Releases

When a preview or update runs with a policy pack, the pull request comment and commit check that Pulumi Cloud posts now include a Policy violations section. It shows how many mandatory and advisory violations were found, then lists each one with its policy pack, policy name, the resource it flagged, and the violation message. Developers can now view why a preview failed from their pull request without opening Pulumi Cloud.

The section appears on GitHub, GitLab, Bitbucket, and Azure DevOps, for previews as well as updates. Pull request comments list up to 40 violations; check run details include the full list.

See the version control integrations and policy docs for details.

We shipped a bunch of new features and improvements in the Pulumi CLI and SDK this month. A few highlights:

• A redesigned interactive pulumi new that asks for a cloud provider and language instead of listing every template, then confirms your project, stack, and config defaults in a single step (v3.258, v3.259)
• Opt-in encryption of stored credentials with a key protected by your operating system, selected with PULUMI_CREDENTIAL_STORE (v3.258)
• A new pulumi state get command to inspect an individual resource in your state (v3.257)
• A new pulumi state promote command that turns the stateful snippets created by pulumi do into Pulumi program code (v3.260)
• An --ignore-protect flag for pulumi up, pulumi preview, and pulumi destroy that deletes protected resources without unprotecting them in state first (v3.256)
• Full-stack validation for Go policy packs via policyx.NewStackValidationPolicy (v3.258)
• A PULUMI_DEFAULT_ORGANIZATION environment variable to set your default organization (v3.259)
• Support for Go 1.27 (v3.260)

We also retired the AI mode of pulumi new in favor of pulumi neo (v3.256), and made a raft of improvements to pulumi do as well.

See the Releases page on GitHub and the pulumi do docs for details.

The Pulumi Context API is now available in public preview. It connects everything Pulumi knows about your infrastructure, the resources your programs manage, the dependencies between them, how stacks consume each other’s outputs, and the resources Discovery finds in your cloud accounts, into a queryable graph.

Pulumi Neo uses the Context API out of the box. Any other agent, including Claude Code, Codex, and Cursor, learns what it needs to get started with a Markdown document served by the graph API.

Check out the announcement blog post for the full story.

Pulumi Labs has released pulumi-rust, an experimental Rust SDK and language plugin for the Pulumi platform. If you’ve been waiting to write your infrastructure in Rust, you can now give it a try.

This is an early-stage, experimental project: there are no promises of official support yet, and the API is still taking shape. But it’s a great time to kick the tires — tinker with it, file issues, and open pull requests to help shape where it goes.

To get started, head over to the pulumi-rust repository on GitHub.

You can now use pulumi do to create, read, update, and delete cloud resources directly from the command line — no program, project, or stack required — and pull them into new or existing Pulumi projects when you’re ready. Resources created with pulumi do are tracked and managed transparently for you, so commands like these just work:

# Create a new resource
pulumi do aws:s3:Bucket create my-bucket

# Update the resource in place
pulumi do aws:s3:Bucket patch my-bucket

# Delete it
pulumi do aws:s3:Bucket delete my-bucket

When the time comes to pull these resources into a proper Pulumi project of your own, you can promote them using the new pulumi state promote command:

pulumi state promote my-bucket

All of this makes pulumi do a unified, consistent API across the whole cloud that agents can use to manage resources easily and directly, without you having to give up the benefits of a solid IaC foundation.

pulumi do is generally available as of v3.258.0. To learn more, read the announcement post or the pulumi do documentation.

The Pulumi Cloud console now has a unified inbox for all of your notifications. You’ll find it in the sidebar, just above the name of the active organization, and it notifies you in real time, no reload required:

The new notification center currently covers Neo tasks, ESC approvals, and billing notifications, and we’ll be adding more notification types, including token usage, in the weeks ahead. There’s also a full-page view of your notifications that lets you manage them more easily.

You can adjust your notification preferences — including whether to be notified in the console, by email, or both — on your Account settings page.

Pulumi Cloud now discovers your AWS CloudFormation stacks and Azure Resource Manager deployments as discovered stacks. When Pulumi Discovery scans your cloud accounts, every stack and deployment appears with its resources, each mapped to its Pulumi shape and carrying a migration status computed from live state so it never gets stale.

When you’re ready to bring them under Pulumi management, the migration path is built in: hand it to Neo, generate import commands from the console, or drive the same flow from your own agent through the REST API. Progress is derived from real state, and the migration is done when a zero-diff pulumi preview proves the code matches the cloud. Pulumi-hosted Terraform stacks get the same treatment through a new Migration tab.

Read the announcement blog post or the discovered stacks documentation to learn more, and follow the step-by-step migration tutorial to take a CloudFormation stack all the way to Pulumi.

This release contains critical fixes for destroyOnFinalize, making stack teardown and reconciliation more reliable. It also contains quality-of-life feature additions such as better error condition messaging and allowing the flux source artifact size to be configurable.

For the full list of changes, see the v2.8.0 release notes on GitHub.

Pulumi Python programs can now use an async entrypoint. Pass a zero-argument async function to pulumi.run in your __main__.py, and the runtime awaits it on the program’s event loop. This makes it easier to call async functions while retaining a linear program flow:

import pulumi

async def main() -> pulumi.Inputs:
    value_a = await some_async_operation()
    value_b = await some_other_async_operation()
    return {"value_a": value_a, "value_b": value_b}

pulumi.run(main)

If the entrypoint returns a mapping, each entry is registered as a stack output, merging with any explicit pulumi.export calls using the normal export behavior. The entrypoint can also return None and call pulumi.export directly.

pulumi.run may be called only once per program, and existing synchronous programs keep working unchanged. For details, see the async entrypoint documentation.

You can now connect your AWS, Azure, and Google Cloud accounts to Pulumi Discovery in bulk. The new Connect cloud accounts wizard discovers the accounts in your AWS organization, Azure tenant, or Google Cloud organization and helps you connect them to Discovery. With the recommended authentication options, no long-lived cloud secrets are stored in Pulumi Cloud.

Onboarding used to mean manual OIDC configuration and a hand-written Pulumi ESC environment for every account, which made complete coverage across hundreds of accounts, subscriptions, and projects hard to reach. The wizard takes a whole batch across all three clouds from disconnected to scanning in a few minutes.

Bulk onboarding is available now to organization admins and members with permission to connect cloud accounts. Read the announcement blog post or the Connect cloud accounts documentation to learn more.

If you manage your Node.js Pulumi projects with pnpm, our latest releases make the experience a lot smoother:

• Pulumi now supports pnpm 11, including its stricter handling of post-install scripts, so pulumi new works out of the box with the latest pnpm (#23815)
• Serialized functions no longer embed pnpm’s versioned store paths in require calls, so upgrading a dependency no longer produces spurious diffs in serialized code, or errors when a dynamic provider loads its dependencies during pulumi refresh or pulumi destroy (#23767)
• Magic functions, callbacks written inline in your program and deployed as cloud functions, like an aws.lambda.CallbackFunction, now work in pnpm projects. Symlinked workspace and file: dependencies are fixed the same way (#23866)

After you upgrade to an SDK with these fixes, expect a one-time diff on previously serialized functions as their require paths switch to the new version-independent form.

For more on how Pulumi serializes functions in Node.js, see the function serialization docs.

You can now set monthly usage limits for Pulumi Neo to help keep your costs under control as you use Neo to handle more infrastructure tasks.

Organizations with Neo enabled can set a single dollar limit for the entire organization or individual limits for org members. You can also set up email notifications to be notified at 50%, 80%, and 95% of your configured limits.

Neo usage limits are available now for all organizations, and are configurable by organization admins and billing managers. Read the announcement blog post or the usage limits documentation to learn more.

If you sign into Pulumi Cloud with an email and password, you can now sign in with a passkey as well. A passkey is a public-key credential stored on your device (your phone, laptop, hardware key, or password manager) that lets you sign in securely without having to enter a password.

Passkeys are available to all users of Pulumi Cloud. Read the announcement blog post or visit your account settings to set up your first passkey.

Pinned to an older Pulumi CLI or SDK version and finding that the docs describe a newer release? The CLI command reference and the SDK API docs now include a version selector, so the documentation you’re reading matches the version you’re actually running. We keep immutable snapshots going back to v3.150.0, covering the CLI and the Node.js, Python, .NET, and Java SDKs, and your selection is sticky as you navigate.

Read the announcement blog post or head straight to the CLI command reference to try the version dropdown.

ESC secret-rotation webhooks enable you to be notified whenever an ESC secret rotation happens, so your dependent services can take action accordingly.

Like all Pulumi webhooks, ESC webhooks are configurable in the Pulumi Cloud console, with the Pulumi Service Provider, or with the Pulumi CLI.

To learn more about rotation webhooks, read the announcement post or check out the docs.

We shipped many new features and fixes in the Pulumi CLI and SDK this month. A few highlights:

• New subcommands for pulumi logs, including list and remove (v3.246)
• More output formats (e.g., JSON) for pulumi about and pulumi whoami (v3.248)
• Additional resource details (URN, name, type, parent) in the JSON-formatted output of Pulumi operations (v3.246)
• Renamed pulumi stack init to pulumi stack new, with init aliased for compatibility (v3.245)
• Richer pulumi do and pulumi neo interactions and workflows (v3.245, v3.246, v3.247)

… and lots more. See the Releases page on GitHub for details.

As of today, Pulumi Neo code reviews are available in public preview.

Building on the Pulumi GitHub app, which already posts rich diffs as PR comments on pull requests, Neo code reviews help you understand not just what’s changing, but also how those changes relate to, and potentially impact, the rest of your running infrastructure.

Check out the blog to learn more.

We’re excited to share that the Pulumi docs now support dark mode. 😎 If you’re a dark-mode person, you can turn off the lights by toggling the switcher at the bottom of the docs sidebar:

The switcher respects your system settings as well. Visit the docs to give it a try!

When we introduced Pulumi ESC, we shipped it as both a standalone CLI tool (esc) as well as a subcommand of the Pulumi CLI (pulumi env). Both offered the same functionality, but since the majority of ESC users also use Pulumi IaC, we’ve chosen to retire the standalone CLI in favor of a unified pulumi env.

The final release of the standalone esc binary will be next month (July, 2026), at which time the GitHub repository will be archived.

To learn more about Pulumi ESC and pulumi env, visit the Pulumi ESC documentation.

Self-hosted GitHub Enterprise operations may now be run as the individual user who triggered them, so pull requests, commits, and comments are attributed to that person and respect their permissions.

To learn more about this feature and how to configure it with your Pulumi organization, see GitHub Enterprise Server support in the docs.

We’ve added a new, keyboard-friendly command palette that lets you jump to any stack, environment, resource, or view from anywhere in the Pulumi Cloud console.

Hit Command/Control+K to bring it up and start typing:

Visit Pulumi Cloud to give it a try!

You can now push a Git tag to your Pulumi Cloud-connected version control system to trigger a Pulumi deployment. Available to all Pulumi Cloud organizations, this new feature also supports optional glob filters and works across any supported VCS, including GitHub, GitLab, Bitbucket, Azure DevOps, and custom integrations.

To learn more about tag-based deployments and how to use them, read the announcement post or check out Deployments documentation.

The Pulumi Service Provider has officially reached v1.0 and is now generated from the public Pulumi Cloud OpenAPI specification, which commits to a stable contract for the existing resource surface and keeps the provider up to date automatically.

This release also adds:

• Fine-grained RBAC as code
• Pulumi IDP (internal developer platform) as code
• Audit-log export as code

The release is live on npm, PyPI, NuGet, Maven Central, and pkg.go.dev.

To learn more about this release, read the announcement post, and check out the provider’s documentation in the Pulumi Registry. See the v1.0.0 release notes for additional details.

Pulumi ESC change requests now cleanly separate editing a draft from reviewing one. The editor is always where you change the new version, the approval page is a read-only diff, and a banner on the environment lets you flip between the two. Both modes are deep-linkable, so you can send a coworker a URL to review — or co-edit — the same draft before it’s approved.

Learn more about approvals in Pulumi ESC.

The Members tab in Access Management now shows which teams each member of your organization belongs to. Before, you had to open each team individually to see who was on it; now the full picture is on one page, under Settings > Access Management > Members.

Visit the Pulumi Cloud console to have a look.

The Pulumi Cloud console has a refreshed look: new colors; more consistent controls like inputs, selects, and buttons; a new collapsible sidebar with condensed hierarchical navigation; new layouts for tabular data; a new resource graph display; and much more.

Check it out at https://app.pulumi.com and let us know what you think!

Neo can now notify you when a task needs your input, either through native desktop notifications, an audible sound, or both. As you delegate more tasks to Neo and work more asynchronously, you’ll know right away whenever Neo is finished and waiting for you.

You can enable Neo task notifications in Account settings > Neo settings in the Pulumi Cloud console.

Custom VCS integrations connect any Git or Mercurial version control system to Pulumi Cloud, including self-hosted and third-party servers. Store your authentication credentials (SSH, basic auth, or a personal access token) in a Pulumi ESC environment, point the integration at your VCS server, and push to your repository to trigger Pulumi Deployments. Pulumi Neo can also clone and push to these repositories using the same credentials.

To learn more, read the announcement post, and to set up your first integration, check out the Custom VCS documentation.