This release includes 1 breaking change for platform teams planning a safe upgrade.
Published 25d
Infrastructure as Code
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
aws
azure
cloud
cloud-computing
containers
c#
+10 more
.net
fsharp
gcp
go
iac
javascript
kubernetes
python
serverless
typescript
Summary
AI summaryBroad release touches Bug Fixes, Miscellaneous, 3.249.0, and 2026-07-01.
Full changelog
3.249.0 (2026-07-01)
Bug Fixes
- [backend/diy] Fix
pulumi stack tag rmnot removing the last tag on self-managed (diy) backends #23702 - [backend/service] Don't fail a operation due to a logging failure #23704
Features
- [cli] Add
--skip-config-validationflag to preview, up, refresh, and destroy to skip validation of stack config against the project config schema #23691 - [cli] Enable automatic logging for every command by default #23731
Bug Fixes
- [cli] Don't ignore diffs in
Outputvalues #23703 - [cli] Use display resource type names in policy violation output #23705
Improvements
- [cli] Add
--output $formatflag topulumi stack {list,history,tag list}#23686 - [cli] Add --output $format to
pulumi policy listandpulumi policy group list#23698 - [cli] Add --output $format to
pulumi project list#23699 - [cli] Add
--output $formatflag topulumi config env list#23706 - [cli]
pulumi loginwill warn if the given login differs from PULUMI_BACKEND_URL #23716 - [cli/convert] Error when converting a Terraform program to the
hcllanguage #23742 - [cli/engine] Fix TestDebuggerAttach for [email protected] #23693
- [cli/plugin] Add
--output $formattopulumi plugin list#23688
Features
- [cli/policy] Add a
--fileflag topulumi policy analyzeto analyze a state file (as produced bypulumi stack export) without requiring a stack or backend login #23664
Miscellaneous
- [pkg/testing] Allow ProgramTest to use npm for Node.js tests #23675
Bug Fixes
- [programgen] Generate numeric
rangeloops in NodeJS with a per-iteration binding so deferred applies in the loop body observe the correct index
Improvements
- [sdk] Update the dotnet and java language runtimes #23755
Bug Fixes
- [sdk/go] Fix FileArchive nested in an AssetArchive producing zip/tar entries with backslashes on Windows #23750
Improvements
- [sdk/go] Move provider RPC setup code to the sdk module #23695
- [sdk/nodejs] Use npm as the package manager for the Node.js SDK #23655
- [sdk/nodejs] Remove the
fdirandpicomatchdependencies; the Node.js SDK now requires Node.js 22 or later #23722
Bug Fixes
Breaking Changes
- Node.js SDK now requires Node.js 22 or later (removal of fdir and picomatch dependencies)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v3.245.0 Remove "name" from plugin loading functions and require "Type" on Configure & DiffConfig calls in Go SDK.
- v3.245.0 Rename `pulumi stack init` command to `new`.
- v3.238.0 `--format` flag renamed to `--output` on `pulumi api` and subcommands.
- v3.238.0 `pulumi cloud api` renamed to `pulumi api`.
Beta — feedback welcome: [email protected]