Pulumi

Pulumi now lets you define state migration callbacks on ResourceOptions in Python, Go, and Node.js SDKs, and the engine reports planned and applied state migrations through diagnostics while preserving root-first ordering across chained callbacks. Pulumi Cloud updates using journal v2 also now support component state migrations, and the pulumi deployment settings edit command can configure git authentication, dependency caching, template sources, drift remediation, tag triggers, stack labels, and version control integration.

Matters for: Teams managing component resource refactors and upgrades across multi-language Pulumi stacks deployed through Pulumi Cloud.

This release adds pulumi env setup {aws,azure,gcp} commands that configure cloud OIDC trust and create the matching ESC environments, and introduces state migration callbacks that can run during resource registration. It also fixes bugs such as a panic when a stack's state contains a custom resource with no ID and incorrect serialization of secret unknowns in NodeJS, Python, and PCL.

Matters for: Teams managing cloud credentials via OIDC trust across AWS, Azure, and GCP using Pulumi ESC environments.

Pulumi 3.260.0 introduces pulumi state promote to turn stateful resource snippets into Pulumi program code, adds Go 1.27 support, and changes deployment settings to render every source kind and show environment variable values as objects instead of a name list. It also fixes engine handling of resources whose deletedWith target is replaced, corrects Python stack output serialization to match the camelCase wire format used by other language SDKs, and allows transforms to be mocked in Python, Node.js, and Go SDKs.

Matters for: Teams running multi-language Pulumi projects (Python, Go, Node.js) that rely on typed stack outputs, imported resources with deletedWith relationships, or manual state edits that need to be codified.

Pulumi's global secret filter now captures secrets embedded in URLs, such as passwords in Postgres connection strings, previously these were not masked.This ensures such secrets no longer end up exposed in logs.

Matters for: Teams managing infrastructure with connection-string based secrets, such as database URLs, in their Pulumi programs.