Skip to content

build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.257.0 in the pulumi group across 1 directory - #249

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/pulumi-d725b9bff3
Open

build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.257.0 in the pulumi group across 1 directory#249
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/pulumi-d725b9bff3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pulumi group with 1 update in the / directory: github.com/pulumi/pulumi/sdk/v3.

Updates github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.257.0

Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.257.0

3.257.0 (2026-08-13)

Features

  • [cli] Offer to create a first project after logging in to an account with no stacks #24133
  • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
  • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
  • [cli/state] Implement pulumi state get to show individual resources #24191
  • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

Bug Fixes

  • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
  • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
  • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
  • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
  • [sdk/go] Fix panics in hooks to not crash the entire process #24218
  • [programgen/go] for expressions are now generated as Go loops #24228
  • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
  • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
  • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
  • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
  • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245
  • [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #24251
  • [engine] Show secrets in diff display when --show-secrets is passed #24253
  • [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #24276

Improvements

  • [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits #24082
  • [cli] Pass the invoked command (e.g. pulumi new) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them #24192

Miscellaneous

  • [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's #24143
  • [java] Upgrade java to v1.35.0 #24202
  • [backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. #24216
  • [java] Upgrade java to v1.36.0 #24243
  • [sdk/dotnet] Upgrade dotnet to v3.111.1 #24249

v3.256.0

3.256.0 (2026-08-04)

Features

  • [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #24053
  • [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #24055
  • [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #24107

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.257.0 (2026-08-13)

Features

  • [cli] Offer to create a first project after logging in to an account with no stacks #24133
  • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
  • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
  • [cli/state] Implement pulumi state get to show individual resources #24191
  • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

Bug Fixes

  • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
  • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
  • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
  • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
  • [sdk/go] Fix panics in hooks to not crash the entire process #24218
  • [programgen/go] for expressions are now generated as Go loops #24228
  • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
  • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
  • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
  • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
  • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245
  • [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #24251
  • [engine] Show secrets in diff display when --show-secrets is passed #24253
  • [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #24276

Improvements

  • [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits #24082
  • [cli] Pass the invoked command (e.g. pulumi new) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them #24192

Miscellaneous

  • [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's #24143
  • [java] Upgrade java to v1.35.0 #24202
  • [backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. #24216
  • [java] Upgrade java to v1.36.0 #24243
  • [sdk/dotnet] Upgrade dotnet to v3.111.1 #24249

3.256.0 (2026-08-04)

Features

  • [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #24053
  • [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #24055
  • [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #24107

Bug Fixes

  • [backend/service] Fix pulumi login --insecure not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates #24134

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 25, 2026
@github-actions

github-actions Bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

bulwark

  • ✅ scan — no findings

  • ✅ coverage — go: 67.3% (baseline 67.3%)

📦 Full bulwark output — complete scan and coverage logs.

@dependabot dependabot Bot changed the title build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.253.0 in the pulumi group build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.256.0 in the pulumi group across 1 directory Aug 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch from 1ff561f to bcef94b Compare August 15, 2026 15:32
@pedromvgomes pedromvgomes mentioned this pull request Aug 16, 2026
Merged
pedromvgomes added a commit that referenced this pull request Aug 16, 2026
@pedromvgomes
feat(supply-chain): install the Pulumi CLI and provider plugins from …
eb614e1 
…our own mirror

Turns the pins from #276 into actual vendoring. A pin stops us moving by
accident, but the artifacts still lived on hosts we do not control and could
change or disappear underneath a pinned release -- which is how prd broke on
2026-08-14.

Both install paths now fetch from wardnet/toolchain-mirror and verify the
download against the SHA256SUMS that mirror publishes:

- action.yml downloads the CLI archive, verifies it, and puts it first on PATH.
  A follow-up step asserts `pulumi version` matches the pin, so if PATH
  resolution ever picks the runner image's CLI again we fail with a clear
  message instead of silently deploying on an unpinned engine.
- cmd/inforge/plugins.go fetches each provider archive from the mirror and
  verifies it. This path previously downloaded from three different GitHub orgs
  with NO verification of any kind and executed the result as part of a
  production deploy.

Verification happens BEFORE extraction, not while streaming: hashing into the
extractor would write an executable to the plugin directory and only afterwards
discover the bytes were wrong.

Also closes the SDK/CLI skew: go.mod's pulumi/sdk moves 3.251.0 -> 3.253.0 to
match action.yml's CLI pin. They are the same product either side of a process
boundary and nothing links them -- Dependabot bumps the SDK and cannot see the
CLI pin -- so #249 (SDK-only, to 3.256.0) must NOT be merged as-is; it would
silently reopen the skew. 3.253.0 is chosen over 3.256.0 deliberately: prd
recovered on 3.253.0 and 3.256.0 is the version that broke it. Our
AWS_REQUEST_CHECKSUM_CALCULATION fix should make 3.256.0 safe, but that deserves
its own verified bump rather than riding along here.

Worth recording: the provider repos publish SHA-1 checksums, not SHA-256, so the
mirror's own SHA-256 over the stored bytes is now the strongest digest available
for those artifacts.

Verified by installing all four plugins from the live mirror with the real
binary -- digests checked, archives extracted, plugin executes.
@dependabot dependabot Bot changed the title build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.256.0 in the pulumi group across 1 directory build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.257.0 in the pulumi group across 1 directory Aug 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch 2 times, most recently from 4262f5f to 582811c Compare August 22, 2026 17:36
@dependabot dependabot Bot changed the title build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.257.0 in the pulumi group across 1 directory build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.257.0 in the pulumi group across 1 directory Aug 22, 2026
@dependabot
build(deps): bump github.com/pulumi/pulumi/sdk/v3
f88839a 
Bumps the pulumi group with 1 update in the / directory: [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi).


Updates `github.com/pulumi/pulumi/sdk/v3` from 3.253.0 to 3.257.0
- [Release notes](https://github.com/pulumi/pulumi/releases)
- [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md)
- [Commits](pulumi/pulumi@v3.253.0...v3.257.0)

---
updated-dependencies:
- dependency-name: github.com/pulumi/pulumi/sdk/v3
  dependency-version: 3.253.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pulumi
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/pulumi-d725b9bff3 branch from 582811c to f88839a Compare August 22, 2026 17:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants