Pulumi

Adds pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create ESC environments, plus state migration callbacks on resource registrations. Fixes serialization of secret unknowns in NodeJS, Python, and PCL, and a panic on custom resources with no ID.

Adds pulumi state promote to turn stateful snippets into Pulumi program code and changes deployment settings get --output=json to render environment variables as objects. Fixes Python typed object stack outputs now serializing with camelCase names, matching other SDKs.

Introduces PULUMI_DEFAULT_ORGANIZATION to set the default org, and interactive pulumi new now shows a single confirmation of project, stack, and config defaults. Also removes the Node.js Automation API output buffer limit and improves error reporting for failed logins and package schema validation.

Stored credentials can now be encrypted with an OS-protected key, enabled with PULUMI_CREDENTIAL_STORE. Interactive pulumi new now asks for cloud provider and language instead of listing every template, Go policy packs gain stack validation support, and preview --import-file no longer emits unknown values. Plus fixes for hyphenated schema modules, symlinked paths, and missing Python SDK arguments.

Adds pulumi state get to show individual resources, plus new pulumi do capabilities including auto-created project and stack fallback, auto-assigned stack resource identifiers, and stateful patch support. The DIY backend deprecation warning is now an error, and Go codegen fixes several node-naming and collision bugs.

Added --ignore-protect flag to delete protected resources without state changes, and a --server flag that skips package resolution. Fixed output-form invokes depending on pending remote components to resolve as unknown during previews.

Package commands now support an --extension flag for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install. Fixed a race condition where parallel pulumi install processes sharing a PULUMI_HOME could intermittently fail with a missing provider executable error.

New pulumi stack migrate command moves stacks between backends with secret re-encryption, and pulumi logs share shares logs with Pulumi. pulumi neo acp runs Neo as an ACP agent over stdio for editors. Also adds pulumi.run for Python programs, upsert in pulumi do, and an --override-env flag for config environment substitution. CLI commands now have ls, rm, and other aliases, and secrets are redacted in property value logs.

Fixed a regression where the -v log level was ignored, restoring warnings-only output to stderr by default. The Go Automation API now supports --import-pending-creates for refresh operations.

Import is now available in the generated automation APIs for NodeJS, Python, and Go. Reading non-secret stack outputs and running pulumi about no longer require the passphrase for passphrase-encrypted stacks. Also adds a production runtime option for Node.js projects, a --reason flag to pulumi env open-request, and fixes a resource deletion bug when import identifiers differ from canonical IDs.

The experimental deployment settings file (Pulumi..deploy.yaml) and related commands have been removed; manage settings directly in Pulumi Cloud with get, edit, and destroy subcommands. Added pulumi neo --debug-update and --debug-preview flags to investigate failed updates or previews. Fixed a bug where plugin debug logs appeared as raw JSON with --logtostderr, and improved import support for parameterized and extension-parameterized providers.

Fixed recursive property log marshaling in the CLI engine.

Automatic logging is now enabled for every command by default. The Node.js SDK drops support for Node 20 and earlier, requiring Node 22+. Other changes include a --skip-config-validation flag for preview/up/refresh/destroy, a --file flag for policy analysis of state files, and multiple output-format flags for stack, policy, and plugin commands.

Ad-hoc resources can now be tracked as PCL snippets in state, and Node.js SDK adds Output.recover to catch exceptions in outputs. Fixed a panic when binding a schema that references an uninstalled plugin, and generated programs now guard conditionally-created resources.

CLI now auto-refreshes OAuth tokens on 401 instead of returning "login required" errors. Registered resources can be retrieved from the mock monitor for test assertions. Also adds --provider flag to pulumi do, --raw flag to pulumi config set, and Output.recover to Python SDK.

Added pulumi logs ls and pulumi logs rm commands to manage automatic log files. A breaking change deletes all backend config upon logout. The pulumi do command now requires a --stateless flag for direct-provider behavior. Fixed backend compatibility issues with gocloud.dev and schema-declared output fields in PCL programs.

The pulumi stack init command is now named new. Fixed mergeOptions dropping onError hooks from ResourceOptions in the Node.js SDK, and the HCL language runtime is now downloaded on demand instead of bundled. Plugin installation now displays download and unpack progress, and pulumi neo supports arrow keys to scroll through prompt history.

Fixed a snapshot integrity issue that occurred with up --refresh and ensured all provider errors are forwarded to error hooks for retry. Also fixed top-level flags like --logtostderr being recognized when using pulumi do, distinguished multiple packages with the same plugin, improved trace spans for cancel RPCs during shutdown, and fixed requirements.txt merging into pyproject.toml when using uv.

Resource support is now available in the pulumi do command. The pulumi neo agent UI improved with Esc key handling to clear input or cancel turns. Also aliased pulumi new to pulumi project new, added a List method to the Go plugin.Provider interface, and made pulumi project new -y write minimal project files without templates.

Added pulumi deployment get to retrieve deployment details, pulumi insights account scan get and pulumi insights account scan list for scan management, and pulumi org member edit and pulumi org member remove for organization management. The CLI is now available via npx, and pulumi neo supports --print for non-interactive prompts. Fixed pulumi insights account scan log --all pagination and output rendering, gzip.Writer closure in tar.gz archiving, and ArgsDict type usage in Python typed dictionaries.