Pulumi

The CLI adds pulumi env change-request commands for working with change requests, and policy violations exempted by an exception now collapse into one line per policy under Policies:, with a new --show-policy-exceptions flag for up and preview. Also added an AwaitError provider protocol error that continues the deployment with unknown outputs and exits with code 10.

ReadResourceResponse now carries an id field so providers can return a resolved id differing from the request, surfaced via .id on SDKs and treated as unknown during preview when empty. A version 2 of the --policy-pack-config format nests policy configs under policies and adds an exceptions field, alongside engine fixes that skip preview reads for dependencies being created or replaced and redact secrets in invalid input diagnostics unless --show-secrets is passed.

Fixed pulumi env edit, env set, env rm and env provider overwriting changes made after they read the environment; on a conflict, env edit reopens the editor with your edits and the current definition while the others fail. pulumi stack drift status now reports an unknown drift status when drift detection has never run.

Guide explains running Pulumi Neo inside a Docker Sandbox microVM that reaches only allowed files and hosts, with the Pulumi token injected by a proxy so Neo never holds the real credential, plus Pulumi approval and permission modes as a second layer.

New runtime functions in the Go, Node.js, and Python SDKs check whether a resource with a given ID exists without adopting it into the stack, and the generated automation APIs gain convert, refresh, about, and config commands. Secrets carried on output values are now redacted in plaintext log output and pulumi logs share, and pulumi logs and pulumi watch now error by default ahead of their removal.

The engine now negotiates OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, gated by a new accepts_outputs_in_invoke handshake capability. Also fixed plugin checksum verification rejecting valid downloads over HTTP/1.1 and a plugin process leak when the schema loader boots a plugin that runs in a language host.

Pulumi's Google Cloud provider v10.0.0 is a major release based on terraform-provider-google v8, shipping with a migration guide covering every breaking change. Upgrades can be automated via the provider-upgrade skill in Pulumi Neo or coding agents, which scan stacks for affected resources and pause before replacing or deleting live infrastructure.

Fixed concurrent pulumi new runs failing to clone the templates repository, and pulumi install for Python plugins and policy packs using the uv toolchain with a [build-system] table.

Go and Python SDKs now use an explicit provider for resources from an extension package instead of falling back to a default provider, and the Go SDK removed workspace.Credentials.AccessTokens, reading stored logins only from the accounts object of credentials.json. Also improved pulumi neo tool results with console URL and update identifiers.

Pulumi demonstrates GeoDeploy, an app that combines TypeSafe's Jev decision primitives with the Pulumi Automation API to pick AWS, Azure, or Google Cloud regions for managed Kubernetes and provision them. Jev only selects from closed sets of pre-priced region IDs using choice() and noul() calls, so it never generates code, does arithmetic, or invents region names.

An open source pass-through proxy asks TypeSafe AI's Jev System One model which Claude model each new message needs, forwarding to Haiku 4.5, Sonnet 5, or Opus 5.5 and only re-deciding when the user writes a message so prompt caches survive. Tool steps and subagents keep their tier, background calls go to Haiku 4.5, and Jev's answers act as advice since guard questions and hard rules in code can only raise the tier.

The new pulumi logout --all --delete-credentials-key flag removes the key that encrypts stored credentials from the OS credential store, and encrypted credentials in other PULUMI_HOME directories stay readable after a logout --all or login. Fixed a PCL panic when indexing a tuple literal with an index equal to its length, a binder panic on nested tuple literals of different shapes, and Node.js closure serialization for __importStar-wrapped cached modules.

Component state migration callbacks are now available in the Python, Go, and Node.js resource options, with Pulumi Cloud updates enabling component state migrations via journal v2. Also fixed plugin discovery from the current uv workspace member's dependencies, a PendingReplacement deletion bug, and a leaked package process from pulumi package get-schema.