook commands.
Allows imported environments to be substituted for one run without editing stack configuration.
Import files can declare named explicit providers in the resources section and reference them by name.
Adds a command for sharing Pulumi logs with Pulumi.
Runs Neo as an Agent Client Protocol agent over stdio, with read-only and plan modes exposed as session options.
Adds session resumption with chat history and retries transient stream and message-send failures.
Adds runtime options to policy pack creation.
Allows imported environments to be substituted for one run without editing stack configuration.
Allows imported environments to be substituted for one run without editing stack configuration.
Migrates a stack between backends and re-encrypts configuration secrets and state for the target secrets provider.
Allows imported environments to be substituted for one run without editing stack configuration.
Adds natively awaited Python program entrypoints that can return stack outputs.
Adds parent information so state converters can express resource hierarchy.
Adds property filters for state converter resource imports.
Do supports stateful resource creation.
Do supports stateful resource deletion.
Adds stateful creation or updating of resources in a stack.
Go Automation API refresh and preview refresh operations support importing pending creates.
The pulumi command gains --version, which prints the version like pulumi version.
Generated automation APIs for NodeJS, Python, and Go now include import support.
Hooks can now be bound to a resource's onError option.
Adds a flag to explain an environment change request to approvers.
A production runtime option makes installation skip development dependencies for npm, pnpm, and yarn.
Converter mapping requests can specify the ecosystem whose mappings they consume.
Resources under parameterized providers can now be imported from a converter or import file.
Adds a flag to investigate a failed preview.
Adds a flag to investigate a failed update.
Deployment options can target snippets by UUID.
Configuration environment listing supports selecting an output format.
Plugin listing supports selecting an output format.
Policy analysis can analyze an exported state file without requiring a stack or backend login.
Policy group listing supports selecting an output format.
Policy listing supports selecting an output format.
Project listing supports selecting an output format.
Stack history supports selecting an output format.
Stack listing supports selecting an output format.
Stack tag listing supports selecting an output format.
Preview, up, refresh, and destroy can skip stack configuration validation against the project configuration schema.
Resource providers receive the address of a package resolver service during the provider handshake.
Adds the
--outputflag to the about command.Adds options to
pulumi stack getfor parity with the barepulumi stackcommand.Adds the
--outputflag to the whoami command.Resource providers receive the address of a schema loader service during the provider handshake.
Supports blocks of PCL kept in state to track ad-hoc resources.
pulumi neo can run tasks without integration credentials.
The package schema model supports extension parameterization.
Generated Go and Python functions can use multiArgumentInputs.
Adds
Output.recoverto catch and recover from exceptions in outputs.pulumi do can use provider configuration pulled from existing provider state.
Resource providers receive the active login API address and access token through PULUMI_API and PULUMI_ACCESS_TOKEN.
pulumi config set can preserve newlines from stdin when --raw is used.
Schema markdown descriptions can use language-agnostic cross references to other schema components.
Registered resources can be retrieved from the Node.js mock monitor for test assertions.
Adds a read timeout setting for resource read operations.
Adds a command to list automatic log files.
Adds a command to remove automatic log files.
PCL input files can access the selected stack's organization and short name when running pulumi do inside a project.
Coding agents can create claimable temporary accounts when unauthenticated.
The Go plugin.Provider interface now exposes List through the streaming ResourceProvider.List RPC.
The pulumi do command now supports resources.
Adds dedicated command-line flags for each deployment setting.
Adds a command to retrieve details for a specific deployment.
Introduces the initial pulumi do command.
Adds a command to show the full workflow run for one Insights scan.
Adds a command to discover recent Insights scan IDs.
Adds non-interactive single-prompt execution and prints the agent's final response to stdout.
Adds a command to edit organization members.
Adds a command to remove organization members.
Adds a command to export audit logs.
Terminates an in-progress deployment.
Adds JSON output for a structured summary of the destroy operation result.
Lists Insights accounts in an organization.
Creates a Pulumi Insights account.
Triggers a resource discovery scan for an Insights account.
Fetches log output for a Pulumi Insights scan.
Supports selecting specific versions when using registry-backed templates.
Adds a command to list organization audit logs.
Lists the members of an organization.
Assigns a custom role to a team.
Updates a custom role's name, description, or permission tree.
Lists custom roles for an organization.
Creates a custom role from a permission descriptor JSON file.
Deletes a custom role from an organization.
Fetches the resources-under-management summary for an organization.
Lists recent deliveries for an organization webhook.
Updates an organization webhook.
Lists all webhooks configured for an organization.
Creates a new organization webhook.
Sends a test ping to an organization webhook.
Deletes an organization webhook.
Lists compliance results grouped by entity.
Edits policy groups.
Retrieves a policy group.
Creates new policy groups.
Removes policies.
Adds a command to retrieve a policy issue.
Adds a command to list policy issues.
Adds JSON output for a structured summary of the preview operation result.
Adds JSON output for a structured summary of the refresh operation result.
Lists drift detection runs for a stack.
Shows drift detection status for a stack.
Retrieves engine events for a Pulumi Cloud update.
Updates an existing scheduled deployment action.
Retrieves the configuration of a scheduled action.
Lists all scheduled actions configured for a stack.
Creates a raw, drift, or TTL deployment schedule for a stack.
Deletes a scheduled deployment action.
Lists recent deliveries for a stack webhook.
Redelivers a webhook event.
Updates an existing stack webhook.
Creates a new stack webhook.
Deletes a stack webhook.
Adds a command to list deployment executions for a stack.
Adds structured JSON output summarizing the import operation.
Adds a command to retrieve detailed information about a stack.
Adds a command to inspect a single stack webhook.
Adds a command to send a test ping to a stack webhook.
Adds a command to look up a single resource discovered by Pulumi Insights.
Adds a command to search for resources discovered by Pulumi Insights.
Adds an approval-mode flag and supports switching modes mid-session with Ctrl+A.
Adds a permission-mode flag and supports switching modes mid-session with Ctrl+R.
Adds a language flag so the command can run outside a Pulumi project or plugin.
Adds a command to list all webhooks configured for a stack.
Adds a command to list registry-backed templates.
Adds structured JSON output containing a summary of the operation result.
Adds an option to skip up-front plugin installation.
Python provides register_package to cache package references per deployment.
Adds a command that bootstraps a Pulumi package from a template.
Summary engine events now include a result field.
Bundles the HCL language host so HCL programs can be used with Pulumi.
Adds progress events on stderr for paginated API requests.
Adds pagination that follows continuation cursors and combines items into one JSON envelope.
Adds a command for calling any Pulumi Cloud API endpoint with field, header, input, body, format, and dry-run handling.
Adds a command for viewing decrypted Pulumi logs.
PCL can read resources by ID and query without registering them.
Adds a command to inspect parameters, request bodies, and response schemas for Pulumi Cloud API operations in text, markdown, or JSON.
Adds a command to browse every endpoint in the Pulumi Cloud OpenAPI specification with table or JSON output.
pulumi neo gains a local literal multi-file replacement tool with file_pattern filtering and dry_run preview support.
pulumi neo gains a local regex-search tool with optional include filtering, while skipping binary files, hidden directories, and node_modules.
The provider protocol and schema now support List for provider integrations.
The experimental pulumi neo agent gains a local pulumi_preview operation tool with streamed resource changes, diagnostics, and operation summaries.
The experimental pulumi neo agent gains a local pulumi_up operation tool with streamed resource changes, diagnostics, and operation summaries.
The auto-generated Pulumi CLI interface is exposed through workspace.cli_api for Python automation users.
Adds an experimental command that creates a Pulumi Neo agent task and runs the local tool loop.
Adds terminal approval handling for sensitive agent actions and forwards responses to the Pulumi Console.
Adds an interactive terminal UI that renders agent messages, tool calls, and streaming output alongside the Pulumi Console session.
Adds a Shift+Tab plan-mode toggle that prevents file writes, pulumi up, and PR creation until a plan is approved.
Automation API destroy now supports --diff.
Local policy packs now support ESC environments.
Python adds decorator variants for resource and error hooks.
Adds deployment information retrieval to the resource monitor service.
Import files may now define providers alongside the resources that use them.
Adds the New command to the Automation API.
Adds the new command to the Python Automation API.
PCL now supports resource hooks.
Inline programs now support --run-program with preview_refresh and destroy in the Node.js and Python Automation APIs.
Python and Node.js providers gain a Cancel handler for cancellation handling.
Policy packs can resolve ESC environments.
The Node.js Automation API adds the new command to its auto-generated interface.
The Node.js Automation API adds the org search command.
The Node.js Automation API adds the org search ai command.
PCL now supports parameterized providers.
Adds a command to run a policy pack against existing state.
The Node.js Automation API adds the org get-default command.
The Node.js Automation API adds the org set-default command.
Adds --urns to display full resource URNs instead of short names in several CLI operations.
Adds a bidirectional streaming RPC to the LanguageRuntime protobuf.
CLI invocations can use TRACEPARENT to parent Pulumi spans under an existing span.
The auto-generated Node.js interface exposes a low-level cancel command.
Performance tests can use a configured GRPC endpoint.
Pulumi reads resource attributes from the OTEL_RESOURCE_ATTRIBUTES environment variable.
The OTLP exporter supports grpcs endpoints and header authentication.
The command accepts multiple resource URNs and deletes them in dependency-safe order.
Policy packs can now run with bun.
Runs continue after errors when this option is enabled.
Bun is supported as a runtime for Pulumi programs.
Bun is supported as a plugin runtime.
Adds a CLI flag for writing OpenTelemetry traces to a file or directly to a gRPC interface.
PCL supports resource ranges.
Preview or up failures can automatically open a Neo task.
Implements GetProgramDependencies for Bun and pnpm projects.
PCL can express that configuration values should be read as secrets.
DIY backend state files now support zstd compression.
Component schema inference now supports the Partial<T> utility type.
Node.js and Python SDKs use new policy plugin support to run policy packs.
Component schema inference now supports the Required<T> utility type.
RunPluginRequest now includes loader_target.
Provider resources can remap environment variables before passing them to the provider.
Python supports the OnError resource hook.
Adds a command for installing policy packs.
Pulumi.yaml can specify the required Pulumi CLI version.
The .NET program generator now emits RequirePulumiVersion.
The Node.js SDK now supports the OnError resource hook.
The Go SDK now supports the OnError resource hook.
Implements About in the Python automation API server.
Adds CheckPulumiVersion to the Go SDK.
Adds a resource hook for implementing custom retry policies.
Adds the --plan flag to pulumi up.
Adds require_pulumi_version to the Python SDK.
Adds requirePulumiVersion to the Node.js SDK.
The Node.js SDK now supports serializing async generators.
The engine now exposes a CheckPulumiVersion RPC.
Plugins can specify which CLI version range they support.
Adds an sdkgen flag that prevents functions from emitting their plain variants, allowing generated SDK output to be restricted.
Adds the --config option to destroy so developers can select configuration values during resource destruction.
Adds the --config-path option to destroy so developers can specify the configuration file used during destruction.
Adds the --config option to refresh so developers can select configuration values during resource refresh.
Adds the --config-path option to refresh so developers can specify the configuration file used during refresh.
Adds replacement_trigger support to the Python SDK so Python programs can configure replacement-trigger behavior.
Python component providers can now have their version set.
The Node.js SDK now supports replacement triggers for resource replacement behavior.
DIY backends support stack tags, including CRUD operations, system tags, filtering, and compatibility with existing stacks.
A command was added to delete package versions from the Pulumi Registry.
Pulumi Cloud login supports native OIDC token exchange.
The protobuf RPC surface now includes Language.Template.
CLI command flags can now be set through corresponding environment variables, including PULUMI_OPTION_REFRESH for --refresh.
Resources can use replacement_trigger so changing its value between program runs triggers resource replacement, with Go SDK support.
A builtin resource can now save a value to state.
Adds a resource option allowing one resource's replacement operations to trigger replacement of another resource.
Invokes receive a preview flag so they can determine whether they are being called during a preview.
This environment variable skips sending component inputs to the engine for diffing and state storage.
An environment variable can add --refresh to preview, update, and destroy operations.
Policy violation severity can now be overridden.
Performance 13
All commands now start slightly faster.
Pulumi Cloud startup performance has improved.
Provider mapping results are cached on disk so repeated plans avoid booting a provider to fetch unchanged mappings.
Generated code deduplicates identical apply arguments, avoiding unnecessary Promise.all, pulumi.all, and Output.All calls.
Caches type metadata and class references to reduce serialization CPU overhead.
Avoids unnecessary S3 bucket HEAD calls, improving DIY backend performance.
contains_unknowns is faster for large objects.
Plugin downloads use fewer GitHub API requests.
Analyzer calls now run in parallel.
Required policy packs install in parallel with plugins.
StackReference performance was optimized.
Startup performance improves when using the service as a backend.
Improves the performance of StackReference secrets handling.
Behavior and default changes 165
IDInput now satisfies StringInput, allowing it to be used where StringInput is expected.
The Java language runtime is downloaded on demand instead of bundled with the CLI.
lookup accepts defaults of any type and types its result as the unification of the element type and default.
SDKs receive per-value return dependencies from Call operations.
Agent mode now logs in through the browser instead of creating a new agent account.
npm is marked as the recommended package manager when pulumi new prompts for one.
Tuple literals containing outputs are accepted where functions or properties expect input tuples.
URNInput now satisfies StringInput, allowing it to be used where StringInput is expected.
Plugins can now be downloaded from Git repositories whose version tags omit the v prefix.
Pulumi Cloud API calls now include the W3C traceparent header when OpenTelemetry tracing is enabled.
Cross-process install waits can now be cancelled with Ctrl-C.
Quoted strings without interpolation are typed as constants for bind-time string constant and enum validation.
Resources can be assigned to plain properties typed as references to their resource type.
Boolean schemas serialize as equivalent object forms so schema-carrying payloads are valid OpenAPI model instances.
The default plugin version is set when the schema specifies a Go language option.
Interactive login no longer prompts to create a first project.
Skipped reads now return last-known outputs when the resource is already present in state.
A stack configured against a repository URL can be moved onto a version control integration.
Output no longer includes padding for labels that are not printed.
The redundant preview step is skipped when pulumi neo runs the pulumi_up tool.
The credentials preflight now runs for parameterized providers.
Planned and applied state migrations are now reported through user-facing diagnostics.
Python plugin discovery now includes dependencies from the current uv workspace member.
Forwards caller error hooks to remote component providers.
Prompts for ESC project and environment names, asks how to authenticate before access level, and reports successful completion.
Automation API project settings can now use any language runtime.
Component state migrations can split managed state using compatible existing resource identities.
Outputs and prompt values can now be marshalled into fields typed as input interfaces such as pulumi.StringInput.
Stack references use the Pulumi Cloud stack outputs endpoint when advertised instead of exporting the whole deployment.
State migrations now run for aliased remote components.
Generated output types can be used where classes-and-dicts inputs accept an Args class or TypedDict.
Update plan generation and checking now ignore property keys beginning with an underscore.
Command suggestions treat adjacent character swaps as a single typo.
Generated Python accesses hyphenated schema properties through Python attribute names instead of subscripting.
The id attribute of a read resource accepts output-typed values.
Resource, object type, and function names in tokens may contain hyphens.
Python programs support final argument expansion for min and max.
Renders every source kind and shows environment variable values.
Generated Python and Node.js function inputs apply schema defaults.
Stack information output includes secret provider information.
Cancelling a task interrupts a running local tool call instead of waiting for it to finish.
The Node.js Automation API no longer limits captured output buffer size.
Importing local components now generates a component resource definition.
Interactive pulumi new shows one confirmation for project, stack, and config defaults instead of prompting separately.
Creating a stack against the Pulumi Cloud backend now announces that the stack was created.
Interactive
pulumi newnow asks for a cloud provider and language instead of listing every template.The CLI offers to create a first project after logging in to an account with no stacks.
Go program generation now emits for expressions as Go loops.
When invoked outside a Pulumi project, pulumi do falls back to an auto-created project and stack under PULUMI_HOME.
Diff display shows secrets when --show-secrets is passed.
The summary output now reports program errors from the language host.
Diff display now shows the value being added when refresh or a provider diff reports an added property.
No longer writes a new environment revision when the resulting definition is unchanged.
Invokes depending on pending resources are deferred or resolve as unknown during previews, and their results carry inferred resource dependencies.
Import files now generate explicit providers in their resources.
Resolves and installs packages required by the program during project creation, as pulumi install does.
Remote operations no longer require a Pulumi.yaml file to be present.
Third-party S3-compatible backends with custom endpoints default checksum calculation to when_required, fixing 403 write errors.
State converters can supply resource inputs and outputs in ConvertState responses.
Project files are written to disk and their paths are exposed as environment variables for every output format.
Strings containing non-UTF8 bytes can flow between providers, the engine, state, and opted-in languages.
Provider servers can run Construct and Call methods concurrently.
A component block's providers option now applies to the resources and invokes it declares.
Neo diagnostics now suggest debug-update or debug-preview commands for investigating failed operations.
When uv is used, UV_PROJECT_ENVIRONMENT can override the virtualenv path.
Do now accepts expressions for boolean inputs.
Do now accepts expressions for number inputs.
list, remove and move are canonical env subcommands; ls, rm, delete and mv remain aliases.
The command now reports the TypeScript version for Node.js projects.
Using Pulumi ESC with a DIY backend now suggests logging into Pulumi Cloud in the error message.
Commands that list logs now show the command name, and current-command logs are excluded.
Missing resource URNs now produce suggestions for close matches and instructions for listing stack URNs.
Reading non-secret stack outputs no longer requires the passphrase for passphrase-encrypted stacks.
Diff output now marks resources configured to be retained on deletion.
Resources under extension-parameterized providers can now be imported.
Environment definition updates now report the new revision number.
Automatic logging is now enabled for every command by default.
Policy violation output now uses display resource type names.
pulumi login warns when the provided login differs from PULUMI_BACKEND_URL.
Generated Python and NodeJS programs represent map
rangeresource collections as key-indexed maps.Resource providers receive the mapper service address during the provider handshake.
The CLI refreshes expired access tokens on 401 and retries once when credentials.json contains an OAuth refresh token.
Plugin tarballs containing symlinks are now accepted.
Replies such as ok, approve, and go ahead are accepted as approvals at pulumi neo prompts.
JSON output now includes affected resources and their URN, type, name, operation, and parent.
Provider object outputs may now use string enumerations.
Ctrl+Z suspends a running session and restores its transcript when resumed with fg.
Projects without a runtime are supported across CLI operations and Automation API project settings.
Provider plugins are resolved through the Pulumi Registry when converting from a third-party source.
The HCL language runtime is downloaded on demand instead of being bundled.
The command now suggests similar tokens when an unknown token is provided.
Prompt history can now be scrolled with the up and down arrow keys.
All provider errors are now forwarded to error hooks, enabling retry behavior.
Installation now distinguishes multiple packages that use the same plugin.
When using uv without a project section, requirements.txt is merged into pyproject.toml.
When both are available, pulumi api now prefers text/markdown over JSON.
Preview and update diagnostics now suggest pulumi neo.
Esc clears non-empty input; with an empty box, it still cancels the agent's current turn.
With -y and no template, the command writes a minimal project file.
Neo is visible by default because the experimental gate was removed.
Supports multiline input through several key combinations and a trailing backslash.
integration.ProgramTest now recognizes the hcl runtime.
integration.ProgramTest now recognizes the pcl runtime.
GET and HEAD requests automatically receive lang and os query parameters when declared by the matched OpenAPI operation.
Pulumi Cloud API requests now identify the running command and detected AI agent when present.
Automatically installs the HCL converter when converting from HCL.
The engine caches schemas in PULUMI_HOME/schemas, including schemas for parameterised packages.
Node.js program generation now awaits plain call results and uses an async export wrapper when required by the runtime Promise type.
Adds local execution of the edit filesystem tool with exact replacement validation and empty-file creation support.
Gates the experimental pulumi neo functionality behind an environment variable.
Keeps the thinking spinner active until final events and lets users press Esc to request cancellation.
Node.js and Python component provider hosts warn when components contains a non-ComponentResource class.
The Python runtime now supports unwrapping Input[Optional[T]] types.
Automatically detects Mercurial repository metadata for updates, matching existing Git support.
Resource options are now passed to hooks through the engine.
Destroy and import preview-only operations no longer retain a state lock for the DIY backend.
PCL permits key indexing into a map of resources created by range.
Wires the Cancel RPC to language host Run across supported SDKs.
Adds update metadata to the OpenTelemetry root span.
PCL applies default values defined by resource schemas.
Uses nodenext for the module setting in the Node.js SDK configuration.
Uses nodenext for module resolution in the Node.js SDK configuration.
Additional OpenTelemetry interceptors are added for GRPC clients.
Provider OpenTracing spans are bridged into OpenTelemetry traces.
The tracing option now accepts relative file paths.
Pulumi package publishing now supports Azure DevOps git URLs.
The CLI now uses distinct exit codes for different error types.
The CLI now automatically installs missing policy analyzer plugins.
Python toolchain selection now detects lock files.
Generated Go program go.mod files now target Go 1.25 instead of Go 1.23.
Python program dependency detection reads Poetry and uv lockfiles.
pulumi about now displays Bun information.
Refreshing a stack's config now includes environments used by that configuration.
The engine uses provider references from __self__ arguments to calls.
Resource registrations now inherit the provider option automatically.
Journaling is enabled by default and can be disabled with PULUMI_DISABLE_JOURNALING.
The engine now reports policy pack installation errors, making installation failures visible to developers.
Component schema inference now supports enums.
Plugin URLs can now contain underscores in their paths.
Package name resolution now uses the Pulumi Cloud Registry by default.
The Python SDK relaxes its pip version constraint.
Components can use private packages as local dependencies.
The Python SDK supports protobuf 6.
Login extracts organization, team, and user from OIDC JWT claims.
Node.js and Python dynamic providers can return inputs from read(), enabling accurate diffs after refresh.
Login defaults to Pulumi Cloud when an OIDC token is used.
Pulumi no longer sets PULUMI_ROOT when using mise.
Boolean configuration values accept different spellings instead of only lowercase true.
Multiple components from the same repository can now be referenced.
The command now prints Node.js package manager information.
Update metadata now includes language runtime metadata.
The command now always prints the schema before any binding errors.
The command now prints Python toolchain information.
The Python SDK allows older grpcio dependencies.
The Python SDK adds runtime validation checks for PropertyValue.
The Python SDK allows older protobuf dependencies.
The --generate-only workflow now creates pyproject.toml for uv and poetry projects.
pulumi new --generate-only creates pyproject.toml for uv and poetry projects.
Resources marked as Delete can now be targeted and are included in dependency calculation.
pulumi install now recursively installs dependencies in local packages.
Python SDK generation now accepts all PEP440 version specifiers.
Automation APIs retrieve the event log over gRPC instead of reading it from a text file.
The command now includes PULUMI_* environment variables in its output.
Resource state now supports floating-point NaN and Inf values.
The CLI prints replace diffs when replacement is blocked because a resource still has an import ID.
Tooling 47
pulumi_preview and pulumi_up tool results now report the console URL and update identifiers.
Messages and help text now reference pulumi env instead of the retired standalone esc CLI.
Generated Python SDKs now use packaging instead of parver.
Generated Python output types are now precise for discriminated unions instead of using broad Any-based types.
Generated Python adds type annotations for config variable defaults supplied by invokes.
The Go SDK supports Go 1.27.
Node.js transforms can be mocked.
Go transforms can be mocked.
Generated Python type definitions represent constant properties with Literal[value] instead of their primitive type.
Generated Go code uses known map types instead of map[string]interface{} for better typing.
SDKs and programs can now be generated for extension-parameterized packages.
OpenTelemetry spans now identify slow snapshot fetches, deserialization, or secret decryption during StackReference reads.
list and remove are the canonical command names; ls and rm remain aliases.
The CLI now shows download and unpack progress while installing provider plugins.
The package name input is reserved for internal use by sdkgen.
The package name pulumi is reserved for internal use by sdkgen.
pulumi new is now an alias for pulumi project new.
Adds a pulumi package for npx support.
Shows tool call arguments and results through a ctrl+o overlay.
Help now recommends pulumi cloud api describe for verifying operation parameters before calling.
When invoked by an AI coding agent, prints pulumi api pointers after the command completes.
When invoked by an AI coding agent, prints pulumi api pointers after the command completes.
Generated Node.js and Python optional input types now accept undefined or None values.
Node.js codegen now emits unqualified Provider references for a package's own provider resource inside that package.
Generates command methods for the Go Automation API.
Node.js projects using pnpm can now use package.yaml.
The CLI detects AI agents and includes that information in update metadata.
Generated TypeScript configuration is modernized to align with TypeScript defaults.
Allows TypeScript 6 as a Node.js SDK peer dependency.
Plugin installation emits spans, and dependency installation exposes more attributes.
The CLI root span includes CLI metadata.
Debugger support is available for the Bun runtime.
pulumi schema check now supports source-based packages in addition to schema files.
Go program generation now generates Call requests.
Go 1.26 is supported.
SDK generation now supports type references to parameterized and third-party packages.
The CLI now shows environment variables that were set when a snapshot integrity error occurs.
Codegen creates namespace aliases to avoid Pulumi namespace collisions.
Go SDK generation now supports three-level nested builtin output types.
Language runtimes for .NET, Java, and YAML are bumped.
The Java toolchain was updated to v1.18.
Generated SDKs now include a .gitattributes file.
Generated SDKs now include a .gitignore file.
The CLI now logs gRPC requests before invoking them, improving visibility when debugging CLI operations.
The CLI improves how policy violation severity is displayed.
The command now shows functions exposed by a package.
CLI output now displays the severity associated with policy violations.
Fixes and other changes 289
Agent previews honor optional refresh settings without persisting refreshed state.
The PCL entries built-in no longer panics on empty maps or maps whose values have different shapes.
Missing lookup defaults are now reported at bind time instead of when the program runs.
Output.recover now catches faults arriving through apply or after the program body returns.
The command now correctly adds and removes stacks, Policy Packs, and Insights accounts.
Elided asset contents are restored from prior state when providers echo assets during refresh or update.
Plugin checksum verification no longer rejects valid HTTP/1.1 downloads or ignores trailing archive data.
Project settings now work correctly for projects located in symlinked directories.
The pulumi new credentials check no longer has a timeout or produces spurious premature provider exit errors.
Dynamic providers fall back to Read inputs when properties is empty, keeping Get working after engine state changes.
Equivalent recursive object types and object maps now resolve consistently to the same finite type without stack overflow.
Ancestor component resource transforms now apply to resources parented under a resource read.
Snapshot integrity errors are fixed when untargeted steps change dependencies in the program.
pulumi install now works for Python plugins and policy packs using uv with a [build-system] table.
Concurrent pulumi new runs no longer fail when cloning the templates repository.
The credentials warning no longer prints the provider documentation link twice.
Union members are ordered structurally rather than by printed form, making recursive object output complete and diagnostics consistent.
Encrypted credentials in other PULUMI_HOME directories remain readable after logout or login in one directory.
The PCL length built-in now accepts objects and maps.
Generated programs now handle length on output values and count keys of maps and objects in Node.js.
min and max are typed as numbers when any argument is a non-integer literal.
The CLI recovers from partial installs and waits for parallel installs.
Go policy analyzer configuration schemas are now serialized correctly.
Generated Python for output-dependent resource ranges is now valid.
Generated Node.js programs now fill the lists produced by range.
Skipped reads now report Unknown=true after dependency failure during --continue-on-error updates.
Skipped imports now report Unknown=true after dependency failure during --continue-on-error updates.
Generated Node.js SDKs now compile when resource inputs reference themselves.
Informational messages no longer trigger the Neo diagnostic help prompt.
An OnError retry updates the partially created resource instead of creating another resource.
Resources marked PendingReplacement are no longer incorrectly targeted for deletion.
The command no longer leaks package processes.
PCL read blocks now propagate the dependsOn resource option.
Go ReadResource calls now propagate the dependsOn resource option.
Prevents a panic when pnpm config get allowBuilds prints null.
Stops overwriting stack sources for stacks using providers other than GitHub.
Reports an unconfigured stack instead of failing.
Protects retained resources from deletion during a subsequent update before generated code is added.
Applies remote component provider state migrations when the caller also supplies migrations.
An agent account claim marked unavailable is re-validated instead of trusting the stale marker indefinitely.
Automation API error predicates now match wrapped errors and unwrap the underlying cause.
disableSSL no longer overrides explicitly specified protocols.
Errors now report the source position of user code calling a generated resource getter instead of the getter body.
The exclude-dependents option is now propagated through resources read with
.get().The target-dependents option is now propagated through resources read with
.get().Packages required by a local plugin directory are installed before the plugin is installed and run.
Provider configuration runs during provider creation, associating configuration errors with the provider resource.
A resource provider attached through PULUMI_DEBUG_PROVIDERS is treated as installed, preventing an unnecessary download.
pulumi install now works for projects requiring a provider attached through PULUMI_DEBUG_PROVIDERS.
Relative plugin and package paths are resolved against the project directory when starting from a project subdirectory.
Resources are sorted deterministically when repairing a snapshot.
State migration ordering is corrected for components interleaved with other resources.
Successor references are normalized between chained component state migration callbacks.
Ephemeral agent credentials now show the agent account's claim URL instead of an inaccessible View Live link.
Stacks containing a custom resource with no ID now produce a clear error instead of panicking.
Binding a schema property with an integer constant value no longer crashes.
Policy operations no longer hang when a policy pack fails to start up.
Serialization of secret unknowns is corrected in NodeJS, Python, and PCL.
Union values are resolved by wire shape so members without constant properties serialize and translate with the correct property names.
Generated Python remains valid when a component with inputs instantiates another component.
Resources whose deletedWith target is replaced are replaced too, instead of being left orphaned in state.
Python discriminated unions are resolved correctly by their tag.
DIY backend stacks remain readable when checkpoint compression transitions fail.
Go SDK ESC imports use resolved environment names when evaluated.
Generated Node.js declarations quote illegal property identifiers and use bracket access, including for kebab-case names.
Generated Go uses valid struct field names for schema properties whose names contain hyphens.
Imported resources are not replaced when an input becomes secret or output-wrapped without changing its inner value.
Cancelling a local tool call no longer leaves the TUI stuck on Thinking with input blocked.
Cancelling a Neo task immediately stops its local tool and reports the task as cancelled.
pulumi install preserves a package's pluginDownloadURL in regenerated SDKs.
Python provider stack traces are improved.
Python programs preserve all providers passed to remote components.
Generated Python TypedDicts mark required component inputs as required.
Generated Resource.get resolves output-only properties as unknown during preview when the id is unknown.
Python runtime context is propagated across thread boundaries.
Selecting a stack by name outside a Pulumi project directory now produces a clearer error.
Approval replies are no longer silently dropped when the outbound event queue is full.
Serialization always emits the required value and environment keys defined by the ESC OpenAPI contract.
Serialization always emits the required value and environment keys defined by the ESC OpenAPI contract.
The engine no longer returns extension package references for non-parameterised packages sharing the same base.
Generated Go program code is deterministic for objects mixing null and typed properties.
Generated Python code now uses the correct casing for local component outputs.
Mode changes are no longer silently dropped when the outbound event queue is full.
Uses the configured default organization when listing policy groups.
Snippets are retained when deletion fails so the delete operation can be retried.
Login failures explain which state backend failed, where it was configured, and how to change it.
Cancellation requests rejected by the service are retried, keeping Esc responsive instead of leaving the CLI stuck on cancelling.
Reports every schema validation error when package schema binding fails.
Progress bars now render correctly for parallel plugin installations.
DIY backend errors report the configured URL, resolved URL when normalization changed it, and identify local paths as state directories.
Generated Go package clauses are now valid when schema module names contain hyphens.
Fixes global project lookup for
pulumi do.Template and repository cloning now works in paths containing symlinks with absolute targets.
pulumi preview --import-fileno longer emits unknown values.The Python SDK now uses the resource monitor's advertised feature set consistently.
Node.js schema modules with hyphens now export under valid sanitized identifiers, including type namespaces.
Commands now exit promptly when cancelled during a retried HTTP request.
Panics in hooks no longer crash the entire process.
The patch command works in stateful mode and overlays supplied inputs onto the existing snippet.
The --server value is preserved when adding a package to the packages section of Pulumi.yaml.
Plugin last-used times are tracked accurately on all platforms.
Go program generation renames properties colliding with reserved names, preventing uncompilable output.
Generated Go input types now include deeply nested collections of object types.
The SDK provides an improved error message when resource registrations remain pending as pulumi exits.
Current stack selection is scoped to the active backend, preventing stale stack errors after switching backends.
No longer leaks --stack into converter arguments and works when GenerateCode(false) is set.
The insecure login setting is now reflected in stack service secrets manager state, fixing TLS verification failures with self-signed self-hosted backends.
Invokes written inside a component are parented to that component so they resolve its providers.
An invoke resolves its provider from the providers option of its parent named in the request.
Parallel pulumi install processes sharing PULUMI_HOME no longer intermittently fail with a missing provider executable error.
Import file generation works correctly when parent resources share names.
Fixes generated Go code for plain properties nested inside non-plain objects.
Generated Go programs now compile when discriminated union members are used as array or list elements.
Ctrl+C clears typed text while Ctrl+A and Ctrl+E line navigation are preserved.
Ignore-pattern matching on macOS precomposes filenames to NFC, so composed patterns match decomposed filenames like Git.
Provider resources declared inside PCL components are now generated correctly for Node.js, Python and Go.
Without -v, only warnings and errors are written to stderr again.
Strings containing non-UTF8 bytes are rendered as base64 in diffs and JSON output.
Resources whose import identifier differs from the canonical ID are no longer deleted on a subsequent update.
PCL invokes functions declared with multi-argument inputs using positional arguments.
Function serialization no longer includes the package version in module paths when using pnpm.
Fixes recursive property log marshaling in the CLI engine.
The deletedWith resource option now works correctly in Python component resource providers.
Nested FileArchive entries in AssetArchive no longer use backslashes on Windows.
Operations no longer fail solely because logging fails.
Generated Node.js numeric range loops use per-iteration bindings so deferred applies observe the correct index.
Removing the last tag now works on self-managed (DIY) backends.
The replaceWith resource option now works correctly in Python component resource providers.
Generated Python and NodeJS programs guard references to boolean
rangeresources so the generated code type-checks.Prevents a panic when binding a schema that references an uninstalled plugin.
Local Node.js SDKs can run their postinstall script under npm 12.
pulumi logout now clears the current tokenless backend in coding agent environments.
pulumi package add no longer fails with pnpm for generated SDKs using scoped package names.
The CLI respects PULUMI_SKIP_CONFIRMATIONS for every confirmation prompt.
Local SDKs added with pulumi package add are built correctly with pnpm 10.34.2 or newer.
Applying a resource transformation no longer drops the resource parent from RegisterResource.
Node.js SDK mergeOptions no longer drops onError hooks from ResourceOptions.
Top-level flags such as --logtostderr are now recognized when using pulumi do.
Fixes a snapshot integrity issue when running up with --refresh.
Closes gzip.Writer so archiveTarGZIP produces valid tar.gz output.
Fixes ArgsDict usage in Python typed dictionaries.
Makes --all follow the server's pagination cursor through the end of the log.
Renders --job/--step mode as structured lines instead of an empty raw-string blob.
Editing deployment settings no longer clears settings that were not requested for change.
Preserves map entries whose values match enum members in union input element types.
Generates PCL for asset and archive inputs when importing resources instead of returning a NYI error.
Preserves asset, archive, and resource-reference values in maps and arrays and escapes template sequences in map keys.
Batch encryption and decryption errors are no longer silently dropped.
Schema names are validated against module paths to prevent conflicts.
Map values with union element types made of Input-wrapped types are no longer dropped during HCL2 import.
Imported resource state generation now preserves provider-defined keys prefixed with double underscores.
Code generation no longer reports false circular references for several resource option entries sharing top-level node names.
Every assistant message now remains visible in TUI scrollback across tool calls.
Neo TUI conversation blocks now have blank-line gaps for clearer separation.
Cancelling a Neo session no longer causes a panic.
Tool results now return the bare stack name and canonical project name instead of raw input values.
PCL binding no longer panics when a conditional mixes a Promise-typed branch with a try branch.
Component resource argument types now support NotRequired, Required, and total=False TypedDict declarations.
Neo clarifying questions are rendered as questions rather than approval prompts.
Node.js and Python program generation now emits the correct length check for string length.
The Neo shell tool now honors agent-supplied timeouts and terminates the whole process tree when deadlines fire.
Neo now surfaces task-creation errors and exits instead of leaving the TUI stuck.
Pressing Ctrl+C twice now exits Neo cleanly instead of requiring a third press.
Go code generation now correctly generates slices of pulumi.Asset and pulumi.Archive.
Python RPC deserialization now preserves double-underscore-prefixed keys such as type discriminators.
Reverts parsing changes that caused errors for property paths that were previously valid.
Installed plugins claiming the same default provider package name now produce a clear error instead of a panic.
PCL no longer wraps plain method call returns in Output<T>, preventing broken generated apply traversals.
Go codegen now emits unqualified Provider references for a package's own provider resource so generated identifiers compile.
Node.js codegen now imports the Provider class name instead of using the title-cased package name.
Python codegen avoids self-imports when referencing a package's own provider resource, preventing circular imports at runtime.
Uses the default organization name instead of the username when listing policies.
Fixes a race condition during parallel delete-before-replace operations.
Signals providers to cancel before closing them during replacement.
Generated Node.js and Python programs now correctly import camelCase modules.
Generated Go, Node.js, and Python programs now handle some name conflicts correctly.
Generated Node.js programs now include necessary casts between types.
Fixes snapshot integrity errors involving component and provider resources during refresh with --run-program.
Node.js component schemas now include inherited input properties from extended args interfaces.
Python component schemas now include inherited input properties from base classes.
Go predeclared identifiers are added to reserved words during generation.
The Go Automation API places --non-interactive before -- so it is not misinterpreted as a positional argument.
Go union type code generation now handles optional list types.
state upgrade checks for Pulumi.yaml projects and the backend option.
Go program generation now handles ternary expressions inside apply callbacks.
unmarshalOutput now handles known outputs with null elements.
Closure serialization now works for cached modules wrapped with __importStar.
Fixes a deadlock when cancelling an operation.
Fixes OpenTelemetry flushing when providers shut down.
Fixes variable lookup in parent scopes.
DIY backend refresh --preview-only no longer leaves a state lock.
Fixes --include and --exclude for program-based refresh.
Detailed diffs no longer visually nest changed resources under unrelated visible resources when unchanged parents are hidden.
Tracing spans for GRPC streams now end correctly.
Import code generation correctly creates references to non-standard names.
Generated Node.js and Python code correctly converts literals when calling local components.
The CLI no longer applies the secrets filter to boolean values true and false, regardless of case.
Bun execution now checks for an SDK version compatible with bun.
Node.js program generation now correctly generates for expressions.
Python program generation now correctly generates list and dictionary comprehensions.
Refresh no longer encounters a snapshot integrity error when parents change.
The engine now fills in Name and Type for ResourceReference values sent over the wire protocol.
The error message shown during SAML SSO reauthorization has been improved.
Known output values are serialized correctly in snapshots instead of always being recorded as computed.
Package URLs containing .git are parsed correctly.
pulumi destroy now displays the parent resource hierarchy.
package get-schema works correctly for binary providers at relative paths.
Installed packages' pulumi-plugin.json files are located using importlib.
State moves avoid integrity errors when copied providers depend on resources left in the source stack.
ReplacementTrigger no longer fires incorrectly because of dependency changes.
Snapshot integrity issues are automatically repaired, with an error event sent to the backend for diagnosis.
Automation StepEventMetadata JSON parsing handles null detailedDiff values.
Default provider inheritance now works across resources from different packages.
Go code generation no longer panics when schemas contain digit-prefixed properties.
Python code generation now correctly generates entries calls.
Go code generation now lifts plain values to input/output values when required.
Python code generation now correctly generates lookup calls.
Fixes a panic when importing a service stack into a DIY backend.
The Python Automation API no longer crashes in forked processes.
Integer component inputs are converted to int.
Fixes a panic when a new component resource in the program is not targeted.
from_json now reads resourceUrn correctly instead of the snake_case name, preventing the field from being None.
The StackReference schema is corrected.
Generated files now implement singleOrNone semantics correctly.
Loading policy packs using policy SDK v1.18.1 or older no longer hangs.
Go program generation now handles import paths for nested modules correctly.
The command no longer panics for non-absolute paths when PulumiPlugin.yaml has a packages section.
A Pulumi project is now linked only once.
Refresh with --run-program no longer produces snapshot integrity errors with component resources.
A race condition in refresh with --run-program was fixed.
Errors from uv, poetry, or pip during dependency installation are always surfaced.
Errors from uv, poetry, or pip during linking are now surfaced.
Stack graph output is now deterministic.
Python package linking with uv now runs in the correct location.
_LazyModule no longer triggers a full module load for introspection attributes.
Remote components now work correctly when PULUMI_NODEJS_SKIP_COMPONENT_INPUTS is set.
Replacement triggers are now passed through to Construct.
Failed yarn install commands are now retried, including during pulumi install.
Generic subclasses of dynamic.Resource now work correctly.
Correctly installs packages that depend on other packages.
Correctly installs packages that depend on other packages.
Python code generation no longer panics when ranging over resource outputs that are arrays of objects.
Package names are now correctly determined for Python and NodeJS packages.
Positional arguments can be passed to pulumi convert again.
SDK generation now correctly includes git forge organizations as schema namespaces.
The CLI now copies files when linking, improving robustness across file partitions.
The CLI no longer installs plugins twice when explicit parameterizations are used.
Fixes alias options being passed to Construct for remote components.
Reconfigures the service-backed secret manager for the target stack when importing state if required.
Fixes an issue with serialized async generators.
The Node.js SDK avoids a RangeError when error objects are large.
The message renderer now works correctly on Windows.
Internal properties such as __defaults are filtered from diff display.
Fixes import_resources with a converter failing because of --stack argument placement.
Preserves existing behavior when adding a local provider with pulumi package add.
No-diff updates that resolve initErrors now pass ignoreChanges, preserving configured change-ignoring behavior.
Fixes programgen bindings for invokes from parameterized packages, allowing generated programs to bind those calls correctly.
Fixes plugin download URL overrides when the fallback mechanism is used.
Updates pulumi-yaml to v1.26.1, incorporating bug fixes for users of Pulumi YAML.
Plugin dependencies are no longer reinstalled after load failure for Git plugins with nested paths.
Parameterized SDKs now generate lifted single-value calls correctly.
The command now correctly identifies the innermost Project or Plugin.
Cancellation handling is fixed in several places in the Python language host.
Generated Go resource creation functions now account for name conflicts.
ComponentResources no longer incorrectly transfers input arguments to output properties automatically.
Local components now use the version from package.json instead of 0.0.0.
The CLI now correctly installs non-standard plugins.
Node.js SDK serialization errors caused by side-by-side SDK copies are fixed.
Resource snapshots no longer encounter duplicate integrity issues when aliases are present.
Bind errors now include invalid property names.
Previewing an imported resource that deletes and replaces due to diffs no longer panics.
Python resource arguments now accept typeddicts when no language information is specified.
Looking up a nonexistent stack reference output no longer raises an exception in Python.
Avoids cancellations caused by slow request processing in the Python callbacks server.
Fixes closure serialization on Node.js v25.2.0.
Fixes resource parenting in some refresh operations that run a program.
Avoids cancellations caused by slow processing of requests in the SDK.
Rewriting type-invalid PCL no longer causes a panic.
Fixes duplicate resource snapshot integrity issues during pulumi up --refresh --run-program when a PendingReplacement exists.
Fixes an issue where refresh with --run-program could potentially run forever.
Import errors now include the import ID for non-existent resources.
The Node.js and Python scalar return protocol now allows returning secret maps.
Go code generation for scalar return SDK functions is corrected.
Prevents a potential snapshot integrity error when a dependency fails to be destroyed with destroy --run-program.
Converting parameterized packages for .NET and Node.js now propagates local dependencies to GenerateProject.
Errors from the journaler are no longer displayed to users.
The required flag for resource inputs is now reported correctly.
Python invokes now work correctly for functions returning map types.
Stack imports now use the correct casing for the stack/latest path in the DIY backend.