Pulumi Release Notes

3.274.1 (2026-11-05)

Features

• [cli/policy] Add experimental pulumi policy exception new, list, get and remove commands to manage policy exceptions in Pulumi Cloud, hidden behind PULUMI_EXPERIMENTAL #25417
• [auto] Add org member commands to the generated automation APIs for NodeJS, Python and Go #25064
• [auto] Add org role commands to the generated automation APIs for NodeJS, Python and Go #25067

Bug Fixes

• [cli/package] Support publishing npm packages with trusted publishing credentials #24974
• [cli] Allow a project config key named secret, which was rejected by Pulumi.yaml validation #25536
• [engine] Fix .NET resource transforms failing when reading secret inputs #25569
• [engine] Fix resource transforms adding unnecessary Output wrappers to objects with nested dependencies #25568
• [engine] Revert changes to only send inputs not state to provider reads #25561

Improvements

• [cli/policy] Describe policy groups and issues in pulumi policy help #25508
• [cli/policy] Attach the ESC environments listed in the --config file in pulumi policy enable #25395
• [codegen/pcl] Print syntax.Comment and syntax.TemplateDelimiter trivia that tools build without source text #25530
• [sdk/python] Preserve argument types for functions decorated with pulumi.runtime.test #25538
• [sdk/python] Preserve value types and check key types when indexing Python Outputs #25539

Miscellaneous

• [cli/neo] Update the Neo welcome logo and place the title and greeting below it #25313
• [pkg] Add an environments parameter to httpstate/client.Client.ApplyPolicyPack #25395

3.274.0 (2026-11-03)

Features

• [cli/policy] Add pulumi policy get to show a policy pack's policies #25297
• [cli/policy] Add --output json to pulumi policy publish, enable, disable, rm and validate-config, and print the updated policy group after enable and disable #25347
• [cli/policy] Add --stack-rule and --account-rule to pulumi policy group new and edit, and show match rules in policy group console output #25345
• [cli/policy] Add pulumi stack policy ls to list the policy groups and policy packs that apply to a stack #25345
• [auto] Add schema commands to the generated automation APIs for NodeJS, Python and Go #25058
• [auto] Add org usage commands to the generated automation APIs for NodeJS, Python and Go #25059
• [auto] Add api commands to the generated automation APIs for NodeJS, Python and Go #25060
• [auto] Add org audit-log commands to the generated automation APIs for NodeJS, Python and Go #25062
• [cli/policy] Add pulumi policy issue edit to set the status, priority and assignee of a policy issue #25334
• [cli/policy] Add filter and sort flags to pulumi policy issue ls, and add pulumi policy issue export #25333
• [sdkgen/go] Generate <Resource>Exists functions that check whether a resource with a given ID exists without adopting it into the stack #25326
• [programgen/go] Support resourceExists in generated Go programs #25326
• [sdkgen/python] Generate static exists methods that check whether a resource with a given ID exists without adopting it into the stack #25336
• [programgen/python] Support resourceExists in generated Python programs #25336

Bug Fixes

• [cli] Normalize backend URLs when logging in with OIDC #25477
• [sdk/python] Explain how to install missing Python dependencies when uv package discovery requires packaging #25495
• [sdk/nodejs] Restrict @opentelemetry/api to 1.9.x so package managers such as bun and pnpm no longer install 1.10.0, which the OpenTelemetry SDK 2.x packages do not support #25444
• [cli] Document PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER as the fix for secret decryption errors when running from a workspace without local stack configuration, such as the Automation API or a saved update plan applied from a different directory #24535
• [cli/stack] Load the --copy-config-from stack before pulumi stack init creates the new stack, so a source stack that does not exist no longer leaves an empty stack behind #25421
• [cli/config] Write block-style YAML when a CLI edit adds the first entry to an empty {} mapping in a stack or project file, instead of keeping the mapping on one line, as pulumi env set does #25415
• [cli] Report that Pulumi ESC requires Pulumi Cloud before attempting login on DIY backends #25338
• [engine] Preserve snapshot integrity when a protected resource has multiple pending-delete copies of its parent #25384
• [pcl] Send the parent, version and pluginDownloadUrl invoke options to the engine #25403
• [pcl] Fix hideDiffs to resolve both resource input and output properties #25450
• [engine] Use the explicit provider of a custom parent for an invoke that sets no provider #25403
• [cli/env] Show only environment change requests in pulumi env change-request commands #25443
• [pcl] Report a diagnostic instead of panicking when a block that requires labels has none #25445
• [engine] Fix invokes and calls of extension packages #25478
• [sdk/python] Select the provider for pulumi.runtime.exists_resource from its options and parent when no resource is given #25336
• [sdk/python] Fix RecursionError after creating many dynamic resources in one process #25492
• [cli] Print a message when the CLI downloads a language runtime #25512

Improvements

• [cli/policy] Show each group's mode and Insights account count in pulumi policy group ls, including new mode and numAccounts keys in its JSON output #25345
• [cli/policy] Point agents to pulumi policy group get, pulumi stack policy ls and pulumi policy issue ls after pulumi policy group ls #25345
• [cli] Add credentials helpers for backend selection, HTTP authentication, and cloud credentials #25260
• [cli] Point AI agents that call policy endpoints through pulumi api to the matching pulumi policy command #25455
• [cli/policy] Add --closed to pulumi policy issue ls, and show priority, assignee, policy group and policy remediation details in pulumi policy issue get #25295
• [sdkgen] Reject schema property names that contain no ASCII letters, and warn on property names that collide after reduction to lower-case ASCII letters and digits #25292
• [sdk/go] Take the ID passed to Context.ExistsResource as a StringInput, since it is an import ID rather than a resource ID #25326
• [sdk/go] Add config.Value.ToCoercedObject, which returns a value with the typing Map.Set applies below the top level of a --path key #25377
• [cli] Highlight backtick-quoted commands in CLI error messages #25432
• [cli] Make pulumi import --preview-only emit the generated resource code #25448
• [engine] Add a uses_output_values flag on RegisterResourceRequest so SDKs can carry per-leaf dependency information inline as OutputValues instead of filling in a flat propertyDependencies map #25464
• [engine] Stop folding per-property dependencies into a resource's top-level Dependencies list after transforms run — Dependencies now reflects only the user's explicit depends_on, matching the behaviour already used for resources without transforms #25472
• [cli/policy] Return the full response from pulumi policy issue get --output json, with the issue under policyIssue #25295

Miscellaneous

• [sdk/dotnet] Upgrade dotnet to v3.117.0 #25501
• [yaml] Upgrade yaml to v1.38.16 #25501
• [hcl] Upgrade hcl to v0.19.1 #25501
• [java] Upgrade java to v1.39.0 #25501

3.273.0 (2026-10-28)

Features

• [auto] Add up to the generated automation APIs for NodeJS, Python and Go #25055
• [auto] Add logs commands to the generated automation APIs for NodeJS, Python and Go #25065
• [pcl] Add a resourceExists builtin that checks whether a resource with a given ID exists without adopting it into the stack #25321
• [sdkgen/nodejs] Generate static exists methods that check whether a resource with a given ID exists without adopting it into the stack #25329
• [programgen/nodejs] Support resourceExists in generated Node.js programs #25329

Bug Fixes

• [backend/service] Link to the Pulumi Cloud console root instead of a page named after the user in pulumi login, pulumi whoami --verbose, and pulumi about, so the link no longer opens a Not Found page for users without an organization of that name #25305
• [cli/package] Print the Go import path of the generated SDK when the schema sets a Go module path or import base path #25391
• [cli] Make pulumi login in agent mode log in through the browser even when shared agent credentials are valid, instead of reusing the ephemeral agent account #25349
• [pcl] Allow length of a conditional expression whose branches are null and a list #25327
• [programgen/go] Type ApplyT parameters over optional objects and enums as pointers #25337
• [programgen/nodejs,python] Parenthesize nested conditional expressions in generated TypeScript and Python programs #25331
• [engine] Pass only inputs, not state, to the provider's Read when checking whether a resource exists #25321
• [programgen/go] Fix Go program generation for a tuple of optional strings #25381
• [cli] Fix pulumi package add failing with "version must be provided when package supports packing" when a provider's schema omits its version #25393
• [cli/env] Show formatted diagnostics when pulumi env open or pulumi env run cannot evaluate an environment #25397
• [cli/install] Stop the provider plugin that pulumi install starts for local SDK generation #25392
• [cli] Stop pulumi whoami from creating an agent account when not logged in #25394
• [pcl] Fix hideDiffs to resolve resource output properties instead of input properties #25399
• [cli/display] Fix secret maps and arrays leaking into JSON preview and update output #25400

Improvements

• [cli] Remove the deprecated pulumi watch command #25323
• [cli] Remove the deprecated bare pulumi logs command #25322
• [cli] Stop automatically creating Pulumi Cloud accounts for AI agents unless PULUMI_ENABLE_AUTOMATIC_AGENT_SIGNUP is set #25402

Miscellaneous

• [sdk/dotnet] Upgrade dotnet to v3.115.0 #25178
• [yaml] Upgrade yaml to v1.38.12 #25178
• [hcl] Upgrade hcl to v0.18.6 #25178
• [java] Upgrade java to v1.37.7 #25178
• [sdk/dotnet] Upgrade dotnet to v3.116.0 #25363
• [yaml] Upgrade yaml to v1.38.13 #25363
• [hcl] Upgrade hcl to v0.18.8 #25363
• [sdk] Add managed ESC environment fields to apitypes #25372
• [sdk/go] Add workspace.Environment.DefinitionNode for stack-managed ESC environments #25374
• [sdk/dotnet] Upgrade dotnet to v3.116.2 #25426
• [yaml] Upgrade yaml to v1.38.15 #25426
• [hcl] Upgrade hcl to v0.19.0 #25426
• [java] Upgrade java to v1.38.0 #25426

With ESC Approvals, changes to a protected environment go through a change request. Teammates can review and approve the change before it’s applied.

Today we’re introducing the pulumi env change-request command to work with change requests from the CLI.

Review changes without switching to the Pulumi Cloud console, script your approval workflows, or give your agent the tools it needs to review and work with change requests.

How it works

Let’s say your my-project/prod ESC environment is set up to require approval on change. Alice wants to scale the app to 3 replicas, so she opens a change request:

$ pulumi env set my-project/prod app.replicas 3 --draft

You’re the reviewer. Here’s how you’d take it from there.

Find the change request

List the open change requests for an environment:

$ pulumi env change-request list --env my-project/prod
┌──────────────────────────────────────┬────────┐
│ ID                                   │ AUTHOR │
├──────────────────────────────────────┼────────┤
│ 3045b80b-9a13-43c3-9f63-59fa1b09e18d │ alice  │
│ 0dace5b4-ef98-4b4c-9a17-627db3662d3f │ bob    │
└──────────────────────────────────────┴────────┘

Review the change

See the details of a change request:

$ pulumi env change-request get 3045b80b-9a13-43c3-9f63-59fa1b09e18d
ID: 3045b80b-9a13-43c3-9f63-59fa1b09e18d
Environment: acme/my-project/prod
Action: update
Status: pending
Author: Alice <alice>
Created: 2 hours ago
Revision: 1
Base environment revision: 2
Current environment revision: 2
Description:
Scale up to 3 replicas
Approved: false
prod-approvers (not satisfied): 0 of 1 approvals
URL: https://app.pulumi.com/acme/esc/my-project/prod?version=3045b80b-9a13-43c3-9f63-59fa1b09e18d

See what it changes:

$ pulumi env change-request diff 3045b80b-9a13-43c3-9f63-59fa1b09e18d
--- acme/my-project/prod@2
+++ draft 3045b80b-9a13-43c3-9f63-59fa1b09e18d
@@ -1,3 +1,3 @@
values:
app:
-    replicas: 2
+    replicas: 3

Approve the change

Approve it with a comment. The CLI shows the diff again before you confirm:

$ pulumi env change-request approve 3045b80b-9a13-43c3-9f63-59fa1b09e18d -m "Looks good"
Change request 3045b80b-9a13-43c3-9f63-59fa1b09e18d will update environment acme/my-project/prod.
...
Do you want to approve this change request? yes
Approved change request 3045b80b-9a13-43c3-9f63-59fa1b09e18d

Apply the change

Once the change request has the required approvals, you or Alice can go ahead and apply it:

$ pulumi env change-request apply 3045b80b-9a13-43c3-9f63-59fa1b09e18d
Change request 3045b80b-9a13-43c3-9f63-59fa1b09e18d will update environment acme/my-project/prod.
...
Do you want to apply this change request? yes
Applied change request 3045b80b-9a13-43c3-9f63-59fa1b09e18d

That’s it! Alice’s change is now live in prod.

Beyond the basics

• For scripts and agents: pass --yes to approve and apply to skip the confirmation prompt, and --output json to get machine-readable output from commands like list, get, and apply.
• Concurrent change requests: if another change request is applied before yours, run pulumi env change-request rebase to update yours to the latest revision.

Get started

Change requests are available on the Pulumi Cloud Pro and Enterprise editions. See the pulumi env change-request docs to learn more. Give it a try, and let us know what you think in the Pulumi Community Slack!

3.272.0 (2026-10-22)

Features

• [cli/display] Collapse policy violations that an exception exempts under Policies: into one line per policy, and add --show-policy-exceptions to up and preview to list them with their exceptions #25290
• [engine] Add an AwaitError provider protocol error indicating an operation needs to be awaited; the deployment continues, the resource's outputs are unknown, and the CLI exits with the dedicated ExitAwaitError code (10) #25278
• [cli/env] Add pulumi env change-request commands for working with change requests #25122

Bug Fixes

• [cli] Name the directory searched in the no Pulumi.yaml project file found error of pulumi preview, refresh, import, logs and install instead of leaving it empty #25187
• [sdk] Keep the unknown outputs of remote components, such as those that depend on an awaiting or failed child, instead of resolving them as empty values #25291

Improvements

• [cli/env] Use --organization/-o to select the organization in pulumi env setup commands #25231
• [engine] Return dry-run outputs to dependents of resources skipped under --continue-on-error, instead of failing their registrations #25227

A remote component's output that depends on a child resource that's awaiting (or failed, or skipped) is unknown during an update, but the calling program saw it as an empty value, so apply callbacks and dependent resources ran too early with the wrong value. The unknown was lost in four places:

• The Go provider SDK only kept unknowns in its Construct response during previews.
• The engine only kept unknowns when reading a Construct response during previews.
• The Go SDK didn't advertise SupportsPartialValues, so the engine stripped any output containing an unknown from its registration responses (Node.js and Python already advertise it).
• The Go SDK resolved an unknown it wasn't expecting as a known zero value.

This keeps unknowns in Construct responses and has the Go SDK advertise partial values. Since Go can't represent a partly known value, the SDK resolves any output that contains an unknown as wholly unknown, which matches what it effectively saw before.

The new l2-failed-create-component-continue-on-error conformance test covers the same case for a failed child under --continue-on-error, and found three more places in the calling program:

• The Go SDK dropped an output's dependencies on the component's children, so dependents of a failed child weren't skipped.
• The Node.js SDK resolved unknown outputs as undefined during an update.
• The PCL interpreter didn't advertise SupportsPartialValues, and ignored per-property dependencies.

Florian's end-to-end test (TestAwaitingChildOfRemoteComponent) is kept alongside it. Node.js and Python component providers haven't been checked yet.

🤖 Generated with Claude Code

Co-authored-by: Fraser Waters [email protected]
Co-authored-by: Claude Opus 5.5 [email protected]
Co-authored-by: flostadler [email protected]

3.271.0 (2026-10-21)

Features

• [engine] Add an id field to ReadResourceResponse so providers can return a resolved id that differs from the one supplied on the request; SDKs now surface this id via .id and resolve it as unknown when empty during preview #25228
• [cli/policy] Create version 2 of the --policy-pack-config format, nesting policy configs under policies and adding an exceptions field #25280
• [auto] Add state commands to the generated automation APIs for NodeJS, Python and Go #25071
• [auto] Add env commands to the generated automation APIs for NodeJS, Python and Go #25073

Bug Fixes

• [engine] Skip the provider Read in preview when a read's dependency is being created or replaced, and return unknown outputs to the SDK #25222
• [cli] Fix pulumi org audit-log ignoring --user and --event-type, switch to the V2 audit log API, and add --end-time #24665
• [engine] Stop sending resource inputs as the State field of Read to providers; providers can now distinguish a user-driven Get/import from a refresh by whether State is populated #24973
• [engine] Redact secret values in invalid input diagnostics unless --show-secrets is passed #24995
• [pcl] Make the PCL interpreter's lookup return the default unchanged when the key is absent from a map #25112
• [sdk] Resolve the outputs of a resource that fails under --continue-on-error as unknown instead of failing them, so the rest of the program keeps running; recover no longer catches these failures #25168
• [sdk] Resolve the outputs of a read that fails under --continue-on-error as unknown instead of as known empty values #25169
• [sdk/python] Fix false missing-argument errors from ty on Output.apply and other Output methods #25181
• [sdk/nodejs] Support single-member enums and as const objects in Node.js component inputs and outputs #25273

Improvements

• [cli/new] Stop suggesting pulumi new in the first-login welcome message when the login was started by pulumi new #25257
• [protobuf] Pass a mapper target to language hosts in GenerateProgram and GenerateProject requests #25277

Recently, some members of the Pulumi team spent time in San Francisco attending the CoreWeave: Fully Connected 2026 conference, where we had a chance to talk to everyone from solo developers to engineering leaders at Fortune 500 organizations and learn more about how they are building with AI.

A frequent topic of conversation was open weight models and self-hosted inference. Whether AI is integrated into your platform, your product, or your productivity pipelines, rising token costs have decision makers everywhere giving open weight models a closer look, in exchange for the promise of tighter control over spend and greater domain expertise.

If you are actively exploring the space or building with AI yourself, you may already have seen the challenges that come with serving inference at scale:

• Model stability and reliability can differ (sometimes dramatically) across hardware architectures and at different traffic volumes.
• Model performance and throughput can change depending on your workload type or model configuration.
• Cost differences and commitments across providers can make tracking spend challenging.
• Supply constraints and capacity shortages mean teams can’t source hardware when they need it most.

Many teams naturally gravitate toward multicloud strategies that combine hyperscalers with specialized GPU clouds as a way of balancing spend, performance, and reliability. One thing we’ve seen is that developers everywhere are choosing Pulumi to help them navigate the fragmented hardware ecosystem and maintain consistent environments, even when the provider is different.

As part of our ongoing commitment to building better tools for builders, we’re excited to announce the Pulumi NVIDIA AI Cluster Runtime (AICR) provider to help make your ideal self-hosted AI infrastructure available on demand. The Pulumi AICR provider lets you spin up workload-specific training and inference endpoints as you need them, configured with pre-validated recipes to match your workload with the right hardware across a number of cloud-based GPU providers.

AI performance-engineering team as code

Deploying a cluster of GPU nodes as a production AI platform is a complex and time-consuming exercise that often requires specialized expertise. NVIDIA’s AICR offers a collection of validated GPU infrastructure recipes for various cloud providers. By building a provider around AICR, Pulumi offers an efficient and reliable way to manage your GPU clusters, dramatically shortening time to first token.

In addition to bundling a complex technology stack, Pulumi makes it simple to deploy with minimal verbosity. pulumi preview shows every component the recipe expands into (namespaces, operators, schedulers, metrics, training runtime) before anything is applied. pulumi up then deploys them as children of a single resource, with a full day-2 lifecycle: diff, update, drift detection, and destroy.

This short Python snippet shows how easy it is to use AICR to deploy a simple pre-validated inference endpoint without wasting time or resources on guess-and-check configuration, so you can get started serving production traffic immediately.

import pulumi
import pulumi_labs_nvidia_aicr as aicr

config = pulumi.Config()
service = config.get("service") or "lke"
accelerator = config.get("accelerator") or "rtx-pro-6000"
# The CoreWeave Kubernetes Service (CKS) kubeconfig is a plain token config downloaded
# from the CoreWeave console and placed in the same directory as this script (gitignored).
with open("kubeconfig.yaml") as f:
    kubeconfig = f.read()

gpu_stack = aicr.ClusterStack("nvidia-aicr",
    kubeconfig = pulumi.Output.secret(kubeconfig),
    accelerator = accelerator,
    service = service,
    intent = "inference",
    nodes = 2,
    skip_components = [
        "gpu-operator",
        "nfd",
        "nvidia-dra-driver-gpu",
    ],
    skip_await = True,
)

Deploying an inference endpoint to CoreWeave with the Pulumi NVIDIA AICR provider

Behind the scenes, the recipe resolves the code into the full list of Kubernetes components. Recipes are tested and validated by NVIDIA across a broad matrix of both hardware (EKS, GKE, and AKS; A100 through GB200; Ubuntu, RHEL, COS, and Talos; Kubeflow, NIM, Dynamo, Slurm, and Run:ai) and cloud provider permutations. Because AICR is open source, the SDK lends itself to configuration by new providers, giving you a future-forward inference solution that performs in all of the areas that count:

• Deployment: does the running cluster match the recipe? Operator health, GPU visibility via nvidia-smi, and metrics flowing.
• Conformance: dynamic resource allocation, gang scheduling, and job-level networking behave as required.
• Performance: NCCL all-reduce bandwidth for training; model throughput and latency for inference.

Interested in learning more about how Pulumi can help you scale your AI infrastructure? Join the Pulumi Community Slack and the hundreds of builders there, and get help crafting your dream infrastructure today.

Policy groups decide which policy packs apply to which stacks and cloud accounts. Until now, stacks and accounts were added to policy groups individually, so every new stack required opting into their correct group by hand. Policy groups membership can now be managed by tags, so new infrastructure gets the right policy coverage automatically as it’s created.

What’s new

Policy groups now support tag matching conditions. Every stack or cloud account whose tags match the condition joins the group, and membership stays current as tags change. Tag rules work alongside the stacks and accounts you add individually, so you can adopt them without restructuring your existing groups.

To add one, open a policy group in Pulumi Cloud and select Match by tags.

Or define it in code with the Pulumi Service Provider:

import * as pulumiservice from "@pulumi/pulumiservice";

new pulumiservice.api.PolicyGroup("payments-production", {
    orgName: "my-org",
    name: "payments-production",
    mode: "preventative",
    stackMatchRule: pulumiservice.buildStackMatchRuleOutput({
        rules: [{
            conditions: [{
                key: "env",
                value: "prod"
            }, {
                key: "team",
                value: "payments"
            }]
        }],
    }).matchRule,
});

new pulumiservice.api.PolicyGroup("pci-accounts", {
    orgName: "my-org",
    name: "pci-accounts",
    mode: "audit",
    accountMatchRule: pulumiservice.buildAccountMatchRuleOutput({
        rules: [{
            conditions: [{
                key: "env",
                value: "prod"
            }, {
                key: "compliance",
                value: "pci"
            }]
        }],
    }).matchRule,
});

Example: enforcement by environment

A common pattern is one policy group per environment tier, with stricter enforcement in production:

• A production preventative group with a rule matching env: prod, where critical policies are mandatory.
• A development preventative group with a rule matching env: dev, where the same packs are advisory.

A new stack tagged env: prod joins your production policy group automatically, with no one editing the group. The same approach works for audit groups and cloud accounts, for example matching accounts tagged compliance: pci to an audit group running a PCI DSS policy pack.

Get started

Tag rules are available now in Pulumi Cloud. To learn more, see policy groups.