Release history
pulumi releases
Pulumi - Infrastructure as Code in any programming language
All releases
32 shown
JSON outputs + schedule/webhook/drift/audit-policy/Insights features
- Add `pulumi package new` command to bootstrap a Pulumi package from a template
- Include running command name and detected AI agent in User-Agent header on Pulumi Cloud API requests
- Include `result` field on the summary engine event
Full changelog
3.237.0 (2026-05-08)
Features
-
[cli] Include the running command name and detected AI agent (when present) in the User-Agent header on Pulumi Cloud API requests
#22908 -
[engine] Include
resulton the summary engine event
#22883 -
[sdkgen] Eagerly error on schemas with unconstructable types
#22890 -
[cli/cloud] Auto-fill
langandosquery parameters onpulumi cloud apiGET/HEAD requests when the matched OpenAPI operation declares them and the caller hasn't supplied them
#22726 -
[cli/package] Add
pulumi package newto bootstrap a Pulumi package from a template
#22837
Bug Fixes
-
[cli] Add blank-line gaps between
pulumi neoTUI conversation blocks
#22846 -
[cli/import] Preserve
__-prefixed keys when generating PCL for imported resource state, so provider-defined payloads round-trip correctly
#22856 -
[cli/neo] Render
ux__ask_userclarifying questions as questions instead of approval prompts
#22862 -
[cli/neo] Fix a panic when cancelling a
pulumi neosession
#22898 -
[cli/neo] Render every assistant message in the TUI scrollback so multi-turn commentary no longer disappears between tool calls
-
[cli/neo] Return the bare stack name and canonical project name from
pulumi_previewandpulumi_uptool results instead of echoing the raw input
#22891 -
[codegen/pcl] Stop reporting spurious circular references when an
ignoreChanges,hideDiffs,replaceOnChanges, oradditionalSecretOutputsentry shares a name with a top-level node
#22916 -
[programgen/pcl] Fix PCL binder panic when a conditional mixes a Promise-typed branch with a try() branch
#22907 -
[sdk/python] Support
NotRequired,Requiredandtotal=Falsein TypedDicts for component resource arg types
#22858
Miscellaneous
- `pulumi logs decrypt` command to view decrypted log entries
- Bundle the `hcl` language host in the CLI
- Automatic installation of the HCL converter for `pulumi convert --from hcl`
Full changelog
3.235.0 (2026-05-05)
Features
-
[cli] Add
pulumi logs decryptcommand for viewing logs
#22523 -
[cli] Bundle the
hcllanguage host (from pulumi-labs/pulumi-hcl)
#22807 -
[cli] Automatically install the
hclconverter from pulumi-labs/pulumi-hcl when runningpulumi convert --from hcl
#22816 -
[pcl] Add
readblocks to PCL to read resources via ID and query instead of registering them
#22641 -
[cli/cloud] Add
pulumi cloud api <op-or-path>for calling any Pulumi Cloud API
endpoint, with--field/--header/--input/--bodyflag handling, path
template binding, content negotiation via--format, and--dry-run -
[cli/cloud] Add
--paginatetopulumi cloud api: follow continuation cursors,
accumulate items into a single JSON envelope, and surface progress
events to stderr with--emit-events(page, complete, truncated,
partial_failure, cancelled).
Bug Fixes
-
[cli] Fix the
pulumi neoshell tool to honor the agent-suppliedtimeoutand to terminate the whole process tree (and unblock cmd.Wait) when the deadline fires, so commands likekubectl logs -fno longer hang Neo indefinitely.
#22820 -
[cli] Surface the error and exit when
pulumi neofails to create the underlying task, instead of leaving the TUI stuck inThinking…
#22825 -
[codegen/go] Correctly generate
[]pulumi.Asset&[]pulumi.Archive
#22827 -
[cli/neo] Exit cleanly when the user presses Ctrl+C twice in
pulumi neoinstead of hanging until a third press
#22821 -
[engine] The engine now caches schemas at
PULUMI_HOME/schemas, and will cache for parameterised packages as well
#22812 -
[sdk-python] Preserve
__-prefixed keys (e.g.__typediscriminators) across RPC deserialization, matching the behavior of the other language SDKs
#22834 -
[programgen/{nodejs,python}] Fix programgen to emit the right
lengthcheck for string length
#22802
Miscellaneous
- [cli] Replace the Pulumipus mascot in the
pulumi neowelcome banner with new Neo-branded ASCII art.
#22817
- `pulumi cloud api describe` to inspect parameters, request body, and response schema of any Pulumi Cloud API operation (text/markdown/JSON output)
- `pulumi cloud api list` to browse all endpoints in the Pulumi Cloud OpenAPI spec (table/JSON output)
Full changelog
3.234.0 (2026-05-01)
Features
-
[cli/cloud] Add
pulumi cloud api describefor inspecting the parameters, request
body, and response schema of any Pulumi Cloud API operation, with
text, markdown, and JSON output -
[cli/cloud] Add
pulumi cloud api listfor browsing every endpoint exposed by the Pulumi
Cloud OpenAPI spec, with table and JSON output
Bug Fixes
- [engine] Revert changes to property path parsing that resulted in errors for currently valid paths
- Expose auto‑generated Pulumi CLI interface as `workspace.cli_api` for Python
- Add encrypted logging to ~/.pulumi/logs controlled by PULUMI_ENABLE_AUTOMATIC_LOGGING
Full changelog
3.233.0 (2026-04-30)
Features
-
[auto/python] Expose the auto-generated Pulumi CLI interface as
workspace.cli_api
#22638 -
[cli] Add encrypted logging to ~/.pulumi/logs; use the PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on
#22494 -
[cli] Implement the
filesystem__grepandfilesystem__content_replacelocal tools
forpulumi neo.grepruns a regex search across files in the project root
with an optionalincludeglob filter and returns results inpath:lineno: line
form.content_replaceperforms a literal multi-file search-and-replace with a
file_patternglob anddry_runpreview mode. Both tools skip binary files,
hidden directories, andnode_modules, and reject paths outside the project
root. Their input schemas match the cloud-side tool definitions. -
[cli] Add
pulumi_previewandpulumi_upas local tools for the experimentalpulumi neo
agent. The Neo TUI renders a persistent bordered block for each operation that
streams changed resources and diagnostics as the engine runs and finalizes with a
summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL. -
[engine] Add
Listto the provider protocol and schema
#22693
Bug Fixes
-
[engine] Return a clear error when two installed plugins claim the same default provider package name (for example, a native
scalewayprovider alongside aterraform-providerbridge parameterized asscaleway) instead of panicking with "Should not have seen an older plugin if sorting is correct!"
#22679 -
[programgen] Do not wrap a
call(...)on a method whose return type is marked plain in an Output. Previously
PCL bound every method call's return type asOutput<T>, which caused downstream program-gen
to emit broken.apply(...)/.ApplyT(...)traversals against plain struct returns (e.g.
methods withliftSingleValueMethodReturns=trueorReturnTypePlain=true). -
[backend/diy] When using a backend url containing creds (e.g. PostgreSQL conn string), mask user:pass as in lock-related error messages
#22701 -
[codegen/go] Generate unqualified
Providerreferences for the package's own provider resource. Previously
the Go codegen always emitted<pkg>.Providereven when the reference appeared inside<pkg>
itself, producing identifiers that would not compile. Affects generated code for method return
types (and other schema positions) that referencepulumi:providers:<pkg>. -
[codegen/nodejs] Generate unqualified
Providerreferences for the package's own provider resource when emitting
TypeScript code inside that package. Previously the generator always qualified the name as
<pkg>.Provider, which does not resolve when no<pkg>namespace import is in scope. -
[codegen/nodejs] Import the correct class name for a provider resource. Imports for
pulumi:providers:<pkg>used
the title-cased package name instead ofProvider, producing a phantom identifier that clashed
with the containing package's component/resource classes. -
[programgen/nodejs] Emit
awaitforcall(...)invocations of methods whose return type is marked plain, and
force the generated program into an asyncexport = async () => ...wrapper whenever such a
call is present. The Node SDK returnsPromise<T>for plain methods; previously program-gen
used the result directly, which did not match its runtime type. -
[codegen/python] Avoid a self-import (
import pulumi_<pkg>insidepulumi_<pkg>/<module>.py) when referencing
the package's own provider resource. Python referenced the Provider aspulumi_<pkg>.Provider
even inside that package, which caused a circular import at runtime. -
[sdk/python] Reduce internal
Output[T]data to a singleasyncio.Future
#22661 -
[sdkgen/{nodejs,python}] Generate optional input types that accept undefined/None values
#22552
Miscellaneous
- [auto/go] Drop the "With" prefix from generated option helpers so they match the naming of the existing optXxx packages
#22682
- Switch logging library from glog to slog; any if logging.V(x) must change to if logging.V(x).Enabled()
- Experimental pulumi neo command with local tool execution
- Neo terminal UI with agent messages and streaming
- Plan-mode toggle for Neo exploration without file changes
Full changelog
3.232.0 (2026-04-22)
Features
-
[cli] Add an experimental
pulumi neocommand that creates a Pulumi Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell tool calls
issued by the agent run on the user's machine in their working directory; the
interactive chat continues to happen in the Pulumi Console at the URL the command
prints. Hidden behind PULUMI_EXPERIMENTAL. -
[cli] Add support for handling user approval requests in the
pulumi neoterminal UI.
When the agent requests confirmation for a sensitive action, the TUI prompts the
user and forwards their response back to the Pulumi Console. Hidden behind
PULUMI_EXPERIMENTAL. -
[cli] Add an interactive terminal UI for
pulumi neobuilt with bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal alongside the
Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL. -
[cli] Switch logging library from glog to slog.
BREAKING: any if logging.V(x) { need to be changed to if logging.V(x).Enabled()
-
[cli] Add a plan-mode toggle to the
pulumi neoTUI, bound to Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
runningpulumi up, or opening PRs, and surfaces an approved plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
plan mode automatically. -
[cli] The
pulumi neoTUI now drives its "thinking" spinner off a single declarative
rule (the spinner stays on until a final event — final assistant message, approval
request, cancellation, or error — lands), so the indicator no longer flickers off
when the agent hands off tool calls to the CLI or when streaming text arrives
between tools. PressEscduring a turn to ask the agent to cancel; the label
switches to "Cancelling..." until the backend acknowledges. -
[cli]
pulumi neonow executes theeditfilesystem tool locally, matching the schema
and response wording of the upstream mcp-claude-code tool so the agent sees
identical output whether the call ran on Cloud or CLI.editperforms exact-string
replacement with occurrence-count validation, and creates a new file when the
target is missing andold_stringis empty.
Bug Fixes
-
[cli] Render user messages in the
pulumi neoTUI as soon as they're submitted
instead of waiting for the Pulumi Cloud event stream to echo them back.
The initial prompt passed on the command line also appears in the
transcript at startup. Self-echoes from the server are de-duplicated;
user input that originated from another client (e.g. the web UI on the
same task) still renders. -
[cli] Wrap warnings, errors, and user-message bubbles to the terminal width in the
pulumi neoTUI. Previously these blocks rendered as single long lines that
were clipped at the right edge of the viewport. On resize, all width-dependent
transcript blocks (user messages, warnings, errors, assistant messages) now
reflow to the new terminal width. -
[cli/policy] Fix
policy lsto use the default org name, not username
#22656 -
[engine] Fix provider registry race condition in parallel delete-before-replace
#21487 -
[engine] Signal providers to cancel before closing them during replacement
-
[sdkgen] Error on 'id' in state inputs
#22636 -
[programgen/python] Add necessary casts between types in generated programs
#22567 -
[sdkgen/go] Fix caching of package references to be per-deployment not per-process
#22170
Miscellaneous
-
[java] Upgrade java to v1.25.0
#22673 -
[auto/go] Generate command methods for the Go Automation API codegen
#22612 -
[sdk] Clarify docs on the
remoteparameter ofComponentResource/Resourcein the Node and Python SDKs
#22603 -
[sdk/dotnet] Upgrade dotnet to v3.103.1
#22676 -
[yaml] Upgrade yaml to v1.32.0
#22674
- Auto-detect Mercurial repository metadata for `pulumi up` and `pulumi preview` operations
- Resource hooks with decorator variants for Node.js and Python SDKs
- New Automation API commands: `new` and `--diff` flag for destroy operations
- Detect AI agents and send in update metadata
- Add Cancel handler to Python & Node.js providers
- Add ESC environment resolution for policy packs
- Add a new policy analyze command to run a policy pack against existing state
- Support parameterized providers in PCL
- Add --urns flag to display full resource URNs instead of short names
- Add grpcs:// support and header authentication to OTLP exporter
- Don't apply the secrets filter to true and false
- Allow pulumi state delete to accept multiple resource URNs
- Auto-install missing policy analyzer plugins
- Add support for running policy packs with bun
- Add Python lock file detection for toolchain selection
- Support bun as a runtime
- Add debugger support for the bun runtime
- Add support for Bun as a plugin runtime
- Enable journaling by default
- The engine now handles the inheritance of the provider option in resource registrations
- Automatically make invoke outputs secret when there is a secret input
- Add zstd compression option for DIY backend state files
- Automatically make invoke outputs secret when there is a secret input
- Call request generation for programgen/go
Full changelog
- Rename pulumiVersionRange to requiredPulumiVersion in PulumiPlugin.yaml
- Deprecate github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen
- Add policy install command
- Add support for protobuf 6
- Add support for the OnError resource hook
- Add support for the OnError resource hook
- Add support for the OnError resource hook
- Add the OnError resource hook to allow for custom retry policies
- Add requirePulumiVersion to the Node.js SDK
- Add require_pulumi_version to the Python SDK
- Default to Pulumi Cloud when using an OIDC token for login
- Allow dynamic providers to return inputs from read() for accurate diffs after refresh
- Add support for serializing async generators
- Allow plugins to specify a supported version range for the CLI