# Pulumi changelog

> Infrastructure as code in familiar programming languages.

- Vendor: Pulumi
- Category: Developer Tools
- Official site: https://www.pulumi.com
- Tracked by: What's New (https://whatsnew.fyi/product/pulumi)
- Harvested from: GitHub (pulumi/pulumi)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v3.256.0

- Date: 2026-08-04
- Version: v3.256.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.256.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.256.0

- **added** — Add `--ignore-protect` flag to `pulumi up`, `pulumi preview` and `pulumi destroy` to allow deleting protected resources without unprotecting them in the state first
- **added** — Add an optional `--export-env-vars` flag to the `env provider {aws,azure,gcp}-login` commands to also set the standard SDK environment variables referencing the login outputs
- **added** — Add a `--server` flag to `pulumi package add`, `publish`, `get-schema`, `get-mapping`, `gen-sdk`, `info` and `pulumi schema check` that skips package resolution and uses the given URL as the plugin download URL
- **fixed** — Fix `pulumi login --insecure` not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates
- **fixed** — Scope current stack selection to the active backend so switching backends no longer surfaces stale stack errors
- **fixed** — Parent an invoke written inside a component to that component, lower a component's outputs, and only import `fmt` when a component needs it in Go program generation
- **fixed** — Parent an invoke written inside a component to that component in Python program generation so it resolves the component's providers
- **fixed** — Defer output-form invokes that depend on a remote component whose resources are pending creation in Node.js by declaring invoke dependencies to the engine
- **fixed** — Gate invokes on the created-ness of their declared dependencies, including the children of remote components, resolving them as unknown during previews that still have to create them
- **fixed** — Defer output-form invokes that depend on a remote component whose resources are pending creation in Go by declaring invoke dependencies to the engine
- **fixed** — Declare invoke dependencies to the engine in PCL so invokes that depend on pending resources, including remote components, resolve as unknown during previews
- **fixed** — Defer output-form invokes that depend on a remote component whose resources are pending creation in Python by declaring invoke dependencies to the engine
- **fixed** — `env provider` no longer writes a new environment revision when the resulting definition is unchanged
- **fixed** — Output-form invokes in Go now infer their resource dependencies from their arguments, so they are skipped during preview while a dependent resource is pending creation and their results carry those dependencies
- **fixed** — Fix nested optional output conversions in Go SDK generation
- **fixed** — Fix a plugin process leak in `NewPolicyAnalyzer` when `ConfigureStack` fails after the plugin has booted
- **fixed** — Avoid redundant applies when projecting properties from generated Go object outputs
- **fixed** — Fix 403 errors writing to third-party S3-compatible backends by defaulting request_checksum_calculation to when_required when the s3:// backend URL sets a custom endpoint
- **fixed** — Avoid redundant applies when projecting properties from Node.js outputs
- **fixed** — Avoid redundant applies when projecting properties from Python outputs

##### 3.256.0 (2026-08-04)

###### Features

- [cli] Add `--ignore-protect` flag to `pulumi up`, `pulumi preview` and `pulumi destroy` to allow deleting protected resources without unprotecting them in the state first [#24053](https://github.com/pulumi/pulumi/pull/24053)
- [cli/env] Add an optional `--export-env-vars` flag to the `env provider {aws,azure,gcp}-login` commands to also set the standard SDK environment variables referencing the login outputs [#24055](https://github.com/pulumi/pulumi/pull/24055)
- [cli] Add a `--server` flag to `pulumi package add`, `publish`, `get-schema`, `get-mapping`, `gen-sdk`, `info` and `pulumi schema check` that skips package resolution and uses the given URL as the plugin download URL [#24107](https://github.com/pulumi/pulumi/pull/24107)

###### Bug Fixes

- [backend/service] Fix `pulumi login --insecure` not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates [#24134](https://github.com/pulumi/pulumi/pull/24134)
- [cli] Scope current stack selection to the active backend so switching backends no longer surfaces stale stack errors [#23974](https://github.com/pulumi/pulumi/pull/23974)
- [programgen/go] Parent an invoke written inside a component to that component, lower a component's outputs, and only import `fmt` when a component needs it [#24019](https://github.com/pulumi/pulumi/pull/24019)
- [programgen/python] Parent an invoke written inside a component to that component, so it resolves the component's providers [#24018](https://github.com/pulumi/pulumi/pull/24018)
- [sdk/nodejs] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#24042](https://github.com/pulumi/pulumi/pull/24042)
- [engine] Gate invokes on the created-ness of their declared dependencies, including the children of remote components, resolving them as unknown during previews that still have to create them [#24040](https://github.com/pulumi/pulumi/pull/24040)
- [sdk/go] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#24044](https://github.com/pulumi/pulumi/pull/24044)
- [pcl] Declare invoke dependencies to the engine so invokes that depend on pending resources, including remote components, resolve as unknown during previews [#24041](https://github.com/pulumi/pulumi/pull/24041)
- [sdk/python] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#24043](https://github.com/pulumi/pulumi/pull/24043)
- [cli/env] `env provider` no longer writes a new environment revision when the resulting definition is unchanged [#24055](https://github.com/pulumi/pulumi/pull/24055)
- [sdk/go] Output-form invokes now infer their resource dependencies from their arguments, so they are skipped during preview while a dependent resource is pending creation and their results carry those dependencies [#24054](https://github.com/pulumi/pulumi/pull/24054)
- [sdkgen/go] Fixes nested optional output conversions [#24096](https://github.com/pulumi/pulumi/pull/24096)
- [engine] Fix a plugin process leak in `NewPolicyAnalyzer` when `ConfigureStack` fails after the plugin has booted [#24106](https://github.com/pulumi/pulumi/pull/24106)
- [programgen/go] Avoid redundant applies when projecting properties from generated Go object outputs [#24112](https://github.com/pulumi/pulumi/pull/24112)
- [backend/diy] Fix 403 errors writing to third-party S3-compatible backends (e.g. IBM COS, MinIO) by defaulting request_checksum_calculation to when_required when the s3:// backend URL sets a custom endpoint [#24109](https://github.com/pulumi/pulumi/pull/24109)
- [programgen/nodejs] Avoid redundant applies when projecting properties from Node.js outputs [#2411

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.256.0]_

### v3.255.0

- Date: 2026-07-28
- Version: v3.255.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.255.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.255.0

- **added** — Add an --extension flag to package commands for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install
- **added** — Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment
- **added** — Resolve an invoke's provider from the providers option of the parent named on the request, matching the resolution applied to resource registrations
- **added** — Add --resources to refer to existing resources in state in do input expressions
- **fixed** — Parent an invoke written inside a component to that component, so it resolves the component's providers
- **fixed** — Apply the providers option of a component block to the resources and invokes it declares
- **fixed** — Fix import file generation when parent resources share names
- **fixed** — Fix parallel pulumi install processes sharing a PULUMI_HOME intermittently failing with a missing provider executable error
- **fixed** — Allow Construct and Call methods to run concurrently in provider servers
- **changed** — Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in
- **added** — Add a --summary flag to pulumi stack history events that reduces a past update's events to the same summary shape as a live pulumi up --output json, extended with error diagnostics and failed-resource markers
- **changed** — Allow state converters to supply resource inputs and outputs in ConvertState responses
- **changed** — Allow policy packs to point to executable binaries, not just script folders
- **changed** — The Neo diagnostics link now suggests pulumi neo --debug-update or pulumi neo --debug-preview to investigate the failed operation
- **changed** — Allow UV_PROJECT_ENVIRONMENT to override the virtualenv path if uv is used
- **changed** — Allow otel traces to be sent over https

##### 3.255.0 (2026-07-28)

###### Features

- [cli] Add an `--extension` flag to package commands for extension-parameterized packages, reinstalled from `Pulumi.yaml` on `pulumi install`
- [cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment [#23993](https://github.com/pulumi/pulumi/pull/23993)
- [engine] Resolve an invoke's provider from the `providers` option of the parent named on the request, matching the resolution applied to resource registrations [#24016](https://github.com/pulumi/pulumi/pull/24016)
- [cli/do] Add `--resources` to refer to existing resources in state in `do` input expressions [#24037](https://github.com/pulumi/pulumi/pull/24037)

###### Bug Fixes

- [programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers [#24017](https://github.com/pulumi/pulumi/pull/24017)
- [pcl] Apply the `providers` option of a `component` block to the resources and invokes it declares [#24016](https://github.com/pulumi/pulumi/pull/24016)
- [cli/import] Fix import file generation when parent resources share names [#24069](https://github.com/pulumi/pulumi/pull/24069)
- [cli] Fix parallel `pulumi install` processes sharing a `PULUMI_HOME` intermittently failing with a missing provider executable error [#24080](https://github.com/pulumi/pulumi/pull/24080)
- [sdk/python] Allow Construct and Call methods to run concurrently in provider servers [#24081](https://github.com/pulumi/pulumi/pull/24081)

###### Improvements

- [engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) [#23856](https://github.com/pulumi/pulumi/pull/23856)
- [cli] Add a `--summary` flag to `pulumi stack history events` that reduces a past update's events to the same summary shape as a live `pulumi up --output json`, extended with error diagnostics and failed-resource markers [#23960](https://github.com/pulumi/pulumi/pull/23960)
- [protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses [#23987](https://github.com/pulumi/pulumi/pull/23987)
- [engine] Allow policy packs to point to executable binaries, not just script folders [#24052](https://github.com/pulumi/pulumi/pull/24052)
- [cli/display] The Neo diagnostics link now suggests `pulumi neo --debug-update` or `pulumi neo --debug-preview` to investigate the failed operation [#24075](https://github.com/pulumi/pulumi/pull/24075)
- [sdk/python] Allow `UV_PROJECT_ENVIRONMENT` to override the virtualenv path if uv is used [#24077](https://github.com/pulumi/pulumi/pull/24077)
- [cli] Allow otel traces to be sent over https [#24078](https://github.com/pulumi/pulumi/pull/24078)

### v3.254.0

- Date: 2026-07-23
- Version: v3.254.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.254.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.254.0

- **added** — Add `pulumi logs share` command for sharing logs with Pulumi
- **added** — Add `pulumi stack migrate` to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider
- **added** — Add an `--override-env` flag to `up`, `preview`, `destroy`, and `refresh` to substitute imported environments for a single run without editing the stack config
- **added** — Add `pulumi neo acp` to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options
- **added** — Retry transient `pulumi neo` stream and message-send failures, and add `pulumi neo resume` with chat history
- **changed** — Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in `pulumi neo`
- **added** — Add `upsert` to do, allowing resources to be statefully created or updated in a stack
- **added** — Add `pulumi.run` for natively awaited Python program entrypoints that can return stack outputs
- **added** — Allow expressions for number inputs in do
- **added** — Allow expressions for boolean inputs in do
- **added** — Add `--runtime-options` to `pulumi policy new`
- **added** — Add support for stateful create in do
- **added** — Add support for stateful delete in do
- **fixed** — Fix Go codegen for plain properties nested inside non-plain objects
- **fixed** — Keep `pulumi neo` connected during quiet periods when the event stream only receives keep-alive heartbeats
- **fixed** — Validate snippets before persisting them
- **fixed** — Fix dangling ReplaceWith references in the journal replayer
- **fixed** — Fix the converter plugin not being called if just attributes needed converting
- **fixed** — Generate compilable Go for programs that use discriminated union members as array/list elements
- **changed** — Align commands with CLI naming guidelines, adding `ls`, `rm`, `delete`, `mv`, `update`, `modify`, `create` and `setup` aliases to list/remove/move/edit/new commands and making `state remove` and `package remove` the canonical names with `delete` kept as an alias

##### 3.254.0 (2026-07-23)

###### Features

- [cli] Add `pulumi logs share` command for sharing logs with Pulumi [#22546](https://github.com/pulumi/pulumi/pull/22546)
- [cli] Add `pulumi stack migrate` to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider [#22902](https://github.com/pulumi/pulumi/pull/22902)
- [cli/config] Add an `--override-env` flag to `up`, `preview`, `destroy`, and `refresh` to substitute imported environments for a single run without editing the stack config [#23562](https://github.com/pulumi/pulumi/pull/23562)
- [cli] Add `pulumi neo acp` to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options [#23886](https://github.com/pulumi/pulumi/pull/23886)
- [cli/neo] Retry transient `pulumi neo` stream and message-send failures, and add `pulumi neo resume` with chat history [#23835](https://github.com/pulumi/pulumi/pull/23835)
- [cli/neo] Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in `pulumi neo` [#23932](https://github.com/pulumi/pulumi/pull/23932)
- [cli/do] Add `upsert` to do, allowing resources to be statefully created or updated in a stack [#23813](https://github.com/pulumi/pulumi/pull/23813)
- [sdk/python] Add `pulumi.run` for natively awaited Python program entrypoints that can return stack outputs [#23945](https://github.com/pulumi/pulumi/pull/23945)
- [cli/do] Allow expressions for number inputs [#23954](https://github.com/pulumi/pulumi/pull/23954)
- [cli/do] Allow expressions for boolean inputs [#23967](https://github.com/pulumi/pulumi/pull/23967)
- [cli/policy] Add `--runtime-options` to `pulumi policy new` [#23992](https://github.com/pulumi/pulumi/pull/23992)
- [cli/do] Add support for stateful create [#23996](https://github.com/pulumi/pulumi/pull/23996)
- [cli/do] Add support for stateful delete [#24000](https://github.com/pulumi/pulumi/pull/24000)

###### Bug Fixes

- [sdkgen/go] Fix Go codegen for plain properties nested inside non-plain objects [#22524](https://github.com/pulumi/pulumi/pull/22524)
- [cli/neo] Keep `pulumi neo` connected during quiet periods when the event stream only receives keep-alive heartbeats [#23935](https://github.com/pulumi/pulumi/pull/23935)
- [engine] Validate snippets before persisting them [#23920](https://github.com/pulumi/pulumi/pull/23920)
- [backend] Fix dangling ReplaceWith references in the journal replayer [#23927](https://github.com/pulumi/pulumi/pull/23927)
- [cli/do] Fix the converter plugin not being called if just attributes needed converting [#23948](https://github.com/pulumi/pulumi/pull/23948)
- [programgen/go] Generate compilable Go for programs that use discriminated union members as array/list elements [#23980](https://github.com/pulumi/pulumi/pull/23980)

###### Improvements

- [cli] Align commands with the CLI naming guidelines, adding `ls`, `rm`, `delete`, `mv`, `update`, `modify`, `create` and `setup` aliases to list/remove/move/edit/new commands and making `state remove` and `package remove` the canonical names with `delete` kept as an alias [#23903](https://github.com/pulumi/pulumi/pull/23903)
- [cli] Suggest closely-matching commands from the whole command tree when an unknown command is entered [#23848](https://github.com/pulumi/pulumi/pull/23848)
- [cli] Print help but exit with a non-zero code when `pulumi` is run without a command, matching the behavior of other group commands [#23848](https://github.com/pulumi/pulumi/pull/23848)
- [programgen] Support `onError` resource hooks in generated Go, NodeJS, and Python programs and in the PCL runtime, retrying the failed operation when the hook command exits successfully [#23839](https://github.com/pulumi/pulumi/pull/23839)
- [protobuf] Add parent and properties fields to ResourceImport so state converters can express resource hierarchy and

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.254.0]_

### v3.253.0

- Date: 2026-07-14
- Version: v3.253.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.253.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.253.0

- **added** — Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations
- **fixed** — Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames
- **fixed** — Respect the -v log level again so that without -v only warnings and errors are written to stderr
- **fixed** — Correctly generate provider resources declared inside PCL components for Node.js, Python and Go
- **added** — Add a --version flag to the pulumi command that prints the version, same as pulumi version
- **changed** — Align env commands with the CLI naming guidelines, making list, remove and move the canonical names with ls, rm, delete and mv kept as aliases

##### 3.253.0 (2026-07-14)

###### Features

- [auto/go] Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations [#23833](https://github.com/pulumi/pulumi/pull/23833)

###### Bug Fixes

- [sdk] Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames [#23566](https://github.com/pulumi/pulumi/pull/23566)
- [cli] Respect the -v log level again so that without -v only warnings and errors are written to stderr [#23910](https://github.com/pulumi/pulumi/pull/23910)
- [codegen] Correctly generate provider resources declared inside PCL components for Node.js, Python and Go [#23904](https://github.com/pulumi/pulumi/pull/23904)

###### Improvements

- [cli] Add a `--version` flag to the `pulumi` command that prints the version, same as `pulumi version` [#23898](https://github.com/pulumi/pulumi/pull/23898)
- [cli] Align `env` commands with the CLI naming guidelines, making `list`, `remove` and `move` the canonical names with `ls`, `rm`, `delete` and `mv` kept as aliases [#23901](https://github.com/pulumi/pulumi/pull/23901)

### v3.252.0

- Date: 2026-07-13
- Version: v3.252.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.252.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.252.0

- **added** — Add `import` to the generated automation APIs for NodeJS, Python and Go
- **changed** — Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud
- **changed** — Show command name for cli commands when running any command that lists logs
- **changed** — Render strings containing non-UTF8 bytes as b"<base64>" in diffs and JSON output
- **added** — Add a `--reason` flag to `pulumi env open-request` to explain the request to approvers
- **changed** — Improve the error message when a resource URN is not found in the state for `pulumi state` commands, suggesting close-matching URNs and how to list the URNs in the stack
- **added** — Allow binding hooks to a resource's `onError` option
- **added** — Add a `production` runtime option for Node.js projects that skips `devDependencies` when set to `true` in `Pulumi.yaml`
- **fixed** — Exit with a non-zero code when a command group such as `pulumi env` is given an unknown subcommand or no subcommand at all
- **fixed** — Fix a panic when displaying a stack-level policy violation
- **fixed** — Make reading non-secret stack outputs and running `pulumi about` no longer require the passphrase for passphrase-encrypted stacks
- **fixed** — Avoid `pulumi logs <command>` showing the log for the currently running command
- **fixed** — Fix calling delete on PF resources that need read called first
- **fixed** — Submit the change request created by `pulumi env open-request` so it is pending approval instead of being left as an unsubmitted draft
- **fixed** — Fix the initial prompt sometimes rendering above the welcome banner in `pulumi neo`
- **fixed** — Fix importing a resource whose import identifier differs from its canonical ID causes the resource to be deleted on a subsequent update
- **fixed** — Deduplicate identical apply arguments to avoid unnecessary Promise.all/pulumi.all/Output.All in generated code
- **fixed** — Failed resource registrations will return faulted outputs, not unknown outputs
- **fixed** — Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages
- **changed** — Report the TypeScript version in `pulumi about`

##### 3.252.0 (2026-07-13)

###### Features

- [auto] Add `import` to the generated automation APIs for NodeJS, Python and Go [#23876](https://github.com/pulumi/pulumi/pull/23876)
- [cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud [#23811](https://github.com/pulumi/pulumi/pull/23811)
- [cli] Show command name for cli commands when running any command that lists logs [#23889](https://github.com/pulumi/pulumi/pull/23889)
- [cli/display] Render strings containing non-UTF8 bytes as b"<base64>" in diffs and JSON output [#23870](https://github.com/pulumi/pulumi/pull/23870)
- [cli/env] Add a `--reason` flag to `pulumi env open-request` to explain the request to approvers [#23802](https://github.com/pulumi/pulumi/pull/23802)
- [cli/state] Improve the error message when a resource URN is not found in the state for `pulumi state` commands, suggesting close-matching URNs and how to list the URNs in the stack [#23812](https://github.com/pulumi/pulumi/pull/23812)
- [pcl] Allow binding hooks to a resource's `onError` option [#23838](https://github.com/pulumi/pulumi/pull/23838)
- [sdk/nodejs] Add a `production` runtime option for Node.js projects. When set to `true` in `Pulumi.yaml`, `pulumi install` skips `devDependencies` (npm `--production`, pnpm `--production`, yarn `--production`). [#23849](https://github.com/pulumi/pulumi/pull/23849)

###### Bug Fixes

- [cli] Exit with a non-zero code when a command group such as `pulumi env` is given an unknown subcommand or no subcommand at all [#23814](https://github.com/pulumi/pulumi/pull/23814)
- [cli] Fix a panic when displaying a stack-level policy violation [#23692](https://github.com/pulumi/pulumi/pull/23692)
- [cli] Make reading non-secret stack outputs and running `pulumi about` no longer require the passphrase for passphrase-encrypted stacks [#23820](https://github.com/pulumi/pulumi/pull/23820)
- [cli] Avoid `pulumi logs <command>` showing the log for the currently running command [#23887](https://github.com/pulumi/pulumi/pull/23887)
- [cli/do] Fix calling delete on PF resources that need read called first [#23837](https://github.com/pulumi/pulumi/pull/23837)
- [cli/env] Submit the change request created by `pulumi env open-request` so it is pending approval instead of being left as an unsubmitted draft [#23802](https://github.com/pulumi/pulumi/pull/23802)
- [cli/neo] Fix the initial prompt sometimes rendering above the welcome banner in `pulumi neo` [#23831](https://github.com/pulumi/pulumi/pull/23831)
- [engine] Fix importing a resource whose import identifier differs from its canonical ID causes the resource to be deleted on a subsequent update [#23834](https://github.com/pulumi/pulumi/pull/23834)
- [programgen] Deduplicate identical apply arguments to avoid unnecessary Promise.all/pulumi.all/Output.All in generated code [#22293](https://github.com/pulumi/pulumi/pull/22293)
- [sdk] Failed resource registrations will return faulted outputs, not unknown outputs [#23844](https://github.com/pulumi/pulumi/pull/23844)
- [sdk/nodejs] Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages [#23866](https://github.com/pulumi/pulumi/pull/23866)

###### Miscellaneous

- [sdk/nodejs] Report the TypeScript version in `pulumi about` [#23850](https://github.com/pulumi/pulumi/pull/23850)
- [sdk/nodejs] Update OpenTelemetry dependencies [#23855](https://github.com/pulumi/pulumi/pull/23855)

### v3.251.0

- Date: 2026-07-08
- Version: v3.251.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.251.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.251.0

- **fixed** — Show a retain marker for retain-on-delete resources in --diff output
- **fixed** — Don't miscopy out archives
- **added** — Add pulumi neo --debug-update and pulumi neo --debug-preview flags to investigate a failed update or preview
- **changed** — Add an ecosystem field to converter mapping requests so a converter can request mappings for the ecosystem it consumes rather than its own name
- **removed** — pulumi deployment settings no longer writes the local Pulumi.<stack>.deploy.yaml file; the experimental init, pull, configure, and env subcommands have been removed, and the CLI no longer calls the deployment-settings encrypt endpoint
- **removed** — Remove the deployment settings file (Pulumi.<stack>.deploy.yaml) entirely, including the pulumi deployment settings push command, the --config-file flag, and SDK helpers that read the file
- **fixed** — Prevent plugin debug logs from appearing as raw JSON in the CLI's output when logging with --logtostderr
- **changed** — Report the new revision number when an environment definition is updated (e.g. pulumi env edit, pulumi env provider, pulumi env version rollback)
- **changed** — Support importing resources under parameterized providers from a converter or import file
- **changed** — Support importing resources under extension-parameterized providers
- **added** — Add TargetSnippets to deployment options to target snippets by UUID
- **changed** — Add OpenTelemetry spans to the StackReference read path so performance traces can pinpoint slow snapshot fetches, deserialization, or secret decryption
- **added** — Invoke functions declared with multi-argument inputs using positional arguments in PCL
- **fixed** — Don't include the version in module paths when serializing functions when using pnpm
- **added** — Generate SDKs and programs for extension-parameterized packages

##### 3.251.0 (2026-07-08)

###### Bug Fixes

- [cli] Show a `retain` marker for retain-on-delete resources in `--diff` output [#23754](https://github.com/pulumi/pulumi/pull/23754)
- [cli] Don't miscopy out archives [#23798](https://github.com/pulumi/pulumi/pull/23798)

###### Miscellaneous

- [cli] Add `pulumi neo --debug-update` and `pulumi neo --debug-preview` flags to investigate a failed update or preview, suggested in the failure output [#23499](https://github.com/pulumi/pulumi/pull/23499)

###### Improvements

- [cli/convert] Add an `ecosystem` field to converter mapping requests so a converter can request mappings for the ecosystem it consumes rather than its own name [#23804](https://github.com/pulumi/pulumi/pull/23804)
- [cli/deployment] `pulumi deployment settings` no longer writes the local `Pulumi.<stack>.deploy.yaml` file: the experimental `init`, `pull`, `configure`, and `env` subcommands have been removed, and the CLI no longer calls the deployment-settings encrypt endpoint. `get`/`edit`/`destroy` continue to manage settings directly in Pulumi Cloud [#23480](https://github.com/pulumi/pulumi/pull/23480)
- [cli/deployment] The deployment settings file (`Pulumi.<stack>.deploy.yaml`) has been removed entirely. The experimental `pulumi deployment settings push` (`update`/`up`) command, the `--config-file` flag, and the SDK helpers that read the file have been removed. Manage deployment settings directly in Pulumi Cloud with `pulumi deployment settings get`, `edit`, and `destroy` [#23480](https://github.com/pulumi/pulumi/pull/23480)

###### Bug Fixes

- [cli/display] Prevent plugin debug logs from appearing as raw JSON in the CLI's output when logging with `--logtostderr` [#23633](https://github.com/pulumi/pulumi/pull/23633)

###### Improvements

- [cli/env] Report the new revision number when an environment definition is updated (e.g. `pulumi env edit`, `pulumi env provider`, `pulumi env version rollback`) [#23799](https://github.com/pulumi/pulumi/pull/23799)

###### Miscellaneous

- [cli/env] Fold the Pulumi ESC engine and CLI into the pulumi/pulumi monorepo, removing the sdk↔esc Go module cycle. Internal refactor with no user-facing behavior change; `pulumi env`/`pulumi esc` are unaffected. [#23746](https://github.com/pulumi/pulumi/pull/23746)

###### Improvements

- [cli/import] Support importing resources under parameterized providers from a converter or import file [#23763](https://github.com/pulumi/pulumi/pull/23763)
- [cli/import] Support importing resources under extension-parameterized providers [#23779](https://github.com/pulumi/pulumi/pull/23779)

###### Features

- [engine] Add `TargetSnippets` to deployment options to target snippets by UUID. [#23745](https://github.com/pulumi/pulumi/pull/23745)

###### Improvements

- [engine] Add OpenTelemetry spans to the StackReference read path so performance traces can pinpoint slow snapshot fetches, deserialization, or secret decryption [#23787](https://github.com/pulumi/pulumi/pull/23787)

###### Features

- [programgen/pcl] Invoke functions declared with multi-argument inputs using positional arguments in PCL [#23571](https://github.com/pulumi/pulumi/pull/23571)

###### Bug Fixes

- [sdk/nodejs] Don't include the version in module paths when serializing functions when using pnpm [#23767](https://github.com/pulumi/pulumi/pull/23767)

###### Features

- [sdkgen] Generate SDKs and programs for extension-parameterized packages [#23579](https://github.com/pulumi/pulumi/pull/23579)

### v3.250.0

- Date: 2026-07-02
- Version: v3.250.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.250.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.250.0

- **fixed** — Fix recursive property log marshaling in CLI engine

##### 3.250.0 (2026-07-01)

###### Bug Fixes

- [cli/engine] Fix recursive property log marshaling [#23773](https://github.com/pulumi/pulumi/pull/23773)

### v3.249.0

- Date: 2026-07-01
- Version: v3.249.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.249.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.249.0

- **fixed** — Fix `pulumi stack tag rm` not removing the last tag on self-managed (diy) backends
- **fixed** — Don't fail an operation due to a logging failure
- **added** — Add `--skip-config-validation` flag to preview, up, refresh, and destroy to skip validation of stack config against the project config schema
- **changed** — Enable automatic logging for every command by default
- **fixed** — Don't ignore diffs in `Output` values
- **fixed** — Use display resource type names in policy violation output
- **added** — Add `--output $format` flag to `pulumi stack {list,history,tag list}`
- **added** — Add --output $format to `pulumi policy list` and `pulumi policy group list`
- **added** — Add --output $format to `pulumi project list`
- **added** — Add `--output $format` flag to `pulumi config env list`
- **changed** — `pulumi login` will warn if the given login differs from PULUMI_BACKEND_URL
- **fixed** — Error when converting a Terraform program to the `hcl` language
- **fixed** — Fix TestDebuggerAttach for dlv@1.27
- **added** — Add `--output $format` to `pulumi plugin list`
- **added** — Add a `--file` flag to `pulumi policy analyze` to analyze a state file without requiring a stack or backend login
- **changed** — Allow ProgramTest to use npm for Node.js tests
- **fixed** — Generate numeric `range` loops in NodeJS with a per-iteration binding so deferred applies in the loop body observe the correct index
- **changed** — Update the dotnet and java language runtimes
- **fixed** — Fix FileArchive nested in an AssetArchive producing zip/tar entries with backslashes on Windows
- **changed** — Move provider RPC setup code to the sdk module
- **changed** — Use npm as the package manager for the Node.js SDK

##### 3.249.0 (2026-07-01)

###### Bug Fixes

- [backend/diy] Fix `pulumi stack tag rm` not removing the last tag on self-managed (diy) backends [#23702](https://github.com/pulumi/pulumi/pull/23702)
- [backend/service] Don't fail a operation due to a logging failure [#23704](https://github.com/pulumi/pulumi/pull/23704)

###### Features

- [cli] Add `--skip-config-validation` flag to preview, up, refresh, and destroy to skip validation of stack config against the project config schema [#23691](https://github.com/pulumi/pulumi/pull/23691)
- [cli] Enable automatic logging for every command by default [#23731](https://github.com/pulumi/pulumi/pull/23731)

###### Bug Fixes

- [cli] Don't ignore diffs in `Output` values [#23703](https://github.com/pulumi/pulumi/pull/23703)
- [cli] Use display resource type names in policy violation output [#23705](https://github.com/pulumi/pulumi/pull/23705)

###### Improvements

- [cli] Add `--output $format` flag to `pulumi stack {list,history,tag list}` [#23686](https://github.com/pulumi/pulumi/pull/23686)
- [cli] Add --output $format to `pulumi policy list` and `pulumi policy group list` [#23698](https://github.com/pulumi/pulumi/pull/23698)
- [cli] Add --output $format to `pulumi project list` [#23699](https://github.com/pulumi/pulumi/pull/23699)
- [cli] Add `--output $format` flag to `pulumi config env list` [#23706](https://github.com/pulumi/pulumi/pull/23706)
- [cli] `pulumi login` will warn if the given login differs from PULUMI_BACKEND_URL [#23716](https://github.com/pulumi/pulumi/pull/23716)
- [cli/convert] Error when converting a Terraform program to the `hcl` language [#23742](https://github.com/pulumi/pulumi/pull/23742)
- [cli/engine] Fix TestDebuggerAttach for dlv@1.27 [#23693](https://github.com/pulumi/pulumi/pull/23693)
- [cli/plugin] Add `--output $format` to `pulumi plugin list` [#23688](https://github.com/pulumi/pulumi/pull/23688)

###### Features

- [cli/policy] Add a `--file` flag to `pulumi policy analyze` to analyze a state file (as produced by `pulumi stack export`) without requiring a stack or backend login [#23664](https://github.com/pulumi/pulumi/pull/23664)

###### Miscellaneous

- [pkg/testing] Allow ProgramTest to use npm for Node.js tests [#23675](https://github.com/pulumi/pulumi/pull/23675)

###### Bug Fixes

- [programgen] Generate numeric `range` loops in NodeJS with a per-iteration binding so deferred applies in the loop body observe the correct index

###### Improvements

- [sdk] Update the dotnet and java language runtimes [#23755](https://github.com/pulumi/pulumi/pull/23755)

###### Bug Fixes

- [sdk/go] Fix FileArchive nested in an AssetArchive producing zip/tar entries with backslashes on Windows [#23750](https://github.com/pulumi/pulumi/pull/23750)

###### Improvements

- [sdk/go] Move provider RPC setup code to the sdk module [#23695](https://github.com/pulumi/pulumi/pull/23695)
- [sdk/nodejs] Use npm as the package manager for the Node.js SDK [#23655](https://github.com/pulumi/pulumi/pull/23655)
- [sdk/nodejs] Remove the `fdir` and `picomatch` dependencies; the Node.js SDK now requires Node.js 22 or later [#23722](https://github.com/pulumi/pulumi/pull/23722)

###### Bug Fixes

- [sdk/python] Fix `deletedWith` and `replaceWith` resource options in Python component resource providers [#23710](https://github.com/pulumi/pulumi/pull/23710)
- [sdkgen/python] Cache package references per-deployment in generated SDKs [#22459](https://github.com/pulumi/pulumi/pull/22459)

### v3.248.0

- Date: 2026-06-24
- Version: v3.248.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.248.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.248.0

- **fixed** — Fix a panic in pulumi package get-schema when binding a schema that references an uninstalled plugin
- **added** — Add options to pulumi stack get for parity with bare pulumi stack
- **added** — Add --output flag to about and whoami commands
- **added** — Add support for snippets, blocks of PCL kept in state to track ad-hoc resources
- **added** — Send the address of a schema loader service to resource providers as part of the provider handshake
- **added** — Send the address of a package resolver service to resource providers as part of the provider handshake
- **fixed** — Guard references to conditionally-created boolean range resources in generated Python and NodeJS programs so they type-check
- **fixed** — Generate map range resource collections as key-indexed maps in Python and NodeJS so they can be indexed by key
- **added** — Add Output.recover to catch and recover from exceptions in outputs
- **fixed** — Fix extra trailing new lines in comments
- **changed** — Require callers to pass an explicit schema loader when binding PCL programs and package schemas

##### 3.248.0 (2026-06-24)

###### Bug Fixes

- [cli] Fix a panic in `pulumi package get-schema` when binding a schema that references an uninstalled plugin [#23647](https://github.com/pulumi/pulumi/pull/23647)

###### Improvements

- [cli] Add options to `pulumi stack get` for parity with bare `pulumi stack` [#23623](https://github.com/pulumi/pulumi/pull/23623)
- [cli] Add `--output` flag to about and whoami commands [#23651](https://github.com/pulumi/pulumi/pull/23651)

###### Features

- [engine] Add support for 'snippets', blocks of PCL kept in state to track ad-hoc resources [#23286](https://github.com/pulumi/pulumi/pull/23286)
- [engine] Send the address of a schema loader service to resource providers as part of the provider handshake [#23645](https://github.com/pulumi/pulumi/pull/23645)
- [engine] Send the address of a package resolver service to resource providers as part of the provider handshake [#23654](https://github.com/pulumi/pulumi/pull/23654)

###### Bug Fixes

- [programgen] Guard references to conditionally-created (boolean `range`) resources in generated Python and NodeJS programs so they type-check [#23634](https://github.com/pulumi/pulumi/pull/23634)
- [programgen] Generate map `range` resource collections as key-indexed maps in Python and NodeJS so they can be indexed by key [#23639](https://github.com/pulumi/pulumi/pull/23639)

###### Features

- [sdk/nodejs] Add `Output.recover` to catch and recover from exceptions in outputs [#23642](https://github.com/pulumi/pulumi/pull/23642)

###### Bug Fixes

- [sdkgen] Fix extra trailing new lines in comments [#23619](https://github.com/pulumi/pulumi/pull/23619)

###### Improvements

- [sdkgen] Require callers to pass an explicit schema loader when binding PCL programs and package schemas [#23672](https://github.com/pulumi/pulumi/pull/23672)

### v3.247.0

- Date: 2026-06-18
- Version: v3.247.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.247.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.247.0

- **added** — Add --raw flag to pulumi config set to avoid stripping newlines when input is piped through stdin
- **added** — Add --provider flag to pulumi do to pull provider config to use from existing provider state
- **added** — Resource providers now receive the active login's API address and access token through PULUMI_API and PULUMI_ACCESS_TOKEN environment variables
- **added** — Add --disable-integrations flag to pulumi neo that runs the task with no integration credentials
- **added** — Send the address of a mapper service to resource providers as part of the provider handshake
- **added** — Support functions with multiArgumentInputs in Go program generation
- **added** — Support functions with multiArgumentInputs in Python program generation
- **added** — Registered resources can now be retrieved from the mock monitor for test assertions in Node.js SDK
- **added** — Add Output.recover to Python SDK to catch and recover from exceptions in outputs
- **added** — Add support for language agnostic cross references in schemas using the form {{% ref <target> %}}
- **added** — Add extension parameterization to the package schema model
- **added** — When credentials.json carries an OAuth refresh token, the CLI now auto-refreshes the access token on 401 and retries the request once instead of returning a login required error
- **changed** — Respect PULUMI_SKIP_CONFIRMATIONS whenever asking for confirmation
- **changed** — Use list and remove as the canonical names for list and remove commands, with ls and rm as aliases
- **changed** — Serve raw schema bytes from the engine's schema loader service instead of binding and re-marshaling the full schema on every request
- **changed** — The plugin.Host interface in Go SDK is now stateless with respect to workspaces; host methods that boot or resolve plugins take a plugin.Context carrying the workspace state
- **changed** — Allow running the postinstall script for local SDKs under npm 12 in Node.js SDK
- **changed** — Add register_package helper to Python SDK to cache package references per deployment
- **fixed** — Ensure pulumi logout clears the current tokenless backend in coding agent environments
- **fixed** — Read Git metadata correctly in repositories that enable the worktreeConfig extension, such as those hosted on Azure DevOps

##### 3.247.0 (2026-06-18)

###### Features

- [cli/config] Add --raw flag to `pulumi config set` to avoid stripping newlines when input is piped through stdin [#23593](https://github.com/pulumi/pulumi/pull/23593)
- [cli/do] Add `--provider` flag to pull provider config to use from existing provider state [#23560](https://github.com/pulumi/pulumi/pull/23560)
- [cli/engine] Resource providers now receive the active login's API address and access token through PULUMI_API and PULUMI_ACCESS_TOKEN [#23589](https://github.com/pulumi/pulumi/pull/23589)
- [cli/neo] Add a `--disable-integrations` flag to `pulumi neo` that runs the task with no integration credentials [#23531](https://github.com/pulumi/pulumi/pull/23531)
- [engine] Send the address of a mapper service to resource providers as part of the provider handshake
- [programgen/go] Support functions with multiArgumentInputs [#23554](https://github.com/pulumi/pulumi/pull/23554)
- [programgen/python] Support functions with multiArgumentInputs [#23574](https://github.com/pulumi/pulumi/pull/23574)
- [sdk/nodejs] Registered resources can now be retrieved from the mock monitor for test assertions [#20539](https://github.com/pulumi/pulumi/pull/20539)
- [sdk/python] Add `Output.recover` to catch and recover from exceptions in outputs [#23591](https://github.com/pulumi/pulumi/pull/23591)
- [sdkgen] Adds support for language agnostic cross references in schemas. Use the form `{{% ref <target> %}}` to reference other schema components in markdown descriptions. Such as `{{% ref [#21369](https://github.com/pulumi/pulumi/pull/21369)
- [sdkgen] Add extension parameterization to the package schema model [#23536](https://github.com/pulumi/pulumi/pull/23536)
- [sdkgen/go] Support functions with multiArgumentInputs [#23554](https://github.com/pulumi/pulumi/pull/23554)
- [sdkgen/python] Support functions with multiArgumentInputs [#23574](https://github.com/pulumi/pulumi/pull/23574)
- [cli/auth] When `credentials.json` carries an OAuth refresh token, the CLI now auto-refreshes the access token on 401 and retries the request once, instead of returning a "login required" error [#23430](https://github.com/pulumi/pulumi/pull/23430)

###### Improvements

- [cli] Respect PULUMI_SKIP_CONFIRMATIONS whenever we ask for confirmation [#23607](https://github.com/pulumi/pulumi/pull/23607)
- [cli] Use list and remove as the canonical names for list/remove commands, with ls and rm as aliases [#23608](https://github.com/pulumi/pulumi/pull/23608)
- [docs] Generate redirects for command aliases [#23610](https://github.com/pulumi/pulumi/pull/23610)
- [engine] Serve raw schema bytes from the engine's schema loader service instead of binding and re-marshaling the full schema on every request [#23551](https://github.com/pulumi/pulumi/pull/23551)
- [sdk/go] The `plugin.Host` interface is now stateless with respect to workspaces; host methods that boot or resolve plugins take a `plugin.Context` carrying the workspace state, and closing a `plugin.Context` no longer closes a host that was passed in to its constructor [#23508](https://github.com/pulumi/pulumi/pull/23508)
- [sdk/nodejs] Allow running the postinstall script for local SDKs under npm 12 [#23568](https://github.com/pulumi/pulumi/pull/23568)
- [sdk/python] Add register_package helper to cache package references per deployment [#22459](https://github.com/pulumi/pulumi/pull/22459)

###### Bug Fixes

- [cli] Ensure `pulumi logout` clears the current tokenless backend in coding agent environments [#23540](https://github.com/pulumi/pulumi/pull/23540)
- [cli] Read Git metadata correctly in repositories that enable the worktreeConfig extension, such as those hosted on Azure DevOps [#23535](https://github.com/pulumi/pulumi/pull/23535)
- [cli/display] Show interrupted steps as interrupted instead of as finished [#23510](https://github.com/pulumi/pulumi/pull/23510)
- [cli/plugin] Allow plugin tarballs containing symlinks [#23587](https://gi

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.247.0]_