---
scope: org
organization: pulumi
release_count: 15
last_release: 2026-10-06
generated: 2026-04-21
updated: 2026-10-16
canonical: https://releases.sh/pulumi/overview.md
---

Shipped OIDC token issuance for arbitrary services in Pulumi ESC and a breaking Google Cloud provider major.

**ESC now mints OIDC tokens for services beyond your cloud.** The `fn::open::oidc` provider signs a short-lived token for an audience you choose, and the service named in that audience verifies the signature and exchanges it for its own credential. That replaces long-lived API keys for package registries, AI platforms, and workload access platforms.

**Google Cloud provider v10 is a breaking major.** It rebases on terraform-provider-google v8, and a migration guide covers every breaking change. Neo or a coding agent can run the `provider-upgrade` skill to move stacks over.

**ESC Approvals allows simultaneous change requests.** Multiple people can propose changes to the same environment at once — a credential rotation and a feature flag addition each go through their own review, rather than one open request blocking everyone else.

**AWS IAM account access manager is manageable as code.** The `accountaccess` resources ship in the AWS provider (v7.45.0 and later) and AWS Native (v1.75.0 and later), with SDKs for TypeScript, Python, Go, C#, Java, HCL, and YAML.

**Automation APIs gained `convert`, `refresh`, `about`, and `config`.** The engine also negotiates OutputValues on Call, and the Go, Node.js, and Python SDKs can check whether a resource exists without adopting it into a stack.

**Neo agent tasks survive runtime restarts.** Workspace snapshots keep generated files, dependency state, local commits, and scratch output recoverable mid-task. Component state migrations, which let a component ship its own upgrade path, reached Python, Go, and Node.js resource options plus Pulumi Cloud updates.