# Pulumi changelog

> Infrastructure as code in familiar programming languages.

- Vendor: Pulumi
- Category: Infrastructure & DevOps
- License: Apache-2.0
- Language: Go
- Official site: https://www.pulumi.com
- Tracked by: What's New (https://whatsnew.fyi/product/pulumi)
- Harvested from: GitHub (pulumi/pulumi)
- Entries below: 23 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v3.269.0

- Date: 2026-10-14
- Version: v3.269.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.269.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.269.0

- **added** — Add runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack
- **added** — Negotiate OutputValues on Call so SDKs receive per-value return dependencies
- **added** — Add convert to the generated automation APIs for NodeJS, Python and Go
- **added** — Add refresh to the generated automation APIs for NodeJS, Python and Go
- **added** — Add about commands to the generated automation APIs for NodeJS, Python and Go
- **added** — Add config commands to the generated automation APIs for NodeJS, Python and Go
- **fixed** — Accept a lookup default of any type and type the result as the unification of the element type and the default
- **fixed** — Report a missing lookup default at bind time instead of failing when the program runs
- **fixed** — Accept a tuple literal that holds an output where a function or property expects the input form of a tuple, such as length([secret(x)])
- **fixed** — Fix a panic in the PCL interpreter's entries built-in on a map whose values have different shapes or on an empty map
- **fixed** — Fix pulumi policy group edit so that it adds and removes stacks, Policy Packs, and Insights accounts
- **fixed** — Stop lifting a prompt operand's type-conversion wrapper into an unnecessary apply, which produced invalid Go code
- **fixed** — Fix switching template source when prefixes match
- **security** — Redact secrets carried on output values in plaintext log output and in pulumi logs share
- **fixed** — Fix template fetching when changing branches
- **fixed** — Log in through the browser on pulumi login in agent mode instead of creating a new agent account
- **fixed** — Remove redundant ToIDOutput().ToStringOutput() conversions when passing resource IDs to string inputs
- **fixed** — Type object literals of outputs as pulumi.StringMap and friends so they compile and export without a cast
- **fixed** — Honor optional refresh settings in agent previews without persisting refreshed state
- **fixed** — Stop finished download and unpack progress bars from reappearing below later output, such as the pulumi new success message
- **fixed** — Fix Output.recover failing to catch faults that arrive through apply or after the program body has returned
- **fixed** — Recover from failed function calls with recover in the PCL interpreter
- **fixed** — Check assignability of recursive types, such as a schema object that nests itself, without overflowing the stack
- **fixed** — Fix Equals on recursive object types that differ under a cycle
- **changed** — Run OPA policy packs through the pulumi-language-opa language plugin, which the CLI downloads on demand, and stop falling back to a pulumi-analyzer-policy-<runtime> plugin for policy packs whose runtime has no language plugin
- **changed** — Mark npm as the recommended package manager when prompting in pulumi new
- **changed** — Make IDInput and URNInput satisfy StringInput, and AssetInput and ArchiveInput satisfy AssetOrArchiveInput
- **changed** — Skip the package manager prompt for new Node.js projects when only one package manager is installed
- **changed** — Use pip without prompting for a toolchain in pulumi new when neither Poetry nor uv is installed
- **deprecated** — Make pulumi logs error by default before its removal
- **deprecated** — Make pulumi watch error by default before its removal

##### 3.269.0 (2026-10-14)

###### Features

- [sdk] Add runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack [#24808](https://github.com/pulumi/pulumi/pull/24808)
- [engine] Negotiate OutputValues on Call so SDKs receive per-value return dependencies [#25017](https://github.com/pulumi/pulumi/pull/25017)
- [auto] Add `convert` to the generated automation APIs for NodeJS, Python and Go [#25050](https://github.com/pulumi/pulumi/pull/25050)
- [auto] Add `refresh` to the generated automation APIs for NodeJS, Python and Go [#25052](https://github.com/pulumi/pulumi/pull/25052)
- [auto] Add `about` commands to the generated automation APIs for NodeJS, Python and Go [#25066](https://github.com/pulumi/pulumi/pull/25066)
- [auto] Add `config` commands to the generated automation APIs for NodeJS, Python and Go [#25072](https://github.com/pulumi/pulumi/pull/25072)

###### Bug Fixes

- [pcl] Accept a `lookup` default of any type and type the result as the unification of the element type and the default [#24771](https://github.com/pulumi/pulumi/pull/24771)
- [pcl] Report a missing `lookup` default at bind time instead of failing when the program runs [#24772](https://github.com/pulumi/pulumi/pull/24772)
- [pcl] Accept a tuple literal that holds an output where a function or property expects the input form of a tuple, such as `length([secret(x)])` [#24782](https://github.com/pulumi/pulumi/pull/24782)
- [pcl] Fix a panic in the PCL interpreter's `entries` built-in on a map whose values have different shapes or on an empty map [#24783](https://github.com/pulumi/pulumi/pull/24783)
- [cli/policy] Fix `pulumi policy group edit` so that it adds and removes stacks, Policy Packs, and Insights accounts [#24996](https://github.com/pulumi/pulumi/pull/24996)
- [pcl] Stop lifting a prompt operand's type-conversion wrapper into an unnecessary apply, which produced invalid Go code [#25021](https://github.com/pulumi/pulumi/pull/25021)
- [cli/new] Fix switching template source when prefixes match [#25087](https://github.com/pulumi/pulumi/pull/25087)
- [cli] Redact secrets carried on output values in plaintext log output and in `pulumi logs share` [#25092](https://github.com/pulumi/pulumi/pull/25092)
- [cli/new] Fix template fetching when changing branches [#25088](https://github.com/pulumi/pulumi/pull/25088)
- [cli] Log in through the browser on `pulumi login` in agent mode instead of creating a new agent account [#25107](https://github.com/pulumi/pulumi/pull/25107)
- [programgen/go] Remove redundant `ToIDOutput().ToStringOutput()` conversions when passing resource IDs to string inputs [#25101](https://github.com/pulumi/pulumi/pull/25101)
- [programgen/go] Type object literals of outputs as `pulumi.StringMap` and friends so they compile and export without a cast [#25108](https://github.com/pulumi/pulumi/pull/25108)
- [cli/neo] Honor optional refresh settings in agent previews without persisting refreshed state [#25117](https://github.com/pulumi/pulumi/pull/25117)
- [cli] Stop finished download and unpack progress bars from reappearing below later output, such as the `pulumi new` success message [#25150](https://github.com/pulumi/pulumi/pull/25150)
- [sdk/python] Fix `Output.recover` failing to catch faults that arrive through `apply` or after the program body has returned [#25164](https://github.com/pulumi/pulumi/pull/25164)
- [pcl] Recover from failed function calls with `recover` in the PCL interpreter [#25167](https://github.com/pulumi/pulumi/pull/25167)
- [pcl] Check assignability of recursive types, such as a schema object that nests itself, without overflowing the stack [#25176](https://github.com/pulumi/pulumi/pull/25176)
- [pcl] Fix `Equals` on recursive object types that differ under a cycle [#25177](https://github.com/pulumi/pulumi/pull/25177)

###### Improvements

- [cli/policy] Run OPA policy packs through the `pulumi-language

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.269.0]_

### v3.268.0

- Date: 2026-10-07
- Version: v3.268.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.268.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.268.0

- **added** — Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, gated by a new accepts_outputs_in_invoke handshake capability
- **added** — Add version to the generated automation APIs for NodeJS, Python and Go
- **added** — Add whoami to the generated automation APIs for NodeJS, Python and Go
- **added** — Add install to the generated automation APIs for NodeJS, Python and Go
- **fixed** — Restore elided asset contents from prior state when a provider echoes assets back from refresh or update
- **fixed** — Apply resource transforms declared on an ancestor component to resources parented under a resource read
- **fixed** — Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time
- **fixed** — Link @pulumi/pulumi types in generated docs to their TypeDoc pages instead of missing anchors
- **fixed** — Fix snapshot integrity error when untargeted steps change dependencies in the program
- **fixed** — Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state
- **fixed** — Download plugins from Git repositories whose version tags have no v prefix
- **fixed** — Fix a language host process leak when the schema loader boots a plugin that runs in a language host
- **fixed** — Reject schemas that define a resource named provider in the root module through moduleFormat, instead of panicking during SDK generation
- **fixed** — Shut down plugins in parallel to avoid timeouts
- **fixed** — Fix plugin checksum verification rejecting valid downloads over HTTP/1.1 and ignoring data at the end of the archive
- **fixed** — Fix spurious provider exited prematurely error from the pulumi new credentials check, which no longer has a timeout
- **fixed** — Fix project settings in projects that live in symlinked directories
- **changed** — Send the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set

##### 3.268.0 (2026-10-07)

###### Features

- [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in `args` and receive them in the response, and providers can process them, gated by a new `accepts_outputs_in_invoke` handshake capability [#24953](https://github.com/pulumi/pulumi/pull/24953)
- [auto] Add `version` to the generated automation APIs for NodeJS, Python and Go [#24990](https://github.com/pulumi/pulumi/pull/24990)
- [auto] Add `whoami` to the generated automation APIs for NodeJS, Python and Go [#25024](https://github.com/pulumi/pulumi/pull/25024)
- [auto] Add `install` to the generated automation APIs for NodeJS, Python and Go [#25038](https://github.com/pulumi/pulumi/pull/25038)

###### Bug Fixes

- [engine] Restore elided asset contents from prior state when a provider echoes assets back from refresh or update [#24570](https://github.com/pulumi/pulumi/pull/24570)
- [engine] Apply resource transforms declared on an ancestor component to resources parented under a resource read [#24689](https://github.com/pulumi/pulumi/pull/24689)
- [pcl] Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time [#24805](https://github.com/pulumi/pulumi/pull/24805)
- [sdkgen/nodejs] Link `@pulumi/pulumi` types in generated docs to their TypeDoc pages instead of missing anchors [#24928](https://github.com/pulumi/pulumi/pull/24928)
- [engine] Fix snapshot integrity error when untargeted steps change dependencies in the program [#24801](https://github.com/pulumi/pulumi/pull/24801)
- [sdk/nodejs] Dynamic providers now fall back to the `inputs` field of a `Read` request when `properties` is empty, so `Get` continues to work after the engine stops duplicating inputs into state [#24977](https://github.com/pulumi/pulumi/pull/24977)
- [sdk/python] Dynamic providers now fall back to the `inputs` field of a `Read` request when `properties` is empty, so `Get` continues to work after the engine stops duplicating inputs into state [#24977](https://github.com/pulumi/pulumi/pull/24977)
- [cli/package] Download plugins from Git repositories whose version tags have no `v` prefix [#24986](https://github.com/pulumi/pulumi/pull/24986)
- [engine] Fix a language host process leak when the schema loader boots a plugin that runs in a language host [#25002](https://github.com/pulumi/pulumi/pull/25002)
- [sdkgen] Reject schemas that define a resource named `provider` in the root module through `moduleFormat`, instead of panicking during SDK generation [#25020](https://github.com/pulumi/pulumi/pull/25020)
- [engine] Shut down plugins in parallel to avoid timeouts [#25026](https://github.com/pulumi/pulumi/pull/25026)
- [cli/plugin] Fix plugin checksum verification rejecting valid downloads over HTTP/1.1 and ignoring data at the end of the archive [#25032](https://github.com/pulumi/pulumi/pull/25032)
- [cli/new] Fix spurious provider "exited prematurely" error from the `pulumi new` credentials check, which no longer has a timeout [#25030](https://github.com/pulumi/pulumi/pull/25030)
- [auto] Fix project settings in projects that live in symlinked directories [#25046](https://github.com/pulumi/pulumi/pull/25046)

###### Improvements

- [backend/service] Send the W3C `traceparent` header on Pulumi Cloud API calls when `--otel-traces` is set [#25009](https://github.com/pulumi/pulumi/pull/25009)

###### Miscellaneous

- [java] Upgrade java to v1.37.4 [#25027](https://github.com/pulumi/pulumi/pull/25027)
- [yaml] Upgrade yaml to v1.38.9 [#25027](https://github.com/pulumi/pulumi/pull/25027)
- [hcl] Upgrade hcl to v0.18.4 [#25027](https://github.com/pulumi/pulumi/pull/25027)
- [sdk/dotnet] Upgrade dotnet to v3.114.2 [#25034](https://github.com/pulumi/pulumi/pull/25034)

### v3.267.0

- Date: 2026-10-01
- Version: v3.267.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.267.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.267.0

- **fixed** — Fix concurrent pulumi new runs failing to clone the templates repository
- **fixed** — Fix pulumi install for Python plugins and policy packs that use the uv toolchain and a [build-system] table

##### 3.267.0 (2026-10-01)

###### Bug Fixes

- [cli/new] Fix concurrent `pulumi new` runs failing to clone the templates repository [#24939](https://github.com/pulumi/pulumi/pull/24939)
- [sdk/python] Fix `pulumi install` for Python plugins and policy packs that use the uv toolchain and a `[build-system]` table [#24951](https://github.com/pulumi/pulumi/pull/24951)

### v3.266.0

- Date: 2026-09-30
- Version: v3.266.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.266.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.266.0

- **fixed** — Use an explicit provider for resources from an extension package in Go SDK, instead of falling back to a default provider
- **fixed** — Use an explicit provider for resources from an extension package in Python SDK, instead of falling back to a default provider
- **fixed** — Order the members of a union type by a fixed structural order rather than by their printed form, so that a recursive object type prints all of its properties and diagnostics list union members consistently
- **fixed** — Avoid printing the provider docs link twice in the pulumi new credentials warning
- **changed** — Report the console URL and update identifiers in pulumi neo pulumi_preview/pulumi_up tool results
- **added** — Support #/provider doc references in schema descriptions
- **removed** — Remove workspace.Credentials.AccessTokens and read stored logins only from the accounts object of credentials.json

##### 3.266.0 (2026-09-30)

###### Bug Fixes

- [sdk/go] Use an explicit provider for resources from an extension package, instead of falling back to a default provider [#24702](https://github.com/pulumi/pulumi/pull/24702)
- [sdk/python] Use an explicit provider for resources from an extension package, instead of falling back to a default provider [#24702](https://github.com/pulumi/pulumi/pull/24702)
- [pcl] Order the members of a union type by a fixed structural order rather than by their printed form, so that a recursive object type prints all of its properties and diagnostics list union members consistently [#24804](https://github.com/pulumi/pulumi/pull/24804)
- [cli/new] Avoid printing the provider docs link twice in the `pulumi new` credentials warning [#24925](https://github.com/pulumi/pulumi/pull/24925)

###### Improvements

- [cli/neo] Report the console URL and update identifiers in `pulumi neo` pulumi_preview/pulumi_up tool results [#24721](https://github.com/pulumi/pulumi/pull/24721)
- [sdkgen] Support `#/provider` doc references in schema descriptions [#24918](https://github.com/pulumi/pulumi/pull/24918)

###### Miscellaneous

- [sdk/go] Remove `workspace.Credentials.AccessTokens` and read stored logins only from the `accounts` object of `credentials.json` [#24922](https://github.com/pulumi/pulumi/pull/24922)
- [sdk/dotnet] Upgrade dotnet to v3.114.1 [#24926](https://github.com/pulumi/pulumi/pull/24926)
- [java] Upgrade java to v1.37.3 [#24926](https://github.com/pulumi/pulumi/pull/24926)
- [yaml] Upgrade yaml to v1.38.8 [#24926](https://github.com/pulumi/pulumi/pull/24926)
- [hcl] Upgrade hcl to v0.18.3 [#24926](https://github.com/pulumi/pulumi/pull/24926)

### v3.265.0

- Date: 2026-09-25
- Version: v3.265.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.265.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.265.0

- **added** — Add `pulumi logout --all --delete-credentials-key` to delete the key that encrypts stored credentials from the OS credential store
- **fixed** — Generate valid Python for output-dependent resource ranges
- **fixed** — Recover from partial installs and wait for parallel installs
- **fixed** — Cancel cross-process waits with Ctrl-C
- **fixed** — Report Unknown=true on the ReadResourceResponse when a Read is skipped because one of its dependencies failed during a --continue-on-error update
- **fixed** — Keep encrypted credentials in other PULUMI_HOME directories readable after `pulumi logout --all` or `pulumi login` in one of them
- **fixed** — Report Unknown=true on the register response when an Import step is skipped because one of its dependencies failed during a --continue-on-error update
- **fixed** — Fix generated Node.js SDK compilation for self-referencing resource inputs
- **fixed** — Fix a panic when a PCL program indexes a tuple literal with an index equal to its length
- **fixed** — Fix a binder panic on nested tuple literals of different shapes, and unify collection literals that hold different constants into one collection type
- **fixed** — Fix the `length` built-in in the PCL interpreter to accept objects and maps
- **fixed** — Add the `range` built-in to the PCL interpreter
- **fixed** — Type `min` and `max` as number when any argument is a non-integer literal
- **fixed** — Report an error when a number or bool literal is assigned to a property whose schema constant or enum does not admit it
- **fixed** — Report a type mismatch on a resource input property that the resource does not also declare as an output
- **fixed** — Allow a resource to be assigned to a plain property typed as a reference to its resource type
- **fixed** — Type a quoted string with no interpolation as a constant so string constants and string enums are validated at bind time
- **fixed** — Fix `length` on output values in generated programs, and count the keys of maps and objects in generated Node.js programs
- **fixed** — Fix policy analyzer config schema serialization for Go analyzers
- **fixed** — Fill the lists that `range` produces in Node.js programs

##### 3.265.0 (2026-09-25)

###### Features

- [cli/auth] Add `pulumi logout --all --delete-credentials-key` to delete the key that encrypts stored credentials from the OS credential store [#24764](https://github.com/pulumi/pulumi/pull/24764)

###### Bug Fixes

- [programgen/python] Generate valid Python for output-dependent resource ranges [#24474](https://github.com/pulumi/pulumi/pull/24474)
- [cli/policy] Recover from partial installs & wait for parallel installs [#24705](https://github.com/pulumi/pulumi/pull/24705)
- [cli/install] Cancel cross-process waits with Ctrl-C [#24711](https://github.com/pulumi/pulumi/pull/24711)
- [engine] Report `Unknown=true` on the `ReadResourceResponse` when a Read is skipped because one of its dependencies failed during a `--continue-on-error` update, so SDKs can propagate unknowns to dependents rather than treating empty outputs as real [#24747](https://github.com/pulumi/pulumi/pull/24747)
- [cli/auth] Keep encrypted credentials in other `PULUMI_HOME` directories readable after `pulumi logout --all` or `pulumi login` in one of them [#24764](https://github.com/pulumi/pulumi/pull/24764)
- [engine] Report `Unknown=true` on the register response when an Import step is skipped because one of its dependencies failed during a `--continue-on-error` update, so SDKs propagate unknowns to dependents rather than treating empty outputs as real [#24774](https://github.com/pulumi/pulumi/pull/24774)
- [sdkgen/nodejs] Fix generated Node.js SDK compilation for self-referencing resource inputs [#24752](https://github.com/pulumi/pulumi/pull/24752)
- [pcl] Fix a panic when a PCL program indexes a tuple literal with an index equal to its length [#24755](https://github.com/pulumi/pulumi/pull/24755)
- [pcl] Fix a binder panic on nested tuple literals of different shapes, and unify collection literals that hold different constants into one collection type so they can be iterated [#24756](https://github.com/pulumi/pulumi/pull/24756)
- [pcl] Fix the `length` built-in in the PCL interpreter to accept objects and maps [#24757](https://github.com/pulumi/pulumi/pull/24757)
- [pcl] Add the `range` built-in to the PCL interpreter [#24758](https://github.com/pulumi/pulumi/pull/24758)
- [pcl] Type `min` and `max` as number when any argument is a non-integer literal [#24759](https://github.com/pulumi/pulumi/pull/24759)
- [pcl] Report an error when a number or bool literal is assigned to a property whose schema constant or enum does not admit it [#24761](https://github.com/pulumi/pulumi/pull/24761)
- [pcl] Report a type mismatch on a resource input property that the resource does not also declare as an output [#24765](https://github.com/pulumi/pulumi/pull/24765)
- [pcl] Allow a resource to be assigned to a plain property typed as a reference to its resource type [#24763](https://github.com/pulumi/pulumi/pull/24763)
- [pcl] Type a quoted string with no interpolation as a constant so string constants and string enums are validated at bind time [#24766](https://github.com/pulumi/pulumi/pull/24766)
- [programgen] Fix `length` on output values in generated programs, and count the keys of maps and objects in generated Node.js programs [#24757](https://github.com/pulumi/pulumi/pull/24757)
- [sdk/go] Fix policy analyzer config schema serialization for Go analyzers [#24775](https://github.com/pulumi/pulumi/pull/24775)
- [programgen] Fill the lists that `range` produces in Node.js programs [#24758](https://github.com/pulumi/pulumi/pull/24758)
- [pcl] Fix PCL type conversion checks whose result depended on whether the same types had been unified first [#24793](https://github.com/pulumi/pulumi/pull/24793)
- [sdk/nodejs] Fix closure serialization for `__importStar`-wrapped cached modules [#24797](https://github.com/pulumi/pulumi/pull/24797)

###### Improvements

- [pcl] Name the constant or the enum members a resource property admits when a literal does not match it [#24770](https://github.com/pulumi/pulumi/

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.265.0]_

### v3.264.0

- Date: 2026-09-23
- Version: v3.264.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.264.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.264.0

- **added** — Add component state migration callbacks to ResourceOptions for Python SDK
- **added** — Add component state migration callbacks to ResourceOptions for Go SDK
- **added** — Add component state migration callbacks to ResourceOptions for Node.js SDK
- **added** — Allow `pulumi deployment settings edit` to configure git authentication, dependency caching, template sources and drift remediation
- **added** — Allow `pulumi deployment settings edit` to configure tag triggers, review stack labels and the version control integration
- **added** — Enable component state migrations for Pulumi Cloud updates using journal v2
- **fixed** — Discover plugins from the current uv workspace member's dependencies in Python SDK
- **fixed** — Suppress the Neo diagnostic help prompt for informational messages
- **fixed** — Run the `pulumi new` credentials preflight for parameterized providers
- **fixed** — Reference `pulumi env` rather than the retired standalone `esc` CLI in `pulumi env` messages and help text
- **fixed** — Allow `pulumi deployment settings edit` to move a stack configured against a repository URL onto a version control integration
- **fixed** — Stop `pulumi deployment settings get` padding its output for labels it does not print
- **fixed** — Serialize ESC boolean schemas as their equivalent object forms instead of bare JSON booleans in Go SDK
- **fixed** — Run Go policy remediations only at the `remediate` enforcement level
- **fixed** — Avoid trying to delete resources `PendingReplacement`
- **fixed** — Fix path handling with absolute paths in DIY backend
- **fixed** — Interpret documentation references on lazily-loaded packages after they are fully bound
- **fixed** — Update the partially created resource instead of creating another one when an `OnError` hook retries a create
- **fixed** — Preserve root-first state ordering between chained state migration callbacks
- **fixed** — Propagate the `dependsOn` resource option on `ReadResource` calls in Go SDK and `read` blocks in PCL
- **changed** — Remove `policyx.ResourceValidationArgs.DryRun` from Go SDK as it was never correctly set
- **changed** — Report planned and applied state migrations through user-facing diagnostics

##### 3.264.0 (2026-09-23)

###### Features

- [sdk/python] Add component state migration callbacks to ResourceOptions [#24331](https://github.com/pulumi/pulumi/pull/24331)
- [cli/deployment] Allow `pulumi deployment settings edit` to configure git authentication, dependency caching, template sources and drift remediation [#24528](https://github.com/pulumi/pulumi/pull/24528)
- [cli/deployment] Allow `pulumi deployment settings edit` to configure tag triggers, review stack labels and the version control integration [#24527](https://github.com/pulumi/pulumi/pull/24527)
- [backend/service] Enable component state migrations for Pulumi Cloud updates using journal v2 [#24458](https://github.com/pulumi/pulumi/pull/24458)
- [sdk/go] Add component state migration callbacks to resource options [#24519](https://github.com/pulumi/pulumi/pull/24519)
- [sdk/nodejs] Add component state migration callbacks to resource options [#24715](https://github.com/pulumi/pulumi/pull/24715)

###### Bug Fixes

- [sdk/python] Discover plugins from the current uv workspace member’s dependencies [#24706](https://github.com/pulumi/pulumi/pull/24706)
- [cli] Suppress the Neo diagnostic help prompt for informational messages [#24743](https://github.com/pulumi/pulumi/pull/24743)
- [cli] Run the `pulumi new` credentials preflight for parameterized providers [#24669](https://github.com/pulumi/pulumi/pull/24669)
- [cli/env] Reference `pulumi env` rather than the retired standalone `esc` CLI in `pulumi env` messages and help text [#24699](https://github.com/pulumi/pulumi/pull/24699)
- [cli/deployment] Allow `pulumi deployment settings edit` to move a stack configured against a repository URL onto a version control integration [#24529](https://github.com/pulumi/pulumi/pull/24529)
- [cli/deployment] Stop `pulumi deployment settings get` padding its output for labels it does not print [#24448](https://github.com/pulumi/pulumi/pull/24448)
- [sdk/go] Serialize ESC boolean schemas as their equivalent object forms (`{}` for "always", `{"not":{}}` for "never") instead of bare JSON booleans, so schema-carrying payloads are valid instances of the OpenAPI models that describe them [#24613](https://github.com/pulumi/pulumi/pull/24613)
- [sdk/go] Run Go policy remediations only at the `remediate` enforcement level [#24647](https://github.com/pulumi/pulumi/pull/24647)
- [engine] Avoid trying to delete resources `PendingReplacement` [#24588](https://github.com/pulumi/pulumi/pull/24588)
- [backend/diy] Fix path handling with absolute paths [#24628](https://github.com/pulumi/pulumi/pull/24628)
- [pkg] Interpret documentation references on lazily-loaded packages after they are fully bound, and resolve references to members that have not been loaded yet [#24682](https://github.com/pulumi/pulumi/pull/24682)
- [engine] Update the partially created resource instead of creating another one when an `OnError` hook retries a create [#24684](https://github.com/pulumi/pulumi/pull/24684)
- [engine] Preserve root-first state ordering between chained state migration callbacks [#24695](https://github.com/pulumi/pulumi/pull/24695)
- [sdk/go] Propagate the `dependsOn` resource option on `ReadResource` calls [#24725](https://github.com/pulumi/pulumi/pull/24725)
- [pcl] Propagate the `dependsOn` resource option on `read` blocks [#24725](https://github.com/pulumi/pulumi/pull/24725)
- [cli/neo] Skip the redundant preview step when `pulumi neo` runs the `pulumi_up` tool [#24719](https://github.com/pulumi/pulumi/pull/24719)
- [sdkgen/go] Set the default plugin version when the schema sets a Go language option [#24733](https://github.com/pulumi/pulumi/pull/24733)
- [cli/package] Stop leaking package processes from `pulumi package get-schema` [#24741](https://github.com/pulumi/pulumi/pull/24741)
- [cli] Remove the prompt to create a first project after an interactive login [#24742](https://github.com/pulumi/pulumi/pull/24742)
- [engine] When a Read is skipped because one of i

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.264.0]_

### v3.263.0

- Date: 2026-09-16
- Version: v3.263.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.263.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.263.0

- **fixed** — Stop `pulumi deployment settings edit` overwriting the source of stacks that use a provider other than GitHub
- **fixed** — Take `--path-filter` once per filter rather than splitting it on commas in deployment settings
- **fixed** — Report an unconfigured stack from `get` instead of failing
- **fixed** — Fix remote component provider state migrations being skipped when the caller also supplies migrations
- **fixed** — Forward caller error hooks to remote component providers
- **fixed** — Error sooner if string values can't be cast to numeric or boolean inputs in `pulumi do`
- **fixed** — Restore pr#<number> based downloads
- **fixed** — Fix a panic in the pnpm package manager when `pnpm config get allowBuilds` prints `null`
- **changed** — Document automatic plugin installation and list the valid KIND values in `pulumi plugin install --help`
- **changed** — Describe what `pulumi plugin ls` does and does not list in its help text
- **changed** — Reframe `pulumi plugin` help around automatic plugin installation and link the plugin-authoring docs
- **changed** — Protect resources retained by `pulumi state promote` so a subsequent update cannot delete them before the generated code is added to the program
- **changed** — Prompt for the ESC project and environment names in `pulumi env setup`, ask how to authenticate before choosing an access level, and print a success message when setup completes
- **changed** — Upgrade java to v1.37.1
- **changed** — Upgrade hcl to v0.18.0
- **changed** — Upgrade yaml to v1.38.6
- **changed** — Upgrade dotnet to v3.113.3

##### 3.263.0 (2026-09-15)

###### Bug Fixes

- [cli/deployment] Stop `pulumi deployment settings edit` overwriting the source of stacks that use a provider other than GitHub, take `--path-filter` once per filter rather than splitting it on commas, and report an unconfigured stack from `get` instead of failing [#24526](https://github.com/pulumi/pulumi/pull/24526)
- [engine] Fix remote component provider state migrations being skipped when the caller also supplies migrations [#24620](https://github.com/pulumi/pulumi/pull/24620)
- [engine] Forward caller error hooks to remote component providers [#24622](https://github.com/pulumi/pulumi/pull/24622)
- [cli/do] Error sooner if string values can't be cast to numeric/boolean inputs [#24643](https://github.com/pulumi/pulumi/pull/24643)
- [build] Restore pr#<number> based downloads [#24649](https://github.com/pulumi/pulumi/pull/24649)
- [sdk/nodejs] Fix a panic in the pnpm package manager when `pnpm config get allowBuilds` prints `null` [#24674](https://github.com/pulumi/pulumi/pull/24674)

###### Improvements

- [cli] Document automatic plugin installation and list the valid KIND values in `pulumi plugin install --help` [#24630](https://github.com/pulumi/pulumi/pull/24630)
- [cli/plugin] Describe what `pulumi plugin ls` does and does not list in its help text [#24631](https://github.com/pulumi/pulumi/pull/24631)
- [cli] Reframe `pulumi plugin` help around automatic plugin installation and link the plugin-authoring docs [#24632](https://github.com/pulumi/pulumi/pull/24632)
- [cli] Protect resources retained by `pulumi state promote` so a subsequent update cannot delete them before the generated code is added to the program [#24640](https://github.com/pulumi/pulumi/pull/24640)
- [cli/env] Prompt for the ESC project and environment names in `pulumi env setup`, ask how to authenticate before choosing an access level, and print a success message when setup completes [#24662](https://github.com/pulumi/pulumi/pull/24662)

###### Miscellaneous

- [java] Upgrade java to v1.37.1 [#24659](https://github.com/pulumi/pulumi/pull/24659)
- [hcl] Upgrade hcl to v0.18.0 [#24659](https://github.com/pulumi/pulumi/pull/24659)
- [yaml] Upgrade yaml to v1.38.6 [#24661](https://github.com/pulumi/pulumi/pull/24661)
- [sdk/dotnet] Upgrade dotnet to v3.113.3 [#24672](https://github.com/pulumi/pulumi/pull/24672)

### v3.262.0

- Date: 2026-09-10
- Version: v3.262.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.262.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.262.0

- **added** — Support importing a pulumi:index:Stash resource that adopts the given id and holds a null value, with the program's configured input applying as an update
- **fixed** — Match wrapped errors in the Automation API error predicates and unwrap the underlying cause
- **fixed** — Stop pulumi deployment settings edit clearing settings it was not asked to change, let --branch and --commit replace one another rather than be combined, and reject --oidc-*-clear=false instead of ignoring it
- **fixed** — Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever
- **fixed** — Verify TLS certificates when downloading a template from a URL outside the configured service
- **fixed** — Propagate --target-dependents and --exclude-dependents through resources read with .get()
- **fixed** — Run state migrations for aliased remote components
- **fixed** — Sort resources deterministically when repairing a snapshot
- **fixed** — Fix state migration ordering for components interleaved with other resources
- **fixed** — Allow Automation API project settings to use any language runtime
- **fixed** — Redact secret property values in violates plan error messages unless --show-secrets is passed
- **fixed** — Treat a resource provider attached through PULUMI_DEBUG_PROVIDERS as installed, so package installation does not try to download it
- **fixed** — Install the packages a local plugin directory requires before the plugin is installed and run
- **fixed** — Avoid a deadlock when a resource provider asks the engine to load another plugin while it boots
- **fixed** — Allow component state migrations to split managed state using compatible existing resource identities
- **fixed** — Allow outputs and prompt values to be marshalled into fields typed as input interfaces, such as pulumi.StringInput
- **fixed** — Make sure disableSSL doesn't override explicitly specified protocols
- **fixed** — Fix pulumi install for a project that requires a resource provider attached through PULUMI_DEBUG_PROVIDERS
- **fixed** — Resolve a project's relative plugin and package paths against the project directory when a plugin starts from a subdirectory of the project
- **fixed** — Report the source position of the user code that calls a generated resource getter instead of the getter body
- **fixed** — Normalize successor references between chained component state migration callbacks
- **fixed** — Error out on ambiguous template names instead of failing silently
- **changed** — Add --filter to pulumi api list to filter endpoints by keyword
- **changed** — Warn in interactive pulumi new when cloud credentials are missing or invalid for providers that opt in via the new validateCredentialsOnNew and configurationDocsUrl schema fields
- **added** — Add helper methods to transform ResourceOptions to InvokeOptions in the Node.js SDK
- **changed** — Read stack outputs for stack references through the Pulumi Cloud stack outputs endpoint when the service advertises it, instead of exporting the whole deployment
- **changed** — Replace parver with packaging in generated Python SDKs
- **changed** — Run provider configuration as part of provider create steps so errors are returned associated with the provider resource, not the first resource that uses it
- **changed** — Improve error messages if default org is invalid

##### 3.262.0 (2026-09-10)

###### Features

- [engine] Support importing a `pulumi:index:Stash` resource. The stash adopts the given id and holds a null value, and the program's configured input then applies as an update [#24544](https://github.com/pulumi/pulumi/pull/24544)

###### Bug Fixes

- [auto/go] Match wrapped errors in the Automation API error predicates, and unwrap the underlying cause [#24197](https://github.com/pulumi/pulumi/pull/24197)
- [cli/deployment] Stop `pulumi deployment settings edit` clearing settings it was not asked to change, let `--branch` and `--commit` replace one another rather than be combined, and reject `--oidc-*-clear=false` instead of ignoring it [#24525](https://github.com/pulumi/pulumi/pull/24525)
- [cli] Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever [#24495](https://github.com/pulumi/pulumi/pull/24495)
- [cli] Verify TLS certificates when downloading a template from a URL outside the configured service [#24504](https://github.com/pulumi/pulumi/pull/24504)
- [engine] Propagate --target-dependents and --exclude-dependents through resources read with .get() [#24538](https://github.com/pulumi/pulumi/pull/24538)
- [engine] Run state migrations for aliased remote components [#24545](https://github.com/pulumi/pulumi/pull/24545)
- [engine] Sort resources deterministically when repairing a snapshot [#24551](https://github.com/pulumi/pulumi/pull/24551)
- [engine] Fix state migration ordering for components interleaved with other resources [#24552](https://github.com/pulumi/pulumi/pull/24552)
- [sdk] Allow Automation API project settings to use any language runtime [#24559](https://github.com/pulumi/pulumi/pull/24559)
- [engine] Redact secret property values in `violates plan` error messages unless `--show-secrets` is passed [#24567](https://github.com/pulumi/pulumi/pull/24567)
- [cli] Treat a resource provider attached through PULUMI_DEBUG_PROVIDERS as installed, so package installation does not try to download it [#24572](https://github.com/pulumi/pulumi/pull/24572)
- [cli] Install the packages a local plugin directory requires before the plugin is installed and run [#24576](https://github.com/pulumi/pulumi/pull/24576)
- [engine] Avoid a deadlock when a resource provider asks the engine to load another plugin while it boots [#24571](https://github.com/pulumi/pulumi/pull/24571)
- [engine] Allow component state migrations to split managed state using compatible existing resource identities [#24582](https://github.com/pulumi/pulumi/pull/24582)
- [sdk/go] Allow outputs and prompt values to be marshalled into fields typed as input interfaces, such as pulumi.StringInput [#24577](https://github.com/pulumi/pulumi/pull/24577)
- [backend/diy] Make sure `disableSSL` doesn't override explicitly specified protocols [#24593](https://github.com/pulumi/pulumi/pull/24593)
- [cli] Fix `pulumi install` for a project that requires a resource provider attached through PULUMI_DEBUG_PROVIDERS [#24604](https://github.com/pulumi/pulumi/pull/24604)
- [cli] Resolve a project's relative plugin and package paths against the project directory when a plugin starts from a subdirectory of the project [#24596](https://github.com/pulumi/pulumi/pull/24596)
- [sdk/go] Report the source position of the user code that calls a generated resource getter instead of the getter body [#24602](https://github.com/pulumi/pulumi/pull/24602)
- [engine] Normalize successor references between chained component state migration callbacks [#24598](https://github.com/pulumi/pulumi/pull/24598)
- [cli/new] Error out on ambiguous template names instead of failing silently [#24607](https://github.com/pulumi/pulumi/pull/24607)

###### Improvements

- [cli/plugin] Correct `pulumi plugin rm` help text to note that the CLI re-downloads removed plugins automatically [#24618](https://github.com/pulumi/pulumi/pull/24618)
- [cli] Add `--filter` to `pulumi api list` to filter endpo

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.262.0]_

### v3.261.0

- Date: 2026-09-02
- Version: v3.261.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.261.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.261.0

- **added** — Support state migration callbacks on resource registrations
- **added** — Add `pulumi env setup {aws,azure,gcp}` to configure cloud OIDC trust and create the ESC environments that use it
- **fixed** — Report a clear error instead of panicking when the stack's state contains a custom resource with no ID
- **fixed** — Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials
- **fixed** — Fix a crash when binding a schema property with an integer constant value
- **fixed** — Avoid hanging when policy pack fails to start up
- **fixed** — Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version
- **fixed** — Fix serialization of secret unknowns in NodeJS, Python and PCL
- **fixed** — Ignore internal property keys (those starting with an underscore) when generating and checking update plans
- **changed** — Generate precise Python output types for discriminated unions
- **changed** — Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names
- **changed** — Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error
- **changed** — Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability
- **added** — Add helper methods to transform ResourceOptions to InvokeOptions

##### 3.261.0 (2026-09-02)

###### Features

- [engine] Support state migration callbacks on resource registrations [#24328](https://github.com/pulumi/pulumi/pull/24328)
- [cli/env] Add `pulumi env setup {aws,azure,gcp}` to configure cloud OIDC trust and create the ESC environments that use it [#23911](https://github.com/pulumi/pulumi/pull/23911)

###### Bug Fixes

- [engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID [#24438](https://github.com/pulumi/pulumi/pull/24438)
- [cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials [#24476](https://github.com/pulumi/pulumi/pull/24476)
- [pcl] Fix a crash when binding a schema property with an integer constant value [#24480](https://github.com/pulumi/pulumi/pull/24480)
- [cli/policy] Avoid hanging when policy pack fails to start up [#24492](https://github.com/pulumi/pulumi/pull/24492)
- [pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version [#24499](https://github.com/pulumi/pulumi/pull/24499)
- [sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL [#24500](https://github.com/pulumi/pulumi/pull/24500)
- [engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans [#24532](https://github.com/pulumi/pulumi/pull/24532)

###### Improvements

- [sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed `Sequence[Any]` and a scalar union `Any`, while the matching getters on the generated Args classes were already typed [#24485](https://github.com/pulumi/pulumi/pull/24485)
- [sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names [#24484](https://github.com/pulumi/pulumi/pull/24484)
- [sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error [#24507](https://github.com/pulumi/pulumi/pull/24507)
- [engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability [#24524](https://github.com/pulumi/pulumi/pull/24524)
- [sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions [#24533](https://github.com/pulumi/pulumi/pull/24533)

###### Miscellaneous

- [java] Upgrade java to v1.36.3 [#24509](https://github.com/pulumi/pulumi/pull/24509)
- [yaml] Upgrade yaml to v1.38.5 [#24509](https://github.com/pulumi/pulumi/pull/24509)
- [sdk/dotnet] Upgrade dotnet to v3.113.1 [#24512](https://github.com/pulumi/pulumi/pull/24512)

### v3.260.0

- Date: 2026-08-28
- Version: v3.260.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.260.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.260.0

- **added** — Make `pulumi deployment settings get` render every source kind and show environment variable values, changing the `--output=json` shape of `environmentVariables` from a list of names to a list of objects
- **added** — Support Go 1.27
- **added** — Add `pulumi state promote` to turn stateful snippets into Pulumi program code
- **fixed** — Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state
- **fixed** — Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs
- **fixed** — Cancelling a task now interrupts a running local tool call instead of waiting for it to finish
- **fixed** — Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting
- **fixed** — Generate valid struct field names for properties whose names contain hyphens
- **fixed** — Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them
- **fixed** — Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked
- **fixed** — Use resolved environment names when evaluating ESC imports
- **fixed** — Allow output-typed values for the id attribute of a read resource
- **fixed** — Register resolvers for output-only properties in generated Resource.get so they resolve as unknown during preview when the id is unknown
- **fixed** — Avoid replacing imported resources when an input changes from plain to a secret or output-wrapped value with the same inner value
- **fixed** — Keep DIY backend stacks readable when checkpoint compression transitions fail
- **fixed** — Give a clearer error message when selecting a stack by name outside a directory with a Pulumi.yaml project file
- **fixed** — Propagate runtime context across thread boundaries
- **fixed** — Name plain function input object types without the Args suffix, matching the name the generated SDK exports
- **fixed** — Reject zip template entries that resolve outside the extraction directory
- **fixed** — Keep a package's pluginDownloadURL in SDKs regenerated by `pulumi install`

##### 3.260.0 (2026-08-28)

###### Features

- [cli/deployment] Make `pulumi deployment settings get` render every source kind and show environment variable values, changing the `--output=json` shape of `environmentVariables` from a list of names to a list of objects [#24284](https://github.com/pulumi/pulumi/pull/24284)
- [sdk/go] Support Go 1.27 [#24401](https://github.com/pulumi/pulumi/pull/24401)
- [cli/state] Add `pulumi state promote` to turn stateful snippets into Pulumi program code [#24453](https://github.com/pulumi/pulumi/pull/24453)

###### Bug Fixes

- [engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state [#23818](https://github.com/pulumi/pulumi/pull/23818)
- [sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs [#24246](https://github.com/pulumi/pulumi/pull/24246)
- [cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish [#24268](https://github.com/pulumi/pulumi/pull/24268)
- [programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting [#24300](https://github.com/pulumi/pulumi/pull/24300)
- [programgen/go] Generate valid struct field names for properties whose names contain hyphens [#24300](https://github.com/pulumi/pulumi/pull/24300)
- [sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them [#24300](https://github.com/pulumi/pulumi/pull/24300)
- [cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked [#24318](https://github.com/pulumi/pulumi/pull/24318)
- [sdk/go] Use resolved environment names when evaluating ESC imports [#24375](https://github.com/pulumi/pulumi/pull/24375)
- [codegen/pcl] Allow output-typed values for the id attribute of a read resource [#24386](https://github.com/pulumi/pulumi/pull/24386)
- [sdkgen/nodejs] Register resolvers for output-only properties in generated Resource.get so they resolve as unknown during preview when the id is unknown [#24386](https://github.com/pulumi/pulumi/pull/24386)
- [engine] Avoid replacing imported resources when an input changes from plain to a secret or output-wrapped value with the same inner value [#24387](https://github.com/pulumi/pulumi/pull/24387)
- [backend/diy] Keep DIY backend stacks readable when checkpoint compression transitions fail [#24383](https://github.com/pulumi/pulumi/pull/24383)
- [cli/stack] Give a clearer error message when selecting a stack by name outside a directory with a Pulumi.yaml project file [#24394](https://github.com/pulumi/pulumi/pull/24394)
- [sdk/python] Propagate runtime context across thread boundaries [#24403](https://github.com/pulumi/pulumi/pull/24403)
- [programgen/python] Name plain function input object types without the Args suffix, matching the name the generated SDK exports [#24440](https://github.com/pulumi/pulumi/pull/24440)
- [cli/new] Reject zip template entries that resolve outside the extraction directory [#24447](https://github.com/pulumi/pulumi/pull/24447)
- [cli/package] Keep a package's pluginDownloadURL in SDKs regenerated by `pulumi install` [#24432](https://github.com/pulumi/pulumi/pull/24432)
- [sdk/python] Preserve all providers passed to remote components in Python programs [#24443](https://github.com/pulumi/pulumi/pull/24443)
- [sdkgen] Apply schema defaults to generated Python and Node.js function inputs [#24452](https://github.com/pulumi/pulumi/pull/24452)
- [programgen/python] Mark required component inputs as required in generated Python TypedDicts [#24459](https://github.com/pulumi/pulumi/pull/24459)
- [programgen/python] Add type annotations for config variables default values coming from invokes [#24464](https://github.com/pulumi/pulumi/pull/24464)
- [programgen/python] Ge

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.260.0]_

### v3.259.0

- Date: 2026-08-19
- Version: v3.259.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.259.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.259.0

- **added** — Show a single confirmation of project, stack, and config defaults in interactive pulumi new instead of prompting for each value
- **added** — Introduce PULUMI_DEFAULT_ORGANIZATION environment variable to set the default organization
- **added** — Add --parallel flag to pulumi plugin install
- **changed** — Type constant properties as Literal[value] instead of their primitive type in Python SDK generation
- **fixed** — Announce Created stack when creating a stack against the Pulumi Cloud backend
- **fixed** — Retry pulumi neo cancellation requests that the service rejects and keep Esc responsive instead of showing Cancelling forever
- **fixed** — Generate a component resource definition when importing local components
- **fixed** — Remove Node.js Automation API output buffer limit
- **fixed** — Always emit the value and environment keys when serializing esc.Value and esc.Range, matching the fields the ESC OpenAPI contract marks required
- **fixed** — Fix the engine returning extension package refs for non-parameterised packages against the same base
- **fixed** — Fix approval replies and mode changes being silently dropped when the outbound event queue is full
- **fixed** — Fix nondeterministic Go program codegen for objects that mix null and typed properties
- **fixed** — Keep snippets when delete fails, so delete can be retried
- **fixed** — Report every schema validation error when pulumi package add fails to bind a package schema
- **fixed** — Fix casing of local component outputs in Python program generation
- **fixed** — Make pulumi policy group ls respect the default organization
- **changed** — Explain which state backend pulumi login failed against, where that backend was configured, and how to change it
- **changed** — Report the state backend URL as configured when it cannot be opened, adding the resolved form when normalization changed it, and name a local path a state directory rather than a bucket
- **changed** — Fix progress bar rendering for parallel plugin installs

##### 3.259.0 (2026-08-19)

###### Features

- [cli/new] Show a single confirmation of project, stack, and config defaults in interactive `pulumi new` instead of prompting for each value [#24223](https://github.com/pulumi/pulumi/pull/24223)
- [cli] Introduce `PULUMI_DEFAULT_ORGANIZATION` to be able to set the default org [#24384](https://github.com/pulumi/pulumi/pull/24384)

###### Bug Fixes

- [cli/stack] Announce `Created stack` when creating a stack against the Pulumi Cloud backend [#24280](https://github.com/pulumi/pulumi/pull/24280)
- [cli] Retry `pulumi neo` cancellation requests that the service rejects and keep Esc responsive instead of showing "Cancelling..." forever [#24267](https://github.com/pulumi/pulumi/pull/24267)
- [cli/import] Generate a component resource definition when importing local components [#24294](https://github.com/pulumi/pulumi/pull/24294)
- [auto/nodejs] Remove Node.js Automation API output buffer limit [#24333](https://github.com/pulumi/pulumi/pull/24333)
- [sdk/go] Always emit the `value` and `environment` keys when serializing `esc.Value` and `esc.Range`, matching the fields the ESC OpenAPI contract marks required [#24346](https://github.com/pulumi/pulumi/pull/24346)
- [engine] Fix the engine returning extension package refs for non-parameterised packages against the same base [#24347](https://github.com/pulumi/pulumi/pull/24347)
- [cli/neo] Fix approval replies and mode changes being silently dropped when the outbound event queue is full [#24370](https://github.com/pulumi/pulumi/pull/24370)
- [codegen/go] Fix nondeterministic Go program codegen for objects that mix null and typed properties [#24366](https://github.com/pulumi/pulumi/pull/24366)
- [cli/do] Keep snippets when delete fails, so delete can be retried [#24271](https://github.com/pulumi/pulumi/pull/24271)
- [cli/package] Report every schema validation error when `pulumi package add` fails to bind a package schema [#24367](https://github.com/pulumi/pulumi/pull/24367)
- [programgen/python] Fix casing of local component outputs [#24379](https://github.com/pulumi/pulumi/pull/24379)
- [cli/policy] Make `policy group ls` respect the default org [#24385](https://github.com/pulumi/pulumi/pull/24385)

###### Improvements

- [cli] Explain which state backend `pulumi login` failed against, where that backend was configured, and how to change it [#24322](https://github.com/pulumi/pulumi/pull/24322)
- [backend/diy] Report the state backend URL as configured when it cannot be opened, adding the resolved form when normalization changed it, and name a local path a state directory rather than a bucket [#24335](https://github.com/pulumi/pulumi/pull/24335)
- [sdkgen/python] Type constant properties as Literal[value] instead of their primitive type [#24358](https://github.com/pulumi/pulumi/pull/24358)
- [cli/plugin] Add `--parallel` flag to `pulumi plugin install` [#24369](https://github.com/pulumi/pulumi/pull/24369)
- [cli] Fix progress bar rendering for parallel plugin installs [#24372](https://github.com/pulumi/pulumi/pull/24372)

### v3.258.0

- Date: 2026-08-17
- Version: v3.258.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.258.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.258.0

- **added** — Add opt-in encryption of stored credentials with a key protected by the operating system, selected with PULUMI_CREDENTIAL_STORE
- **added** — Ask for a cloud provider and language in interactive pulumi new instead of listing every template
- **added** — Add policyx.NewStackValidationPolicy and wire up the analyzer's AnalyzeStack RPC so Go policy packs can validate the full stack
- **fixed** — Generate valid Go package clauses for schema modules whose names contain hyphens
- **fixed** — Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces
- **fixed** — pulumi preview --import-file no longer emits unknown values, and pulumi import rejects files that contain them
- **fixed** — Add missing program argument on preview_refresh and preview_destroy stack methods
- **fixed** — Fix cloning templates and repositories into paths containing symlinks with absolute targets
- **fixed** — Fix global project lookup
- **changed** — Use the resource monitor's advertised feature set consistently throughout the Python SDK

##### 3.258.0 (2026-08-17)

###### Features

- [cli] Add opt-in encryption of stored credentials with a key protected by the operating system, selected with `PULUMI_CREDENTIAL_STORE` [#24212](https://github.com/pulumi/pulumi/pull/24212)
- [cli/new] Ask for a cloud provider and language in interactive `pulumi new` instead of listing every template [#24226](https://github.com/pulumi/pulumi/pull/24226)
- [sdk/go] Add `policyx.NewStackValidationPolicy` and wire up the analyzer's `AnalyzeStack` RPC so Go policy packs can validate the full stack [#24232](https://github.com/pulumi/pulumi/pull/24232)

###### Bug Fixes

- [sdkgen/go] Generate valid Go package clauses for schema modules whose names contain hyphens [#24288](https://github.com/pulumi/pulumi/pull/24288)
- [sdkgen/nodejs] Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces [#24288](https://github.com/pulumi/pulumi/pull/24288)
- [cli/import] `pulumi preview --import-file` no longer emits unknown values, and `pulumi import` rejects files that contain them [#24261](https://github.com/pulumi/pulumi/pull/24261)
- [auto/python] Add missing `program` argument on `preview_refresh` and `preview_destroy` stack methods [#24274](https://github.com/pulumi/pulumi/pull/24274)
- [cli/new] Fix cloning templates and repositories into paths containing symlinks with absolute targets [#24329](https://github.com/pulumi/pulumi/pull/24329)
- [cli/do] Fix global project lookup [#24334](https://github.com/pulumi/pulumi/pull/24334)

###### Improvements

- [sdk/python] Use the resource monitor's advertised feature set consistently throughout the Python SDK [#24308](https://github.com/pulumi/pulumi/pull/24308)

###### Miscellaneous

- [cli] Rewrite the `pulumi login` and `pulumi logout` help text to cover all supported state backends and document `PULUMI_ACCESS_TOKEN`, `--default-org`, and `--interactive` [#24319](https://github.com/pulumi/pulumi/pull/24319)

### v3.257.0

- Date: 2026-08-13
- Version: v3.257.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.257.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.257.0

- **added** — Offer to create a first project after logging in to an account with no stacks
- **added** — Auto-assign identifiers to existing stack resources in `pulumi do` input expressions, and add `pulumi do show-resources` to list them
- **added** — Make `pulumi do <pkg> <resource> patch <name>` work in stateful mode, overlaying the supplied inputs onto the existing snippet
- **added** — Implement `pulumi state get` to show individual resources
- **added** — Fall back to an auto-created project and stack under PULUMI_HOME when `pulumi do` is invoked outside of a Pulumi project
- **fixed** — Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments
- **fixed** — Make `pulumi stack history events --summary` report the program errors from the language host
- **fixed** — `pulumi api`: repeated `-H`/`--header` values for the same header name now all reach the wire, instead of each one silently overwriting the last
- **fixed** — Maintain `--server` when adding to the packages section of Pulumi.yaml
- **fixed** — Fix panics in hooks to not crash the entire process
- **fixed** — `for` expressions are now generated as Go loops
- **fixed** — Fix invalid `_ := index` statement emitted for resources with a numeric `range` whose value variable is unused
- **fixed** — Report an error instead of hanging when a Python resource depends on its own parent
- **fixed** — Generate the missing Go input types for resource input properties that are deeply nested collections of object types
- **fixed** — Rename properties that collide with reserved names (e.g. `elementType`) the same way SDK codegen does, instead of emitting uncompilable code
- **fixed** — Show the value being added when a refresh or provider diff reports an added property
- **fixed** — Track when a plugin was last run so `pulumi plugin ls` reports an accurate last-used time on all platforms
- **fixed** — Show secrets in diff display when `--show-secrets` is passed
- **fixed** — Exit promptly when a command is cancelled while an HTTP request is being retried
- **changed** — The deprecation warning for DIY backend is now an error, with PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING renamed to PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR

##### 3.257.0 (2026-08-13)

###### Features

- [cli] Offer to create a first project after logging in to an account with no stacks [#24133](https://github.com/pulumi/pulumi/pull/24133)
- [cli/do] Auto-assign identifiers to existing stack resources in `pulumi do` input expressions, and add `pulumi do show-resources` to list them [#24184](https://github.com/pulumi/pulumi/pull/24184)
- [cli/do] Make "`pulumi do <pkg> <resource> patch <name>` work in stateful mode, overlaying the supplied inputs onto the existing snippet" [#24295](https://github.com/pulumi/pulumi/pull/24295)
- [cli/state] Implement `pulumi state get` to show individual resources [#24191](https://github.com/pulumi/pulumi/pull/24191)
- [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when `pulumi do` is invoked outside of a Pulumi project [#24231](https://github.com/pulumi/pulumi/pull/24231)

###### Bug Fixes

- [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later [#24060](https://github.com/pulumi/pulumi/pull/24060)
- [cli] Make '`pulumi stack history events --summary` report the program errors  from the language host [#24111](https://github.com/pulumi/pulumi/pull/24111)
- [cli/cloud] `pulumi api`: repeated `-H`/`--header` values for the same header name now all reach the wire, instead of each one silently overwriting the last [#24180](https://github.com/pulumi/pulumi/pull/24180)
- [cli/package] Maintain `--server` when adding to the packages section of Pulumi.yaml [#24189](https://github.com/pulumi/pulumi/pull/24189)
- [sdk/go] Fix panics in hooks to not crash the entire process [#24218](https://github.com/pulumi/pulumi/pull/24218)
- [programgen/go] `for` expressions are now generated as Go loops [#24228](https://github.com/pulumi/pulumi/pull/24228)
- [programgen/go] Fix invalid `_ := index` statement emitted for resources with a numeric `range` whose value variable is unused [#24227](https://github.com/pulumi/pulumi/pull/24227)
- [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent [#24230](https://github.com/pulumi/pulumi/pull/24230)
- [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types [#24236](https://github.com/pulumi/pulumi/pull/24236)
- [programgen/go] Rename properties that collide with reserved names (e.g. `elementType`) the same way SDK codegen does, instead of emitting uncompilable code [#24235](https://github.com/pulumi/pulumi/pull/24235)
- [cli/display] Show the value being added when a refresh or provider diff reports an added property [#24245](https://github.com/pulumi/pulumi/pull/24245)
- [cli/plugin] Track when a plugin was last run so `pulumi plugin ls` reports an accurate last-used time on all platforms [#24251](https://github.com/pulumi/pulumi/pull/24251)
- [engine] Show secrets in diff display when `--show-secrets` is passed [#24253](https://github.com/pulumi/pulumi/pull/24253)
- [cli] Exit promptly when a command is cancelled while an HTTP request is being retried [#24276](https://github.com/pulumi/pulumi/pull/24276)

###### Improvements

- [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits [#24082](https://github.com/pulumi/pulumi/pull/24082)
- [cli] Pass the invoked command (e.g. `pulumi new`) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them [#24192](https://github.com/pulumi/pulumi/pull/24192)

###### Miscellaneous

- [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's [#24143](https://github.com/pulumi/pulumi/pull/24143)
- [java] Upgrade java to v1.35.0 [#24202](https://github.com/pulumi/pu

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.257.0]_

### v3.256.0

- Date: 2026-08-04
- Version: v3.256.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.256.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.256.0

- **added** — Add `--ignore-protect` flag to `pulumi up`, `pulumi preview` and `pulumi destroy` to allow deleting protected resources without unprotecting them in the state first
- **added** — Add an optional `--export-env-vars` flag to the `env provider {aws,azure,gcp}-login` commands to also set the standard SDK environment variables referencing the login outputs
- **added** — Add a `--server` flag to `pulumi package add`, `publish`, `get-schema`, `get-mapping`, `gen-sdk`, `info` and `pulumi schema check` that skips package resolution and uses the given URL as the plugin download URL
- **fixed** — Fix `pulumi login --insecure` not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates
- **fixed** — Scope current stack selection to the active backend so switching backends no longer surfaces stale stack errors
- **fixed** — Parent an invoke written inside a component to that component, lower a component's outputs, and only import `fmt` when a component needs it in Go program generation
- **fixed** — Parent an invoke written inside a component to that component in Python program generation so it resolves the component's providers
- **fixed** — Defer output-form invokes that depend on a remote component whose resources are pending creation in Node.js by declaring invoke dependencies to the engine
- **fixed** — Gate invokes on the created-ness of their declared dependencies, including the children of remote components, resolving them as unknown during previews that still have to create them
- **fixed** — Defer output-form invokes that depend on a remote component whose resources are pending creation in Go by declaring invoke dependencies to the engine
- **fixed** — Declare invoke dependencies to the engine in PCL so invokes that depend on pending resources, including remote components, resolve as unknown during previews
- **fixed** — Defer output-form invokes that depend on a remote component whose resources are pending creation in Python by declaring invoke dependencies to the engine
- **fixed** — `env provider` no longer writes a new environment revision when the resulting definition is unchanged
- **fixed** — Output-form invokes in Go now infer their resource dependencies from their arguments, so they are skipped during preview while a dependent resource is pending creation and their results carry those dependencies
- **fixed** — Fix nested optional output conversions in Go SDK generation
- **fixed** — Fix a plugin process leak in `NewPolicyAnalyzer` when `ConfigureStack` fails after the plugin has booted
- **fixed** — Avoid redundant applies when projecting properties from generated Go object outputs
- **fixed** — Fix 403 errors writing to third-party S3-compatible backends by defaulting request_checksum_calculation to when_required when the s3:// backend URL sets a custom endpoint
- **fixed** — Avoid redundant applies when projecting properties from Node.js outputs
- **fixed** — Avoid redundant applies when projecting properties from Python outputs

##### 3.256.0 (2026-08-04)

###### Features

- [cli] Add `--ignore-protect` flag to `pulumi up`, `pulumi preview` and `pulumi destroy` to allow deleting protected resources without unprotecting them in the state first [#24053](https://github.com/pulumi/pulumi/pull/24053)
- [cli/env] Add an optional `--export-env-vars` flag to the `env provider {aws,azure,gcp}-login` commands to also set the standard SDK environment variables referencing the login outputs [#24055](https://github.com/pulumi/pulumi/pull/24055)
- [cli] Add a `--server` flag to `pulumi package add`, `publish`, `get-schema`, `get-mapping`, `gen-sdk`, `info` and `pulumi schema check` that skips package resolution and uses the given URL as the plugin download URL [#24107](https://github.com/pulumi/pulumi/pull/24107)

###### Bug Fixes

- [backend/service] Fix `pulumi login --insecure` not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates [#24134](https://github.com/pulumi/pulumi/pull/24134)
- [cli] Scope current stack selection to the active backend so switching backends no longer surfaces stale stack errors [#23974](https://github.com/pulumi/pulumi/pull/23974)
- [programgen/go] Parent an invoke written inside a component to that component, lower a component's outputs, and only import `fmt` when a component needs it [#24019](https://github.com/pulumi/pulumi/pull/24019)
- [programgen/python] Parent an invoke written inside a component to that component, so it resolves the component's providers [#24018](https://github.com/pulumi/pulumi/pull/24018)
- [sdk/nodejs] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#24042](https://github.com/pulumi/pulumi/pull/24042)
- [engine] Gate invokes on the created-ness of their declared dependencies, including the children of remote components, resolving them as unknown during previews that still have to create them [#24040](https://github.com/pulumi/pulumi/pull/24040)
- [sdk/go] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#24044](https://github.com/pulumi/pulumi/pull/24044)
- [pcl] Declare invoke dependencies to the engine so invokes that depend on pending resources, including remote components, resolve as unknown during previews [#24041](https://github.com/pulumi/pulumi/pull/24041)
- [sdk/python] Defer output-form invokes that depend on a remote component whose resources are pending creation, by declaring invoke dependencies to the engine [#24043](https://github.com/pulumi/pulumi/pull/24043)
- [cli/env] `env provider` no longer writes a new environment revision when the resulting definition is unchanged [#24055](https://github.com/pulumi/pulumi/pull/24055)
- [sdk/go] Output-form invokes now infer their resource dependencies from their arguments, so they are skipped during preview while a dependent resource is pending creation and their results carry those dependencies [#24054](https://github.com/pulumi/pulumi/pull/24054)
- [sdkgen/go] Fixes nested optional output conversions [#24096](https://github.com/pulumi/pulumi/pull/24096)
- [engine] Fix a plugin process leak in `NewPolicyAnalyzer` when `ConfigureStack` fails after the plugin has booted [#24106](https://github.com/pulumi/pulumi/pull/24106)
- [programgen/go] Avoid redundant applies when projecting properties from generated Go object outputs [#24112](https://github.com/pulumi/pulumi/pull/24112)
- [backend/diy] Fix 403 errors writing to third-party S3-compatible backends (e.g. IBM COS, MinIO) by defaulting request_checksum_calculation to when_required when the s3:// backend URL sets a custom endpoint [#24109](https://github.com/pulumi/pulumi/pull/24109)
- [programgen/nodejs] Avoid redundant applies when projecting properties from Node.js outputs [#2411

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.256.0]_

### v3.255.0

- Date: 2026-07-28
- Version: v3.255.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.255.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.255.0

- **added** — Add an --extension flag to package commands for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install
- **added** — Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment
- **added** — Resolve an invoke's provider from the providers option of the parent named on the request, matching the resolution applied to resource registrations
- **added** — Add --resources to refer to existing resources in state in do input expressions
- **fixed** — Parent an invoke written inside a component to that component, so it resolves the component's providers
- **fixed** — Apply the providers option of a component block to the resources and invokes it declares
- **fixed** — Fix import file generation when parent resources share names
- **fixed** — Fix parallel pulumi install processes sharing a PULUMI_HOME intermittently failing with a missing provider executable error
- **fixed** — Allow Construct and Call methods to run concurrently in provider servers
- **changed** — Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in
- **added** — Add a --summary flag to pulumi stack history events that reduces a past update's events to the same summary shape as a live pulumi up --output json, extended with error diagnostics and failed-resource markers
- **changed** — Allow state converters to supply resource inputs and outputs in ConvertState responses
- **changed** — Allow policy packs to point to executable binaries, not just script folders
- **changed** — The Neo diagnostics link now suggests pulumi neo --debug-update or pulumi neo --debug-preview to investigate the failed operation
- **changed** — Allow UV_PROJECT_ENVIRONMENT to override the virtualenv path if uv is used
- **changed** — Allow otel traces to be sent over https

##### 3.255.0 (2026-07-28)

###### Features

- [cli] Add an `--extension` flag to package commands for extension-parameterized packages, reinstalled from `Pulumi.yaml` on `pulumi install`
- [cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment [#23993](https://github.com/pulumi/pulumi/pull/23993)
- [engine] Resolve an invoke's provider from the `providers` option of the parent named on the request, matching the resolution applied to resource registrations [#24016](https://github.com/pulumi/pulumi/pull/24016)
- [cli/do] Add `--resources` to refer to existing resources in state in `do` input expressions [#24037](https://github.com/pulumi/pulumi/pull/24037)

###### Bug Fixes

- [programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers [#24017](https://github.com/pulumi/pulumi/pull/24017)
- [pcl] Apply the `providers` option of a `component` block to the resources and invokes it declares [#24016](https://github.com/pulumi/pulumi/pull/24016)
- [cli/import] Fix import file generation when parent resources share names [#24069](https://github.com/pulumi/pulumi/pull/24069)
- [cli] Fix parallel `pulumi install` processes sharing a `PULUMI_HOME` intermittently failing with a missing provider executable error [#24080](https://github.com/pulumi/pulumi/pull/24080)
- [sdk/python] Allow Construct and Call methods to run concurrently in provider servers [#24081](https://github.com/pulumi/pulumi/pull/24081)

###### Improvements

- [engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) [#23856](https://github.com/pulumi/pulumi/pull/23856)
- [cli] Add a `--summary` flag to `pulumi stack history events` that reduces a past update's events to the same summary shape as a live `pulumi up --output json`, extended with error diagnostics and failed-resource markers [#23960](https://github.com/pulumi/pulumi/pull/23960)
- [protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses [#23987](https://github.com/pulumi/pulumi/pull/23987)
- [engine] Allow policy packs to point to executable binaries, not just script folders [#24052](https://github.com/pulumi/pulumi/pull/24052)
- [cli/display] The Neo diagnostics link now suggests `pulumi neo --debug-update` or `pulumi neo --debug-preview` to investigate the failed operation [#24075](https://github.com/pulumi/pulumi/pull/24075)
- [sdk/python] Allow `UV_PROJECT_ENVIRONMENT` to override the virtualenv path if uv is used [#24077](https://github.com/pulumi/pulumi/pull/24077)
- [cli] Allow otel traces to be sent over https [#24078](https://github.com/pulumi/pulumi/pull/24078)

### v3.254.0

- Date: 2026-07-23
- Version: v3.254.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.254.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.254.0

- **added** — Add `pulumi logs share` command for sharing logs with Pulumi
- **added** — Add `pulumi stack migrate` to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider
- **added** — Add an `--override-env` flag to `up`, `preview`, `destroy`, and `refresh` to substitute imported environments for a single run without editing the stack config
- **added** — Add `pulumi neo acp` to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options
- **added** — Retry transient `pulumi neo` stream and message-send failures, and add `pulumi neo resume` with chat history
- **changed** — Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in `pulumi neo`
- **added** — Add `upsert` to do, allowing resources to be statefully created or updated in a stack
- **added** — Add `pulumi.run` for natively awaited Python program entrypoints that can return stack outputs
- **added** — Allow expressions for number inputs in do
- **added** — Allow expressions for boolean inputs in do
- **added** — Add `--runtime-options` to `pulumi policy new`
- **added** — Add support for stateful create in do
- **added** — Add support for stateful delete in do
- **fixed** — Fix Go codegen for plain properties nested inside non-plain objects
- **fixed** — Keep `pulumi neo` connected during quiet periods when the event stream only receives keep-alive heartbeats
- **fixed** — Validate snippets before persisting them
- **fixed** — Fix dangling ReplaceWith references in the journal replayer
- **fixed** — Fix the converter plugin not being called if just attributes needed converting
- **fixed** — Generate compilable Go for programs that use discriminated union members as array/list elements
- **changed** — Align commands with CLI naming guidelines, adding `ls`, `rm`, `delete`, `mv`, `update`, `modify`, `create` and `setup` aliases to list/remove/move/edit/new commands and making `state remove` and `package remove` the canonical names with `delete` kept as an alias

##### 3.254.0 (2026-07-23)

###### Features

- [cli] Add `pulumi logs share` command for sharing logs with Pulumi [#22546](https://github.com/pulumi/pulumi/pull/22546)
- [cli] Add `pulumi stack migrate` to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider [#22902](https://github.com/pulumi/pulumi/pull/22902)
- [cli/config] Add an `--override-env` flag to `up`, `preview`, `destroy`, and `refresh` to substitute imported environments for a single run without editing the stack config [#23562](https://github.com/pulumi/pulumi/pull/23562)
- [cli] Add `pulumi neo acp` to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options [#23886](https://github.com/pulumi/pulumi/pull/23886)
- [cli/neo] Retry transient `pulumi neo` stream and message-send failures, and add `pulumi neo resume` with chat history [#23835](https://github.com/pulumi/pulumi/pull/23835)
- [cli/neo] Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in `pulumi neo` [#23932](https://github.com/pulumi/pulumi/pull/23932)
- [cli/do] Add `upsert` to do, allowing resources to be statefully created or updated in a stack [#23813](https://github.com/pulumi/pulumi/pull/23813)
- [sdk/python] Add `pulumi.run` for natively awaited Python program entrypoints that can return stack outputs [#23945](https://github.com/pulumi/pulumi/pull/23945)
- [cli/do] Allow expressions for number inputs [#23954](https://github.com/pulumi/pulumi/pull/23954)
- [cli/do] Allow expressions for boolean inputs [#23967](https://github.com/pulumi/pulumi/pull/23967)
- [cli/policy] Add `--runtime-options` to `pulumi policy new` [#23992](https://github.com/pulumi/pulumi/pull/23992)
- [cli/do] Add support for stateful create [#23996](https://github.com/pulumi/pulumi/pull/23996)
- [cli/do] Add support for stateful delete [#24000](https://github.com/pulumi/pulumi/pull/24000)

###### Bug Fixes

- [sdkgen/go] Fix Go codegen for plain properties nested inside non-plain objects [#22524](https://github.com/pulumi/pulumi/pull/22524)
- [cli/neo] Keep `pulumi neo` connected during quiet periods when the event stream only receives keep-alive heartbeats [#23935](https://github.com/pulumi/pulumi/pull/23935)
- [engine] Validate snippets before persisting them [#23920](https://github.com/pulumi/pulumi/pull/23920)
- [backend] Fix dangling ReplaceWith references in the journal replayer [#23927](https://github.com/pulumi/pulumi/pull/23927)
- [cli/do] Fix the converter plugin not being called if just attributes needed converting [#23948](https://github.com/pulumi/pulumi/pull/23948)
- [programgen/go] Generate compilable Go for programs that use discriminated union members as array/list elements [#23980](https://github.com/pulumi/pulumi/pull/23980)

###### Improvements

- [cli] Align commands with the CLI naming guidelines, adding `ls`, `rm`, `delete`, `mv`, `update`, `modify`, `create` and `setup` aliases to list/remove/move/edit/new commands and making `state remove` and `package remove` the canonical names with `delete` kept as an alias [#23903](https://github.com/pulumi/pulumi/pull/23903)
- [cli] Suggest closely-matching commands from the whole command tree when an unknown command is entered [#23848](https://github.com/pulumi/pulumi/pull/23848)
- [cli] Print help but exit with a non-zero code when `pulumi` is run without a command, matching the behavior of other group commands [#23848](https://github.com/pulumi/pulumi/pull/23848)
- [programgen] Support `onError` resource hooks in generated Go, NodeJS, and Python programs and in the PCL runtime, retrying the failed operation when the hook command exits successfully [#23839](https://github.com/pulumi/pulumi/pull/23839)
- [protobuf] Add parent and properties fields to ResourceImport so state converters can express resource hierarchy and

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.254.0]_

### v3.253.0

- Date: 2026-07-14
- Version: v3.253.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.253.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.253.0

- **added** — Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations
- **fixed** — Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames
- **fixed** — Respect the -v log level again so that without -v only warnings and errors are written to stderr
- **fixed** — Correctly generate provider resources declared inside PCL components for Node.js, Python and Go
- **added** — Add a --version flag to the pulumi command that prints the version, same as pulumi version
- **changed** — Align env commands with the CLI naming guidelines, making list, remove and move the canonical names with ls, rm, delete and mv kept as aliases

##### 3.253.0 (2026-07-14)

###### Features

- [auto/go] Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations [#23833](https://github.com/pulumi/pulumi/pull/23833)

###### Bug Fixes

- [sdk] Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames [#23566](https://github.com/pulumi/pulumi/pull/23566)
- [cli] Respect the -v log level again so that without -v only warnings and errors are written to stderr [#23910](https://github.com/pulumi/pulumi/pull/23910)
- [codegen] Correctly generate provider resources declared inside PCL components for Node.js, Python and Go [#23904](https://github.com/pulumi/pulumi/pull/23904)

###### Improvements

- [cli] Add a `--version` flag to the `pulumi` command that prints the version, same as `pulumi version` [#23898](https://github.com/pulumi/pulumi/pull/23898)
- [cli] Align `env` commands with the CLI naming guidelines, making `list`, `remove` and `move` the canonical names with `ls`, `rm`, `delete` and `mv` kept as aliases [#23901](https://github.com/pulumi/pulumi/pull/23901)

### v3.252.0

- Date: 2026-07-13
- Version: v3.252.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.252.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.252.0

- **added** — Add `import` to the generated automation APIs for NodeJS, Python and Go
- **changed** — Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud
- **changed** — Show command name for cli commands when running any command that lists logs
- **changed** — Render strings containing non-UTF8 bytes as b"<base64>" in diffs and JSON output
- **added** — Add a `--reason` flag to `pulumi env open-request` to explain the request to approvers
- **changed** — Improve the error message when a resource URN is not found in the state for `pulumi state` commands, suggesting close-matching URNs and how to list the URNs in the stack
- **added** — Allow binding hooks to a resource's `onError` option
- **added** — Add a `production` runtime option for Node.js projects that skips `devDependencies` when set to `true` in `Pulumi.yaml`
- **fixed** — Exit with a non-zero code when a command group such as `pulumi env` is given an unknown subcommand or no subcommand at all
- **fixed** — Fix a panic when displaying a stack-level policy violation
- **fixed** — Make reading non-secret stack outputs and running `pulumi about` no longer require the passphrase for passphrase-encrypted stacks
- **fixed** — Avoid `pulumi logs <command>` showing the log for the currently running command
- **fixed** — Fix calling delete on PF resources that need read called first
- **fixed** — Submit the change request created by `pulumi env open-request` so it is pending approval instead of being left as an unsubmitted draft
- **fixed** — Fix the initial prompt sometimes rendering above the welcome banner in `pulumi neo`
- **fixed** — Fix importing a resource whose import identifier differs from its canonical ID causes the resource to be deleted on a subsequent update
- **fixed** — Deduplicate identical apply arguments to avoid unnecessary Promise.all/pulumi.all/Output.All in generated code
- **fixed** — Failed resource registrations will return faulted outputs, not unknown outputs
- **fixed** — Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages
- **changed** — Report the TypeScript version in `pulumi about`

##### 3.252.0 (2026-07-13)

###### Features

- [auto] Add `import` to the generated automation APIs for NodeJS, Python and Go [#23876](https://github.com/pulumi/pulumi/pull/23876)
- [cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud [#23811](https://github.com/pulumi/pulumi/pull/23811)
- [cli] Show command name for cli commands when running any command that lists logs [#23889](https://github.com/pulumi/pulumi/pull/23889)
- [cli/display] Render strings containing non-UTF8 bytes as b"<base64>" in diffs and JSON output [#23870](https://github.com/pulumi/pulumi/pull/23870)
- [cli/env] Add a `--reason` flag to `pulumi env open-request` to explain the request to approvers [#23802](https://github.com/pulumi/pulumi/pull/23802)
- [cli/state] Improve the error message when a resource URN is not found in the state for `pulumi state` commands, suggesting close-matching URNs and how to list the URNs in the stack [#23812](https://github.com/pulumi/pulumi/pull/23812)
- [pcl] Allow binding hooks to a resource's `onError` option [#23838](https://github.com/pulumi/pulumi/pull/23838)
- [sdk/nodejs] Add a `production` runtime option for Node.js projects. When set to `true` in `Pulumi.yaml`, `pulumi install` skips `devDependencies` (npm `--production`, pnpm `--production`, yarn `--production`). [#23849](https://github.com/pulumi/pulumi/pull/23849)

###### Bug Fixes

- [cli] Exit with a non-zero code when a command group such as `pulumi env` is given an unknown subcommand or no subcommand at all [#23814](https://github.com/pulumi/pulumi/pull/23814)
- [cli] Fix a panic when displaying a stack-level policy violation [#23692](https://github.com/pulumi/pulumi/pull/23692)
- [cli] Make reading non-secret stack outputs and running `pulumi about` no longer require the passphrase for passphrase-encrypted stacks [#23820](https://github.com/pulumi/pulumi/pull/23820)
- [cli] Avoid `pulumi logs <command>` showing the log for the currently running command [#23887](https://github.com/pulumi/pulumi/pull/23887)
- [cli/do] Fix calling delete on PF resources that need read called first [#23837](https://github.com/pulumi/pulumi/pull/23837)
- [cli/env] Submit the change request created by `pulumi env open-request` so it is pending approval instead of being left as an unsubmitted draft [#23802](https://github.com/pulumi/pulumi/pull/23802)
- [cli/neo] Fix the initial prompt sometimes rendering above the welcome banner in `pulumi neo` [#23831](https://github.com/pulumi/pulumi/pull/23831)
- [engine] Fix importing a resource whose import identifier differs from its canonical ID causes the resource to be deleted on a subsequent update [#23834](https://github.com/pulumi/pulumi/pull/23834)
- [programgen] Deduplicate identical apply arguments to avoid unnecessary Promise.all/pulumi.all/Output.All in generated code [#22293](https://github.com/pulumi/pulumi/pull/22293)
- [sdk] Failed resource registrations will return faulted outputs, not unknown outputs [#23844](https://github.com/pulumi/pulumi/pull/23844)
- [sdk/nodejs] Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages [#23866](https://github.com/pulumi/pulumi/pull/23866)

###### Miscellaneous

- [sdk/nodejs] Report the TypeScript version in `pulumi about` [#23850](https://github.com/pulumi/pulumi/pull/23850)
- [sdk/nodejs] Update OpenTelemetry dependencies [#23855](https://github.com/pulumi/pulumi/pull/23855)

### v3.251.0

- Date: 2026-07-08
- Version: v3.251.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.251.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.251.0

- **fixed** — Show a retain marker for retain-on-delete resources in --diff output
- **fixed** — Don't miscopy out archives
- **added** — Add pulumi neo --debug-update and pulumi neo --debug-preview flags to investigate a failed update or preview
- **changed** — Add an ecosystem field to converter mapping requests so a converter can request mappings for the ecosystem it consumes rather than its own name
- **removed** — pulumi deployment settings no longer writes the local Pulumi.<stack>.deploy.yaml file; the experimental init, pull, configure, and env subcommands have been removed, and the CLI no longer calls the deployment-settings encrypt endpoint
- **removed** — Remove the deployment settings file (Pulumi.<stack>.deploy.yaml) entirely, including the pulumi deployment settings push command, the --config-file flag, and SDK helpers that read the file
- **fixed** — Prevent plugin debug logs from appearing as raw JSON in the CLI's output when logging with --logtostderr
- **changed** — Report the new revision number when an environment definition is updated (e.g. pulumi env edit, pulumi env provider, pulumi env version rollback)
- **changed** — Support importing resources under parameterized providers from a converter or import file
- **changed** — Support importing resources under extension-parameterized providers
- **added** — Add TargetSnippets to deployment options to target snippets by UUID
- **changed** — Add OpenTelemetry spans to the StackReference read path so performance traces can pinpoint slow snapshot fetches, deserialization, or secret decryption
- **added** — Invoke functions declared with multi-argument inputs using positional arguments in PCL
- **fixed** — Don't include the version in module paths when serializing functions when using pnpm
- **added** — Generate SDKs and programs for extension-parameterized packages

##### 3.251.0 (2026-07-08)

###### Bug Fixes

- [cli] Show a `retain` marker for retain-on-delete resources in `--diff` output [#23754](https://github.com/pulumi/pulumi/pull/23754)
- [cli] Don't miscopy out archives [#23798](https://github.com/pulumi/pulumi/pull/23798)

###### Miscellaneous

- [cli] Add `pulumi neo --debug-update` and `pulumi neo --debug-preview` flags to investigate a failed update or preview, suggested in the failure output [#23499](https://github.com/pulumi/pulumi/pull/23499)

###### Improvements

- [cli/convert] Add an `ecosystem` field to converter mapping requests so a converter can request mappings for the ecosystem it consumes rather than its own name [#23804](https://github.com/pulumi/pulumi/pull/23804)
- [cli/deployment] `pulumi deployment settings` no longer writes the local `Pulumi.<stack>.deploy.yaml` file: the experimental `init`, `pull`, `configure`, and `env` subcommands have been removed, and the CLI no longer calls the deployment-settings encrypt endpoint. `get`/`edit`/`destroy` continue to manage settings directly in Pulumi Cloud [#23480](https://github.com/pulumi/pulumi/pull/23480)
- [cli/deployment] The deployment settings file (`Pulumi.<stack>.deploy.yaml`) has been removed entirely. The experimental `pulumi deployment settings push` (`update`/`up`) command, the `--config-file` flag, and the SDK helpers that read the file have been removed. Manage deployment settings directly in Pulumi Cloud with `pulumi deployment settings get`, `edit`, and `destroy` [#23480](https://github.com/pulumi/pulumi/pull/23480)

###### Bug Fixes

- [cli/display] Prevent plugin debug logs from appearing as raw JSON in the CLI's output when logging with `--logtostderr` [#23633](https://github.com/pulumi/pulumi/pull/23633)

###### Improvements

- [cli/env] Report the new revision number when an environment definition is updated (e.g. `pulumi env edit`, `pulumi env provider`, `pulumi env version rollback`) [#23799](https://github.com/pulumi/pulumi/pull/23799)

###### Miscellaneous

- [cli/env] Fold the Pulumi ESC engine and CLI into the pulumi/pulumi monorepo, removing the sdk↔esc Go module cycle. Internal refactor with no user-facing behavior change; `pulumi env`/`pulumi esc` are unaffected. [#23746](https://github.com/pulumi/pulumi/pull/23746)

###### Improvements

- [cli/import] Support importing resources under parameterized providers from a converter or import file [#23763](https://github.com/pulumi/pulumi/pull/23763)
- [cli/import] Support importing resources under extension-parameterized providers [#23779](https://github.com/pulumi/pulumi/pull/23779)

###### Features

- [engine] Add `TargetSnippets` to deployment options to target snippets by UUID. [#23745](https://github.com/pulumi/pulumi/pull/23745)

###### Improvements

- [engine] Add OpenTelemetry spans to the StackReference read path so performance traces can pinpoint slow snapshot fetches, deserialization, or secret decryption [#23787](https://github.com/pulumi/pulumi/pull/23787)

###### Features

- [programgen/pcl] Invoke functions declared with multi-argument inputs using positional arguments in PCL [#23571](https://github.com/pulumi/pulumi/pull/23571)

###### Bug Fixes

- [sdk/nodejs] Don't include the version in module paths when serializing functions when using pnpm [#23767](https://github.com/pulumi/pulumi/pull/23767)

###### Features

- [sdkgen] Generate SDKs and programs for extension-parameterized packages [#23579](https://github.com/pulumi/pulumi/pull/23579)

### v3.250.0

- Date: 2026-07-02
- Version: v3.250.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.250.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.250.0

- **fixed** — Fix recursive property log marshaling in CLI engine

##### 3.250.0 (2026-07-01)

###### Bug Fixes

- [cli/engine] Fix recursive property log marshaling [#23773](https://github.com/pulumi/pulumi/pull/23773)

### v3.249.0

- Date: 2026-07-01
- Version: v3.249.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.249.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.249.0

- **fixed** — Fix `pulumi stack tag rm` not removing the last tag on self-managed (diy) backends
- **fixed** — Don't fail an operation due to a logging failure
- **added** — Add `--skip-config-validation` flag to preview, up, refresh, and destroy to skip validation of stack config against the project config schema
- **changed** — Enable automatic logging for every command by default
- **fixed** — Don't ignore diffs in `Output` values
- **fixed** — Use display resource type names in policy violation output
- **added** — Add `--output $format` flag to `pulumi stack {list,history,tag list}`
- **added** — Add --output $format to `pulumi policy list` and `pulumi policy group list`
- **added** — Add --output $format to `pulumi project list`
- **added** — Add `--output $format` flag to `pulumi config env list`
- **changed** — `pulumi login` will warn if the given login differs from PULUMI_BACKEND_URL
- **fixed** — Error when converting a Terraform program to the `hcl` language
- **fixed** — Fix TestDebuggerAttach for dlv@1.27
- **added** — Add `--output $format` to `pulumi plugin list`
- **added** — Add a `--file` flag to `pulumi policy analyze` to analyze a state file without requiring a stack or backend login
- **changed** — Allow ProgramTest to use npm for Node.js tests
- **fixed** — Generate numeric `range` loops in NodeJS with a per-iteration binding so deferred applies in the loop body observe the correct index
- **changed** — Update the dotnet and java language runtimes
- **fixed** — Fix FileArchive nested in an AssetArchive producing zip/tar entries with backslashes on Windows
- **changed** — Move provider RPC setup code to the sdk module
- **changed** — Use npm as the package manager for the Node.js SDK

##### 3.249.0 (2026-07-01)

###### Bug Fixes

- [backend/diy] Fix `pulumi stack tag rm` not removing the last tag on self-managed (diy) backends [#23702](https://github.com/pulumi/pulumi/pull/23702)
- [backend/service] Don't fail a operation due to a logging failure [#23704](https://github.com/pulumi/pulumi/pull/23704)

###### Features

- [cli] Add `--skip-config-validation` flag to preview, up, refresh, and destroy to skip validation of stack config against the project config schema [#23691](https://github.com/pulumi/pulumi/pull/23691)
- [cli] Enable automatic logging for every command by default [#23731](https://github.com/pulumi/pulumi/pull/23731)

###### Bug Fixes

- [cli] Don't ignore diffs in `Output` values [#23703](https://github.com/pulumi/pulumi/pull/23703)
- [cli] Use display resource type names in policy violation output [#23705](https://github.com/pulumi/pulumi/pull/23705)

###### Improvements

- [cli] Add `--output $format` flag to `pulumi stack {list,history,tag list}` [#23686](https://github.com/pulumi/pulumi/pull/23686)
- [cli] Add --output $format to `pulumi policy list` and `pulumi policy group list` [#23698](https://github.com/pulumi/pulumi/pull/23698)
- [cli] Add --output $format to `pulumi project list` [#23699](https://github.com/pulumi/pulumi/pull/23699)
- [cli] Add `--output $format` flag to `pulumi config env list` [#23706](https://github.com/pulumi/pulumi/pull/23706)
- [cli] `pulumi login` will warn if the given login differs from PULUMI_BACKEND_URL [#23716](https://github.com/pulumi/pulumi/pull/23716)
- [cli/convert] Error when converting a Terraform program to the `hcl` language [#23742](https://github.com/pulumi/pulumi/pull/23742)
- [cli/engine] Fix TestDebuggerAttach for dlv@1.27 [#23693](https://github.com/pulumi/pulumi/pull/23693)
- [cli/plugin] Add `--output $format` to `pulumi plugin list` [#23688](https://github.com/pulumi/pulumi/pull/23688)

###### Features

- [cli/policy] Add a `--file` flag to `pulumi policy analyze` to analyze a state file (as produced by `pulumi stack export`) without requiring a stack or backend login [#23664](https://github.com/pulumi/pulumi/pull/23664)

###### Miscellaneous

- [pkg/testing] Allow ProgramTest to use npm for Node.js tests [#23675](https://github.com/pulumi/pulumi/pull/23675)

###### Bug Fixes

- [programgen] Generate numeric `range` loops in NodeJS with a per-iteration binding so deferred applies in the loop body observe the correct index

###### Improvements

- [sdk] Update the dotnet and java language runtimes [#23755](https://github.com/pulumi/pulumi/pull/23755)

###### Bug Fixes

- [sdk/go] Fix FileArchive nested in an AssetArchive producing zip/tar entries with backslashes on Windows [#23750](https://github.com/pulumi/pulumi/pull/23750)

###### Improvements

- [sdk/go] Move provider RPC setup code to the sdk module [#23695](https://github.com/pulumi/pulumi/pull/23695)
- [sdk/nodejs] Use npm as the package manager for the Node.js SDK [#23655](https://github.com/pulumi/pulumi/pull/23655)
- [sdk/nodejs] Remove the `fdir` and `picomatch` dependencies; the Node.js SDK now requires Node.js 22 or later [#23722](https://github.com/pulumi/pulumi/pull/23722)

###### Bug Fixes

- [sdk/python] Fix `deletedWith` and `replaceWith` resource options in Python component resource providers [#23710](https://github.com/pulumi/pulumi/pull/23710)
- [sdkgen/python] Cache package references per-deployment in generated SDKs [#22459](https://github.com/pulumi/pulumi/pull/22459)

### v3.248.0

- Date: 2026-06-24
- Version: v3.248.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.248.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.248.0

- **fixed** — Fix a panic in pulumi package get-schema when binding a schema that references an uninstalled plugin
- **added** — Add options to pulumi stack get for parity with bare pulumi stack
- **added** — Add --output flag to about and whoami commands
- **added** — Add support for snippets, blocks of PCL kept in state to track ad-hoc resources
- **added** — Send the address of a schema loader service to resource providers as part of the provider handshake
- **added** — Send the address of a package resolver service to resource providers as part of the provider handshake
- **fixed** — Guard references to conditionally-created boolean range resources in generated Python and NodeJS programs so they type-check
- **fixed** — Generate map range resource collections as key-indexed maps in Python and NodeJS so they can be indexed by key
- **added** — Add Output.recover to catch and recover from exceptions in outputs
- **fixed** — Fix extra trailing new lines in comments
- **changed** — Require callers to pass an explicit schema loader when binding PCL programs and package schemas

##### 3.248.0 (2026-06-24)

###### Bug Fixes

- [cli] Fix a panic in `pulumi package get-schema` when binding a schema that references an uninstalled plugin [#23647](https://github.com/pulumi/pulumi/pull/23647)

###### Improvements

- [cli] Add options to `pulumi stack get` for parity with bare `pulumi stack` [#23623](https://github.com/pulumi/pulumi/pull/23623)
- [cli] Add `--output` flag to about and whoami commands [#23651](https://github.com/pulumi/pulumi/pull/23651)

###### Features

- [engine] Add support for 'snippets', blocks of PCL kept in state to track ad-hoc resources [#23286](https://github.com/pulumi/pulumi/pull/23286)
- [engine] Send the address of a schema loader service to resource providers as part of the provider handshake [#23645](https://github.com/pulumi/pulumi/pull/23645)
- [engine] Send the address of a package resolver service to resource providers as part of the provider handshake [#23654](https://github.com/pulumi/pulumi/pull/23654)

###### Bug Fixes

- [programgen] Guard references to conditionally-created (boolean `range`) resources in generated Python and NodeJS programs so they type-check [#23634](https://github.com/pulumi/pulumi/pull/23634)
- [programgen] Generate map `range` resource collections as key-indexed maps in Python and NodeJS so they can be indexed by key [#23639](https://github.com/pulumi/pulumi/pull/23639)

###### Features

- [sdk/nodejs] Add `Output.recover` to catch and recover from exceptions in outputs [#23642](https://github.com/pulumi/pulumi/pull/23642)

###### Bug Fixes

- [sdkgen] Fix extra trailing new lines in comments [#23619](https://github.com/pulumi/pulumi/pull/23619)

###### Improvements

- [sdkgen] Require callers to pass an explicit schema loader when binding PCL programs and package schemas [#23672](https://github.com/pulumi/pulumi/pull/23672)

### v3.247.0

- Date: 2026-06-18
- Version: v3.247.0
- Original notes: https://github.com/pulumi/pulumi/releases/tag/v3.247.0
- Permalink: https://whatsnew.fyi/product/pulumi/releases/v3.247.0

- **added** — Add --raw flag to pulumi config set to avoid stripping newlines when input is piped through stdin
- **added** — Add --provider flag to pulumi do to pull provider config to use from existing provider state
- **added** — Resource providers now receive the active login's API address and access token through PULUMI_API and PULUMI_ACCESS_TOKEN environment variables
- **added** — Add --disable-integrations flag to pulumi neo that runs the task with no integration credentials
- **added** — Send the address of a mapper service to resource providers as part of the provider handshake
- **added** — Support functions with multiArgumentInputs in Go program generation
- **added** — Support functions with multiArgumentInputs in Python program generation
- **added** — Registered resources can now be retrieved from the mock monitor for test assertions in Node.js SDK
- **added** — Add Output.recover to Python SDK to catch and recover from exceptions in outputs
- **added** — Add support for language agnostic cross references in schemas using the form {{% ref <target> %}}
- **added** — Add extension parameterization to the package schema model
- **added** — When credentials.json carries an OAuth refresh token, the CLI now auto-refreshes the access token on 401 and retries the request once instead of returning a login required error
- **changed** — Respect PULUMI_SKIP_CONFIRMATIONS whenever asking for confirmation
- **changed** — Use list and remove as the canonical names for list and remove commands, with ls and rm as aliases
- **changed** — Serve raw schema bytes from the engine's schema loader service instead of binding and re-marshaling the full schema on every request
- **changed** — The plugin.Host interface in Go SDK is now stateless with respect to workspaces; host methods that boot or resolve plugins take a plugin.Context carrying the workspace state
- **changed** — Allow running the postinstall script for local SDKs under npm 12 in Node.js SDK
- **changed** — Add register_package helper to Python SDK to cache package references per deployment
- **fixed** — Ensure pulumi logout clears the current tokenless backend in coding agent environments
- **fixed** — Read Git metadata correctly in repositories that enable the worktreeConfig extension, such as those hosted on Azure DevOps

##### 3.247.0 (2026-06-18)

###### Features

- [cli/config] Add --raw flag to `pulumi config set` to avoid stripping newlines when input is piped through stdin [#23593](https://github.com/pulumi/pulumi/pull/23593)
- [cli/do] Add `--provider` flag to pull provider config to use from existing provider state [#23560](https://github.com/pulumi/pulumi/pull/23560)
- [cli/engine] Resource providers now receive the active login's API address and access token through PULUMI_API and PULUMI_ACCESS_TOKEN [#23589](https://github.com/pulumi/pulumi/pull/23589)
- [cli/neo] Add a `--disable-integrations` flag to `pulumi neo` that runs the task with no integration credentials [#23531](https://github.com/pulumi/pulumi/pull/23531)
- [engine] Send the address of a mapper service to resource providers as part of the provider handshake
- [programgen/go] Support functions with multiArgumentInputs [#23554](https://github.com/pulumi/pulumi/pull/23554)
- [programgen/python] Support functions with multiArgumentInputs [#23574](https://github.com/pulumi/pulumi/pull/23574)
- [sdk/nodejs] Registered resources can now be retrieved from the mock monitor for test assertions [#20539](https://github.com/pulumi/pulumi/pull/20539)
- [sdk/python] Add `Output.recover` to catch and recover from exceptions in outputs [#23591](https://github.com/pulumi/pulumi/pull/23591)
- [sdkgen] Adds support for language agnostic cross references in schemas. Use the form `{{% ref <target> %}}` to reference other schema components in markdown descriptions. Such as `{{% ref [#21369](https://github.com/pulumi/pulumi/pull/21369)
- [sdkgen] Add extension parameterization to the package schema model [#23536](https://github.com/pulumi/pulumi/pull/23536)
- [sdkgen/go] Support functions with multiArgumentInputs [#23554](https://github.com/pulumi/pulumi/pull/23554)
- [sdkgen/python] Support functions with multiArgumentInputs [#23574](https://github.com/pulumi/pulumi/pull/23574)
- [cli/auth] When `credentials.json` carries an OAuth refresh token, the CLI now auto-refreshes the access token on 401 and retries the request once, instead of returning a "login required" error [#23430](https://github.com/pulumi/pulumi/pull/23430)

###### Improvements

- [cli] Respect PULUMI_SKIP_CONFIRMATIONS whenever we ask for confirmation [#23607](https://github.com/pulumi/pulumi/pull/23607)
- [cli] Use list and remove as the canonical names for list/remove commands, with ls and rm as aliases [#23608](https://github.com/pulumi/pulumi/pull/23608)
- [docs] Generate redirects for command aliases [#23610](https://github.com/pulumi/pulumi/pull/23610)
- [engine] Serve raw schema bytes from the engine's schema loader service instead of binding and re-marshaling the full schema on every request [#23551](https://github.com/pulumi/pulumi/pull/23551)
- [sdk/go] The `plugin.Host` interface is now stateless with respect to workspaces; host methods that boot or resolve plugins take a `plugin.Context` carrying the workspace state, and closing a `plugin.Context` no longer closes a host that was passed in to its constructor [#23508](https://github.com/pulumi/pulumi/pull/23508)
- [sdk/nodejs] Allow running the postinstall script for local SDKs under npm 12 [#23568](https://github.com/pulumi/pulumi/pull/23568)
- [sdk/python] Add register_package helper to cache package references per deployment [#22459](https://github.com/pulumi/pulumi/pull/22459)

###### Bug Fixes

- [cli] Ensure `pulumi logout` clears the current tokenless backend in coding agent environments [#23540](https://github.com/pulumi/pulumi/pull/23540)
- [cli] Read Git metadata correctly in repositories that enable the worktreeConfig extension, such as those hosted on Azure DevOps [#23535](https://github.com/pulumi/pulumi/pull/23535)
- [cli/display] Show interrupted steps as interrupted instead of as finished [#23510](https://github.com/pulumi/pulumi/pull/23510)
- [cli/plugin] Allow plugin tarballs containing symlinks [#23587](https://gi

_[Truncated at 4000 characters — full notes: https://github.com/pulumi/pulumi/releases/tag/v3.247.0]_