This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+10 more
Summary
AI summaryBroad release touches Bug Fixes, 3.252.0, Miscellaneous, and https://github.com/pulumi/pulumi/pull/23802.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Add `import` to generated automation APIs for NodeJS, Python and Go. Add `import` to generated automation APIs for NodeJS, Python and Go. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Low |
Improve error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud. Improve error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Low |
Show command name for CLI commands when listing logs. Show command name for CLI commands when listing logs. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Low |
Render non-UTF8 byte strings as b"<base64>" in diffs and JSON output. Render non-UTF8 byte strings as b"<base64>" in diffs and JSON output. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Low |
Add `--reason` flag to `pulumi env open-request` for request explanation. Add `--reason` flag to `pulumi env open-request` for request explanation. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Low |
Improve error message when a resource URN is not found in state, suggesting close matches and listing commands. Improve error message when a resource URN is not found in state, suggesting close matches and listing commands. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Low |
Allow binding hooks to a resource's `onError` option. Allow binding hooks to a resource's `onError` option. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Low |
Add a `production` runtime option for Node.js projects to skip devDependencies during install. Add a `production` runtime option for Node.js projects to skip devDependencies during install. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Performance | Low |
Deduplicate identical apply arguments in generated code to avoid unnecessary Promise.all/pulumi.all/Output.All. Deduplicate identical apply arguments in generated code to avoid unnecessary Promise.all/pulumi.all/Output.All. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Medium |
Exit with non‑zero code when CLI command group receives unknown or no subcommand. Exit with non‑zero code when CLI command group receives unknown or no subcommand. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Fix panic when displaying a stack‑level policy violation. Fix panic when displaying a stack‑level policy violation. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Low |
Make reading non-secret stack outputs and running `pulumi about` no longer require the passphrase for passphrase‑encrypted stacks. Make reading non-secret stack outputs and running `pulumi about` no longer require the passphrase for passphrase‑encrypted stacks. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Avoid `pulumi logs <command>` showing the log for the currently running command. Avoid `pulumi logs <command>` showing the log for the currently running command. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Fix calling delete on PF resources that need read called first. Fix calling delete on PF resources that need read called first. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Submit the change request created by `pulumi env open-request` so it is pending approval instead of being left as an unsubmitted draft. Submit the change request created by `pulumi env open-request` so it is pending approval instead of being left as an unsubmitted draft. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Fix the initial prompt sometimes rendering above the welcome banner in `pulumi neo`. Fix the initial prompt sometimes rendering above the welcome banner in `pulumi neo`. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Fix importing a resource whose import identifier differs from its canonical ID to prevent deletion on subsequent update. Fix importing a resource whose import identifier differs from its canonical ID to prevent deletion on subsequent update. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Failed resource registrations will return faulted outputs, not unknown outputs. Failed resource registrations will return faulted outputs, not unknown outputs. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
| Bugfix | Low |
Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages. Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages. Source: granite4.1:30b@2026-07-14-audit Confidence: low |
— |
Full changelog
3.252.0 (2026-07-13)
Features
- [auto] Add
importto the generated automation APIs for NodeJS, Python and Go #23876 - [cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud #23811
- [cli] Show command name for cli commands when running any command that lists logs #23889
- [cli/display] Render strings containing non-UTF8 bytes as b"" in diffs and JSON output #23870
- [cli/env] Add a
--reasonflag topulumi env open-requestto explain the request to approvers #23802 - [cli/state] Improve the error message when a resource URN is not found in the state for
pulumi statecommands, suggesting close-matching URNs and how to list the URNs in the stack #23812 - [pcl] Allow binding hooks to a resource's
onErroroption #23838 - [sdk/nodejs] Add a
productionruntime option for Node.js projects. When set totrueinPulumi.yaml,pulumi installskipsdevDependencies(npm--production, pnpm--production, yarn--production). #23849
Bug Fixes
- [cli] Exit with a non-zero code when a command group such as
pulumi envis given an unknown subcommand or no subcommand at all #23814 - [cli] Fix a panic when displaying a stack-level policy violation #23692
- [cli] Make reading non-secret stack outputs and running
pulumi aboutno longer require the passphrase for passphrase-encrypted stacks #23820 - [cli] Avoid
pulumi logs <command>showing the log for the currently running command #23887 - [cli/do] Fix calling delete on PF resources that need read called first #23837
- [cli/env] Submit the change request created by
pulumi env open-requestso it is pending approval instead of being left as an unsubmitted draft #23802 - [cli/neo] Fix the initial prompt sometimes rendering above the welcome banner in
pulumi neo#23831 - [engine] Fix importing a resource whose import identifier differs from its canonical ID causes the resource to be deleted on a subsequent update #23834
- [programgen] Deduplicate identical apply arguments to avoid unnecessary Promise.all/pulumi.all/Output.All in generated code #22293
- [sdk] Failed resource registrations will return faulted outputs, not unknown outputs #23844
- [sdk/nodejs] Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages #23866
Miscellaneous
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v3.245.0 Remove "name" from plugin loading functions and require "Type" on Configure & DiffConfig calls in Go SDK.
- v3.245.0 Rename `pulumi stack init` command to `new`.
- v3.238.0 `--format` flag renamed to `--output` on `pulumi api` and subcommands.
- v3.238.0 `pulumi cloud api` renamed to `pulumi api`.
Beta — feedback welcome: [email protected]