npx @buildinternet/releases get pulumiShipped OIDC token issuance for arbitrary services in Pulumi ESC and a breaking Google Cloud provider major.
ESC now mints OIDC tokens for services beyond your cloud. The fn::open::oidc provider signs a short-lived token for an audience you choose, and the service named in that audience verifies the signature and exchanges it for its own credential. That replaces long-lived API keys for package registries, AI platforms, and workload access platforms.
Google Cloud provider v10 is a breaking major. It rebases on terraform-provider-google v8, and a migration guide covers every breaking change. Neo or a coding agent can run the provider-upgrade skill to move stacks over.
ESC Approvals allows simultaneous change requests. Multiple people can propose changes to the same environment at once — a credential rotation and a feature flag addition each go through their own review, rather than one open request blocking everyone else.
AWS IAM account access manager is manageable as code. The accountaccess resources ship in the AWS provider (v7.45.0 and later) and AWS Native (v1.75.0 and later), with SDKs for TypeScript, Python, Go, C#, Java, HCL, and YAML.
Automation APIs gained convert, refresh, about, and config. The engine also negotiates OutputValues on Call, and the Go, Node.js, and Python SDKs can check whether a resource exists without adopting it into a stack.
Neo agent tasks survive runtime restarts. Workspace snapshots keep generated files, dependency state, local commits, and scratch output recoverable mid-task. Component state migrations, which let a component ship its own upgrade path, reached Python, Go, and Node.js resource options plus Pulumi Cloud updates.
Fixed pulumi env edit, env set, env rm and env provider overwriting changes made after they read the environment; on a conflict, env edit reopens the editor with your edits and the current definition while the others fail. pulumi stack drift status now reports an unknown drift status when drift detection has never run.
Guide explains running Pulumi Neo inside a Docker Sandbox microVM that reaches only allowed files and hosts, with the Pulumi token injected by a proxy so Neo never holds the real credential, plus Pulumi approval and permission modes as a second layer.
A new fn::open::oidc provider lets a Pulumi ESC environment mint a short-lived OpenID Connect token for any service that accepts one, replacing long-lived stored API keys with credentials that expire within the hour. Tokens are signed by Pulumi, carry configurable audience and duration, and ESC stores nothing.
New runtime functions in the Go, Node.js, and Python SDKs check whether a resource with a given ID exists without adopting it into the stack, and the generated automation APIs gain convert, refresh, about, and config commands. Secrets carried on output values are now redacted in plaintext log output and pulumi logs share, and pulumi logs and pulumi watch now error by default ahead of their removal.
Pulumi AWS provider v7.45.0 and AWS Native v1.75.0 add accountaccess resources (aws.accountaccess.Application and aws.accountaccess.Entitlement) for managing AWS IAM account access manager as code, with SDKs for TypeScript, Python, Go, C#, Java, HCL, and YAML. The post walks through defining roles, applications, and entitlements, and notes that AAM roles must be created by you rather than provisioned automatically like permission sets.
The engine now negotiates OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, gated by a new accepts_outputs_in_invoke handshake capability. Also fixed plugin checksum verification rejecting valid downloads over HTTP/1.1 and a plugin process leak when the schema loader boots a plugin that runs in a language host.
Environments with approvals enabled can now have multiple open change requests at once, where previously only one was allowed and teammates were blocked. If another change request is applied first, a change request based on an older revision can be updated via a 3-way merge, with conflicts shown line-by-line in the console. Available in Pulumi Cloud on Pro and Enterprise editions.
Pulumi's Google Cloud provider v10.0.0 is a major release based on terraform-provider-google v8, shipping with a migration guide covering every breaking change. Upgrades can be automated via the provider-upgrade skill in Pulumi Neo or coding agents, which scan stacks for affected resources and pause before replacing or deleting live infrastructure.
Fixed concurrent pulumi new runs failing to clone the templates repository, and pulumi install for Python plugins and policy packs using the uv toolchain with a [build-system] table.
Go and Python SDKs now use an explicit provider for resources from an extension package instead of falling back to a default provider, and the Go SDK removed workspace.Credentials.AccessTokens, reading stored logins only from the accounts object of credentials.json. Also improved pulumi neo tool results with console URL and update identifiers.
Pulumi demonstrates GeoDeploy, an app that combines TypeSafe's Jev decision primitives with the Pulumi Automation API to pick AWS, Azure, or Google Cloud regions for managed Kubernetes and provision them. Jev only selects from closed sets of pre-priced region IDs using choice() and noul() calls, so it never generates code, does arithmetic, or invents region names.
An open source pass-through proxy asks TypeSafe AI's Jev System One model which Claude model each new message needs, forwarding to Haiku 4.5, Sonnet 5, or Opus 5.5 and only re-deciding when the user writes a message so prompt caches survive. Tool steps and subagents keep their tier, background calls go to Haiku 4.5, and Jev's answers act as advice since guard questions and hard rules in code can only raise the tier.
The new pulumi logout --all --delete-credentials-key flag removes the key that encrypts stored credentials from the OS credential store, and encrypted credentials in other PULUMI_HOME directories stay readable after a logout --all or login. Fixed a PCL panic when indexing a tuple literal with an index equal to its length, a binder panic on nested tuple literals of different shapes, and Node.js closure serialization for __importStar-wrapped cached modules.
Pulumi explains how Neo achieves workspace continuity for long-running agent tasks by replacing Git-based repository reconstruction with Kopia, an open source backup tool that creates encrypted, incremental, content-addressed snapshots on generic object storage. The design splits a control plane that authorizes recovery and mints task-scoped credentials from a data plane where the runtime restores and checkpoints its workspace directly, with per-task storage prefixes and repository passwords as the multi-tenant security boundary.
New component state migrations let Pulumi component authors ship an upgrade path with the component itself, translating the saved state of a component and its children before Pulumi works out which resources need to change, so components like AWSX VPC can change internal design without replacing running infrastructure. The state migrations API is experimental and may change.
Component state migration callbacks are now available in the Python, Go, and Node.js resource options, with Pulumi Cloud updates enabling component state migrations via journal v2. Also fixed plugin discovery from the current uv workspace member's dependencies, a PendingReplacement deletion bug, and a leaked package process from pulumi package get-schema.
Fixed pulumi deployment settings edit overwriting the source of stacks using a provider other than GitHub, taking --path-filter once per filter instead of splitting on commas, and failing on unconfigured stacks from get. Also fixed skipped remote component provider state migrations and a pnpm panic when pnpm config get allowBuilds prints null.
The new pulumi env setup command brings Pulumi ESC's OIDC onboarding flow for AWS, Azure, and Google Cloud to the CLI, with interactive prompts or non-interactive flags for scripts and agents. It creates the identity provider, IAM role, and policy attachment per account, then creates an ESC environment per account with the aws-login provider configured.
pulumi deployment settings edit no longer clears settings it was not asked to change, lets --branch and --commit replace one another instead of combining, and rejects --oidc-*-clear=false. Secret property values are now redacted in violates plan errors unless --show-secrets is passed. Also includes a new import capability for pulumi:index:Stash resources and over a dozen engine and CLI fixes.
Adds pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create ESC environments, plus state migration callbacks on resource registrations. Fixes serialization of secret unknowns in NodeJS, Python, and PCL, and a panic on custom resources with no ID.