Pulumi v3.274.0
+++++++++++*******
Pulumi v3.274.0 adds new pulumi policy and stack policy commands for listing, issuing, editing and exporting policy groups, packs and issues, with JSON output options. It also adds resourceExists generation for Go and Python SDKs and automation API commands for schema, org usage, API and audit logs. The release lists 27 added and 17 fixed changes, including a fix for OIDC backend URL normalization and a fix for stack init leaving an empty stack when the copy-config source is missing.
What changes for platform teams
Platform teams using Pulumi policy packs can list, filter and export policy issues and see which policies apply to a stack from the CLI. Teams that drive Pulumi through automation APIs gain org audit-log and usage commands, and AI agents are pointed at the policy commands instead of raw API calls.
Changes
- [cli/policy] Add pulumi policy get to show a policy pack's policiesadded
- [cli/policy] Add --output json to pulumi policy publish, enable, disable, rm and validate-config, and print the updated policy group after enable and disableadded
- [cli/policy] Add --stack-rule and --account-rule to pulumi policy group new and edit, and show match rules in policy group console outputadded
- [cli/policy] Add pulumi stack policy ls to list the policy groups and policy packs that apply to a stackadded
- [auto] Add schema commands to the generated automation APIs for NodeJS, Python and Goadded
- [auto] Add org usage commands to the generated automation APIs for NodeJS, Python and Goadded
- [auto] Add api commands to the generated automation APIs for NodeJS, Python and Goadded
- [auto] Add org audit-log commands to the generated automation APIs for NodeJS, Python and Goadded
- [cli/policy] Add pulumi policy issue edit to set the status, priority and assignee of a policy issueadded
- [cli/policy] Add filter and sort flags to pulumi policy issue ls, and add pulumi policy issue exportadded
- [sdkgen/go] Generate <Resource>Exists functions that check whether a resource with a given ID exists without adopting it into the stackadded
- [programgen/go] Support resourceExists in generated Go programsadded
32 more lines
- [sdkgen/python] Generate static exists methods that check whether a resource with a given ID exists without adopting it into the stackadded
- [programgen/python] Support resourceExists in generated Python programsadded
- [cli/policy] Show each group's mode and Insights account count in pulumi policy group ls, including new mode and numAccounts keys in its JSON outputadded
- [cli/policy] Point agents to pulumi policy group get, pulumi stack policy ls and pulumi policy issue ls after pulumi policy group lsadded
- [cli] Add credentials helpers for backend selection, HTTP authentication, and cloud credentialsadded
- [cli] Point AI agents that call policy endpoints through pulumi api to the matching pulumi policy commandadded
- [cli/policy] Add --closed to pulumi policy issue ls, and show priority, assignee, policy group and policy remediation details in pulumi policy issue getadded
- [sdkgen] Reject schema property names that contain no ASCII letters, and warn on property names that collide after reduction to lower-case ASCII letters and digitsadded
- [sdk/go] Take the ID passed to Context.ExistsResource as a StringInput, since it is an import ID rather than a resource IDadded
- [sdk/go] Add config.Value.ToCoercedObject, which returns a value with the typing Map.Set applies below the top level of a --path keyadded
- [cli] Highlight backtick-quoted commands in CLI error messagesadded
- [cli] Make pulumi import --preview-only emit the generated resource codeadded
- [engine] Add a uses_output_values flag on RegisterResourceRequest so SDKs can carry per-leaf dependency information inline as OutputValues instead of filling in a flat propertyDependencies mapadded
- [engine] Stop folding per-property dependencies into a resource's top-level Dependencies list after transforms run — Dependencies now reflects only the user's explicit depends_on, matching the behaviour already used for resources without transformsadded
- [cli/policy] Return the full response from pulumi policy issue get --output json, with the issue under policyIssueadded
- [cli] Normalize backend URLs when logging in with OIDCfixed
- [sdk/python] Explain how to install missing Python dependencies when uv package discovery requires packagingfixed
- [sdk/nodejs] Restrict @opentelemetry/api to 1.9.x so package managers such as bun and pnpm no longer install 1.10.0, which the OpenTelemetry SDK 2.x packages do not supportfixed
- [cli] Document PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER as the fix for secret decryption errors when running from a workspace without local stack configuration, such as the Automation API or a saved update plan applied from a different directoryfixed
- [cli/stack] Load the --copy-config-from stack before pulumi stack init creates the new stack, so a source stack that does not exist no longer leaves an empty stack behindfixed
- [cli/config] Write block-style YAML when a CLI edit adds the first entry to an empty {} mapping in a stack or project file, instead of keeping the mapping on one line, as pulumi env set doesfixed
- [cli] Report that Pulumi ESC requires Pulumi Cloud before attempting login on DIY backendsfixed
- [engine] Preserve snapshot integrity when a protected resource has multiple pending-delete copies of its parentfixed
- [pcl] Send the parent, version and pluginDownloadUrl invoke options to the enginefixed
- [pcl] Fix hideDiffs to resolve both resource input and output propertiesfixed
- [engine] Use the explicit provider of a custom parent for an invoke that sets no providerfixed
- [cli/env] Show only environment change requests in pulumi env change-request commandsfixed
- [pcl] Report a diagnostic instead of panicking when a block that requires labels has nonefixed
- [engine] Fix invokes and calls of extension packagesfixed
- [sdk/python] Select the provider for pulumi.runtime.exists_resource from its options and parent when no resource is givenfixed
- [sdk/python] Fix RecursionError after creating many dynamic resources in one processfixed
- [cli] Print a message when the CLI downloads a language runtimefixed
4 maintenance lines (dependency bumps, CI, tests, docs)
- [sdk/dotnet] Upgrade dotnet to v3.117.0maintenance
- [yaml] Upgrade yaml to v1.38.16maintenance
- [hcl] Upgrade hcl to v0.19.1maintenance
- [java] Upgrade java to v1.39.0maintenance
48 lines27 added17 fixed4 maintenancetyped from the source notes
Full release notes ↗ · all Pulumi releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules