Skip to main content
Pulumi logo Pulumi logo
25.8K Contact us Sign in Dashboard Get started
  1. Docs
  2. Administration
  3. Self-Hosting
  4. Changelog

Pulumi Cloud self-hosted changelog

This Pulumi Cloud feature is available in the Enterprise edition.
    If you would like to evaluate the self-hosted Pulumi Cloud, request a Proof of Concept (PoC) or contact us.

    2026

    September

    • Upgraded OpenSearch to 3.7.0 across the self-hosted installers, matching the version Pulumi Cloud runs
    Breaking Change: Installers that deploy an OpenSearch cluster now deploy 3.7.0. Redeploying takes that cluster across the OpenSearch 2.x to 3.x major boundary, so plan for it rather than picking it up on your next update. If instead you point the service at an OpenSearch cluster you manage yourself, nothing changes on this release: the service stays compatible with 2.x, so you can update the service and keep that cluster where it is. For upgrade steps, see the README for your installer.
    • Added per-feature control of SSRF (server-side request forgery) protection with the PULUMI_DISABLE_SSRF_PROTECTION environment variable, support for outbound proxies set with HTTPS_PROXY and HTTP_PROXY on requests under SSRF protection, and SSRF protection for refreshing members’ GitHub Enterprise Server tokens for individual user authentication, under the VCS scope. See SSRF protection.

    Breaking Change: PULUMI_DISABLE_ESC_SSRF_PROTECTION=true now switches off SSRF protection for Pulumi ESC only. It is deprecated; set PULUMI_DISABLE_SSRF_PROTECTION=ESC instead. If you relied on it to let Pulumi Neo reach a custom model provider on your private network, add AGENTS_BYOK to the list, for example PULUMI_DISABLE_SSRF_PROTECTION=ESC,AGENTS_BYOK.

    If individual user authentication is enabled and your GitHub Enterprise Server resolves to a private or loopback address, refreshing a member’s token now fails, so operations that run as that member stop working once the token expires. Add VCS to PULUMI_DISABLE_SSRF_PROTECTION to let the API service reach the server.

    August

    • Tightened encryption checks for Pulumi ESC environments: ciphertext that was copied from another environment is now blocked when the environment is opened
    If an environment fails to open because of this check, set the PULUMI_DISABLE_CRYPTO_ACCESS_ENFORCEMENT=true environment variable, create a new revision of the affected environment from its plaintext values, and then remove the environment variable again.

    April

    • Added SSRF (server-side request forgery) protection to Pulumi ESC providers to prevent requests to private, loopback, and link-local IP addresses
    Breaking Change: ESC providers now block requests to private, loopback, and link-local IP addresses by default. If you run dependent services (for example, local secret stores or webhooks) on the same host or private network as your self-hosted Pulumi Cloud, you may need to disable SSRF protection by setting the PULUMI_DISABLE_ESC_SSRF_PROTECTION=true environment variable. As of September 2026, set PULUMI_DISABLE_SSRF_PROTECTION=ESC instead.

    2025

    November

    Breaking Change: Ensure your permissions are up to date if you are using AWS KMS or Azure Key Vault encryption services.

    March

    • Enhanced GitLab integration support
    • Updated pulumi-self-hosted-installers with latest improvements
    • Security: Run containers with read-only filesystems
    • Added support for de-privileged user for migrations

    February

    January

    • Fixed ESC YAML editor validation and preview issues
    • Improved OAuth token refresh handling

    2024

    December

    November

    • Added support for self-hosted Discovery scans
    • Fixed policy evaluator for more reliable policy enforcement
    • Upgraded pulumi-self-hosted-installers

    October

    September

    August

    • Added centralized Policy Violations page
    • Added Kubernetes-native option for Customer-Managed Agents
    • Improved performance for Resource Search API queries
    • Enhanced logging for OIDC authentication workflows
    • Fixed database migration issues for new installations
    • Security improvements for token validation and verification

    July

    June

    • [scim] Add logs when filtering invalid members
    • Relax transport validations on the http client used by the oidc client on self hosted
    • Honor env proxy variables for oidc metadata requests
    • OIDC Trust - Add support for org tokens with admin privileges

    May

    • [saml] Add email identity for new SAML admin if none exists
    • Decouple GitHub app installation for self hosted
    • [scim] Add more flexibility to SCIM user search filter
    • [saml] Add more flexibility to saml login process
    • Re-enable sign in button after failed login when username changes
    • Log SCIM search users response
    • Fix [saml] handle corrupted saml identities for existing users
    • Rename email change request email
    • Stop navbar flickering after visiting the Resources page
    • Hide GH App on integrations page for self-hosted
    • Fix required marker in delete org dialog

    April

    March

    February

    • Upgrade password hashing complexity
    • Log requested SCIM ops when we fail on validation
    • Fix overflow title in the onboarding dashboard panel

    January

    • Fix: Always allow users to delete existing policies
    • Fix: use stack name on provider audit logs
    • Fix dropping trailing zeros from numbers in config values

      The infrastructure as code platform for any cloud.

      Contact us Get started