Skip to content

build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.258.0 in the pulumi group across 1 directory - #249

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/pulumi-d725b9bff3
Aug 26, 2026
Merged

build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.258.0 in the pulumi group across 1 directory#249
github-actions[bot] merged 1 commit into
mainfrom
dependabot/go_modules/pulumi-d725b9bff3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pulumi group with 1 update in the / directory: github.com/pulumi/pulumi/sdk/v3.

Updates github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.258.0

Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.258.0

3.258.0 (2026-08-17)

Features

  • [cli] Add opt-in encryption of stored credentials with a key protected by the operating system, selected with PULUMI_CREDENTIAL_STORE #24212
  • [cli/new] Ask for a cloud provider and language in interactive pulumi new instead of listing every template #24226
  • [sdk/go] Add policyx.NewStackValidationPolicy and wire up the analyzer's AnalyzeStack RPC so Go policy packs can validate the full stack #24232

Bug Fixes

  • [sdkgen/go] Generate valid Go package clauses for schema modules whose names contain hyphens #24288
  • [sdkgen/nodejs] Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces #24288
  • [cli/import] pulumi preview --import-file no longer emits unknown values, and pulumi import rejects files that contain them #24261
  • [auto/python] Add missing program argument on preview_refresh and preview_destroy stack methods #24274
  • [cli/new] Fix cloning templates and repositories into paths containing symlinks with absolute targets #24329
  • [cli/do] Fix global project lookup #24334

Improvements

  • [sdk/python] Use the resource monitor's advertised feature set consistently throughout the Python SDK #24308

Miscellaneous

  • [cli] Rewrite the pulumi login and pulumi logout help text to cover all supported state backends and document PULUMI_ACCESS_TOKEN, --default-org, and --interactive #24319

v3.257.0

3.257.0 (2026-08-13)

Features

  • [cli] Offer to create a first project after logging in to an account with no stacks #24133
  • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
  • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
  • [cli/state] Implement pulumi state get to show individual resources #24191
  • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

Bug Fixes

  • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
  • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
  • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
  • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
  • [sdk/go] Fix panics in hooks to not crash the entire process #24218
  • [programgen/go] for expressions are now generated as Go loops #24228
  • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
  • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
  • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
  • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
  • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.258.0 (2026-08-17)

Features

  • [cli] Add opt-in encryption of stored credentials with a key protected by the operating system, selected with PULUMI_CREDENTIAL_STORE #24212
  • [cli/new] Ask for a cloud provider and language in interactive pulumi new instead of listing every template #24226
  • [sdk/go] Add policyx.NewStackValidationPolicy and wire up the analyzer's AnalyzeStack RPC so Go policy packs can validate the full stack #24232

Bug Fixes

  • [sdkgen/go] Generate valid Go package clauses for schema modules whose names contain hyphens #24288
  • [sdkgen/nodejs] Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces #24288
  • [cli/import] pulumi preview --import-file no longer emits unknown values, and pulumi import rejects files that contain them #24261
  • [auto/python] Add missing program argument on preview_refresh and preview_destroy stack methods #24274
  • [cli/new] Fix cloning templates and repositories into paths containing symlinks with absolute targets #24329
  • [cli/do] Fix global project lookup #24334

Improvements

  • [sdk/python] Use the resource monitor's advertised feature set consistently throughout the Python SDK #24308

Miscellaneous

  • [cli] Rewrite the pulumi login and pulumi logout help text to cover all supported state backends and document PULUMI_ACCESS_TOKEN, --default-org, and --interactive #24319

3.257.0 (2026-08-13)

Features

  • [cli] Offer to create a first project after logging in to an account with no stacks #24133
  • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
  • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
  • [cli/state] Implement pulumi state get to show individual resources #24191
  • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

Bug Fixes

  • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
  • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
  • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
  • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
  • [sdk/go] Fix panics in hooks to not crash the entire process #24218
  • [programgen/go] for expressions are now generated as Go loops #24228
  • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
  • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
  • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
  • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
  • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245
  • [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #24251
  • [engine] Show secrets in diff display when --show-secrets is passed #24253
  • [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #24276

... (truncated)

Commits
  • dd62362 Update language runtimes (#24345)
  • ae55112 Add missing program arg for preview_refresh and preview_destroy (#24274)
  • 8889401 Fix do help text about delete not needing stateless (#24305)
  • cd514ac Fix config lookup for global projects (#24334)
  • 6f63345 introduce begin update request/response types (#24332)
  • 879a674 Fix cloning templates and repositories into paths containing symlinks with ab...
  • 7601503 Rewrite pulumi login and pulumi logout help text (#24319)
  • 6fb9daf Add opt-in OS-protected credential encryption (PULUMI_CREDENTIAL_STORE) (#24212)
  • 4249214 StackAnalyze conformance test (#24232)
  • 50fdf6f Migrate ConstructResult to use property.Map (#24234)
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 25, 2026
@github-actions

github-actions Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

bulwark

  • ✅ scan — no findings

  • ✅ coverage — go: 67.3% (baseline 67.3%)

📦 Full bulwark output — complete scan and coverage logs.

@dependabot dependabot Bot changed the title build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.253.0 in the pulumi group build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.256.0 in the pulumi group across 1 directory Aug 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch from 1ff561f to bcef94b Compare August 15, 2026 15:32
@pedromvgomes pedromvgomes mentioned this pull request Aug 16, 2026
Merged
pedromvgomes added a commit that referenced this pull request Aug 16, 2026
@pedromvgomes
feat(supply-chain): install the Pulumi CLI and provider plugins from …
eb614e1 
…our own mirror

Turns the pins from #276 into actual vendoring. A pin stops us moving by
accident, but the artifacts still lived on hosts we do not control and could
change or disappear underneath a pinned release -- which is how prd broke on
2026-08-14.

Both install paths now fetch from wardnet/toolchain-mirror and verify the
download against the SHA256SUMS that mirror publishes:

- action.yml downloads the CLI archive, verifies it, and puts it first on PATH.
  A follow-up step asserts `pulumi version` matches the pin, so if PATH
  resolution ever picks the runner image's CLI again we fail with a clear
  message instead of silently deploying on an unpinned engine.
- cmd/inforge/plugins.go fetches each provider archive from the mirror and
  verifies it. This path previously downloaded from three different GitHub orgs
  with NO verification of any kind and executed the result as part of a
  production deploy.

Verification happens BEFORE extraction, not while streaming: hashing into the
extractor would write an executable to the plugin directory and only afterwards
discover the bytes were wrong.

Also closes the SDK/CLI skew: go.mod's pulumi/sdk moves 3.251.0 -> 3.253.0 to
match action.yml's CLI pin. They are the same product either side of a process
boundary and nothing links them -- Dependabot bumps the SDK and cannot see the
CLI pin -- so #249 (SDK-only, to 3.256.0) must NOT be merged as-is; it would
silently reopen the skew. 3.253.0 is chosen over 3.256.0 deliberately: prd
recovered on 3.253.0 and 3.256.0 is the version that broke it. Our
AWS_REQUEST_CHECKSUM_CALCULATION fix should make 3.256.0 safe, but that deserves
its own verified bump rather than riding along here.

Worth recording: the provider repos publish SHA-1 checksums, not SHA-256, so the
mirror's own SHA-256 over the stored bytes is now the strongest digest available
for those artifacts.

Verified by installing all four plugins from the live mirror with the real
binary -- digests checked, archives extracted, plugin executes.
@dependabot dependabot Bot changed the title build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.256.0 in the pulumi group across 1 directory build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.257.0 in the pulumi group across 1 directory Aug 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch 2 times, most recently from 4262f5f to 582811c Compare August 22, 2026 17:36
@dependabot dependabot Bot changed the title build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.257.0 in the pulumi group across 1 directory build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.257.0 in the pulumi group across 1 directory Aug 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch from 582811c to f88839a Compare August 22, 2026 17:38
@dependabot dependabot Bot changed the title build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.257.0 in the pulumi group across 1 directory build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.258.0 in the pulumi group across 1 directory Aug 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch from f88839a to 4d1f842 Compare August 24, 2026 15:23
@pedromvgomes

pedromvgomes commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
build(deps): bump github.com/pulumi/pulumi/sdk/v3
a141ef3 
Bumps the pulumi group with 1 update in the / directory: [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi).


Updates `github.com/pulumi/pulumi/sdk/v3` from 3.253.0 to 3.258.0
- [Release notes](https://github.com/pulumi/pulumi/releases)
- [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md)
- [Commits](pulumi/pulumi@v3.253.0...v3.258.0)

---
updated-dependencies:
- dependency-name: github.com/pulumi/pulumi/sdk/v3
  dependency-version: 3.253.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pulumi
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch from 4d1f842 to a141ef3 Compare August 25, 2026 05:51
@github-actions
github-actions Bot merged commit b429a6c into main Aug 26, 2026
10 checks passed
@github-actions
github-actions Bot deleted the dependabot/go_modules/pulumi-d725b9bff3 branch August 26, 2026 02:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pedromvgomes