Commit Graph

248 Commits

Author SHA1 Message Date
Pulumi Bot
de507af39b [internal] Update GitHub Actions workflow files 2026-02-12 13:17:17 +00:00
Alberto Pose
13a14388f2 Fix workflow failure by ensuring bin directory exists (#762)
# **Note: This is a temporary fix until we get this to `ci-mgmt`**

## Summary
Fixes the GoReleaser workflow failure that started on Feb 6, 2026.

## Root Cause
Commit 491f7de deleted `bin/pulumi-language-python-exec`, which was the
last file in the `bin/` directory. Since Git doesn't track empty
directories, the `bin/` directory disappeared from the repository.

When GoReleaser runs the post-build hook `make
sign-goreleaser-exe-amd64`, it attempts to download `jsign-6.0.jar` to
`bin/jsign-6.0.jar`, but fails with:
```
bin/jsign-6.0.jar: No such file or directory
make: *** [Makefile:260: bin/jsign-6.0.jar] Error 1
```

## Changes
Added `@mkdir -p bin` to Makefile targets that write to the `bin/`
directory:
- `bin/jsign-6.0.jar` target (line 260) - **Critical fix**
- `bin/pulumi-gen-${PACK}` target (line 185) - Defensive fix

This ensures the directory exists before attempting to create files in
it.

Fixes #756

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-11 15:31:19 +00:00
pulumi-renovate[bot]
13acd934b6 Update first-party Pulumi dependencies (#760)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) |
indirect | minor | `v0.21.0` -> `v0.22.0` |
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.219.0` -> `v3.220.0` |

---

### Release Notes

<details>
<summary>pulumi/esc (github.com/pulumi/esc)</summary>

###
[`v0.22.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.22.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.21.0...v0.22.0)

##### Improvements

##### Bug Fixes

##### Breaking changes

</details>

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.220.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.220.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0)

##### 3.220.0 (2026-02-10)

##### Features

- \[cli] Show environment variables that were set if a snapshot
integrity error happens
[#&#8203;21709](https://redirect.github.com/pulumi/pulumi/pull/21709)

- \[cli/{install,package}] Use the Pulumi Cloud Registry by default to
resolve package names

-   \[engine] Pass replacement trigger through to Construct
[#&#8203;21408](https://redirect.github.com/pulumi/pulumi/pull/21408)

- \[engine] Add EnvVarMappings resource option for provider resources,
allowing environment variables to be remapped before being passed to the
provider
[#&#8203;21572](https://redirect.github.com/pulumi/pulumi/pull/21572)

- \[pkg] BREAKING: Deprecate
github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of
github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This
package will be removed from pulumi/pulumi soon!
[#&#8203;21720](https://redirect.github.com/pulumi/pulumi/pull/21720)

##### Bug Fixes

- \[cli] Retry `yarn install` when it fails (e.g. during `pulumi
install`)
[#&#8203;21707](https://redirect.github.com/pulumi/pulumi/pull/21707)

-   \[engine] Deal with errors in elided journal entries correctly
[#&#8203;21576](https://redirect.github.com/pulumi/pulumi/pull/21576)

- \[sdk/nodejs] Fix remote components with
PULUMI_NODEJS_SKIP_COMPONENT_INPUTS

- \[sdk/python] Fix `_LazyModule` to not trigger full module load for
introspection attributes
[#&#8203;21620](https://redirect.github.com/pulumi/pulumi/pull/21620)

- \[sdkgen/python] Remove workaround for slow typechecking with MyPy and
PyCharm
[#&#8203;21722](https://redirect.github.com/pulumi/pulumi/pull/21722)

##### Miscellaneous

- \[cli] Write logfile location if verbosity is >= 1 to stderr instead
of stdout
[#&#8203;21663](https://redirect.github.com/pulumi/pulumi/pull/21663)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
Co-authored-by: Ian Wahbe <me@iwahbe.com>
2026-02-11 10:27:46 +00:00
pulumi-provider-automation[bot]
8cb8d21332 Update GitHub Actions workflows. (#761)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f34bb277a6b5001ebd945cebced51ef890cdb7b9.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-11 06:04:08 +00:00
pulumi-renovate[bot]
c11144e1b3 Update dependency @pulumi/pulumi to v3.220.0 (#759)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.219.0` ->
`3.220.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.219.0/3.220.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.220.0`](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-02-10 17:51:07 +00:00
pulumi-renovate[bot]
ca8a59a077 Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (#758)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git)
| indirect | patch | `v5.16.0` -> `v5.16.5` |

### GitHub Vulnerability Alerts

####
[CVE-2026-25934](https://redirect.github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3)

### Impact 

A vulnerability was discovered in `go-git` whereby data integrity values
for `.pack` and `.idx` files were not properly verified. This resulted
in `go-git` potentially consuming corrupted files, which would likely
result in unexpected errors such as `object not found`.

For context, clients fetch
[`packfiles`](https://git-scm.com/docs/pack-protocol#_packfile_data)
from upstream Git servers. Those files contain a checksum of their
contents, so that clients can perform integrity checks before consuming
it. The pack indexes (`.idx`) are
[generated](https://git-scm.com/docs/pack-format) locally by `go-git`,
or the `git` cli, when new `.pack` files are received and processed. The
integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no
impact on the trust relationship between the client and server, which is
enforced based on the protocol being used (e.g. TLS in the case of
`https://` or known hosts for `ssh://`). In other words, the packfile
checksum verification does not provide any security benefits when
connecting to a malicious or compromised Git server.

### Patches

Users should upgrade to `v5.16.5`, or the latest `v6`
[pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to
mitigate this vulnerability.

### Workarounds

In case updating to a fixed version of `go-git` is not possible, users
can run [git fsck](https://git-scm.com/docs/git-fsck) from the `git` cli
to check for data corruption on a given repository.

### Credit

Thanks @&#8203;N0zoM1z0 for finding and reporting this issue privately
to the `go-git` project.

---

### Release Notes

<details>
<summary>go-git/go-git (github.com/go-git/go-git/v5)</summary>

###
[`v5.16.5`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.5)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.4...v5.16.5)

##### What's Changed

- build: Update module golang.org/x/crypto to v0.45.0 \[SECURITY]
(releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1744](https://redirect.github.com/go-git/go-git/pull/1744)4
- build: Bump Go test versions to 1.23-1.25 (v5) by
[@&#8203;pjbgf](https://redirect.github.com/pjbgf) in
[https://github.com/go-git/go-git/pull/1746](https://redirect.github.com/go-git/go-git/pull/1746)
- \[v5] git: worktree, Don't delete local untracked files when resetting
worktree by [@&#8203;Ch00k](https://redirect.github.com/Ch00k) in
[https://github.com/go-git/go-git/pull/1800](https://redirect.github.com/go-git/go-git/pull/1800)
- Expand packfile checks by
[@&#8203;pjbgf](https://redirect.github.com/pjbgf) in
[https://github.com/go-git/go-git/pull/1836](https://redirect.github.com/go-git/go-git/pull/1836)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5

###
[`v5.16.4`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.4)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.3...v5.16.4)

##### What's Changed

- backport plumbing: format/idxfile, prevent panic by
[@&#8203;swills](https://redirect.github.com/swills) in
[https://github.com/go-git/go-git/pull/1732](https://redirect.github.com/go-git/go-git/pull/1732)
- \[backport] build: test, Fix build on Windows. by
[@&#8203;pjbgf](https://redirect.github.com/pjbgf) in
[https://github.com/go-git/go-git/pull/1734](https://redirect.github.com/go-git/go-git/pull/1734)
- build: Update module golang.org/x/net to v0.38.0 \[SECURITY]
(releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1742](https://redirect.github.com/go-git/go-git/pull/1742)2
- build: Update module github.com/cloudflare/circl to v1.6.1 \[SECURITY]
(releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1741](https://redirect.github.com/go-git/go-git/pull/1741)1
- build: Update module github.com/go-git/go-git/v5 to v5.13.0
\[SECURITY] (releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1743](https://redirect.github.com/go-git/go-git/pull/1743)3

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4

###
[`v5.16.3`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.3)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.2...v5.16.3)

##### What's Changed

- internal: Expand regex to fix build \[5.x] by
[@&#8203;baloo](https://redirect.github.com/baloo) in
[https://github.com/go-git/go-git/pull/1644](https://redirect.github.com/go-git/go-git/pull/1644)
- build: raise timeouts for windows CI tests and disable CIFuzz \[5.x]
by [@&#8203;baloo](https://redirect.github.com/baloo) in
[https://github.com/go-git/go-git/pull/1646](https://redirect.github.com/go-git/go-git/pull/1646)
- plumbing: support commits extra headers, support jujutsu signed commit
\[5.x] by [@&#8203;baloo](https://redirect.github.com/baloo) in
[https://github.com/go-git/go-git/pull/1633](https://redirect.github.com/go-git/go-git/pull/1633)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3

###
[`v5.16.2`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.2)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.1...v5.16.2)

##### What's Changed

- utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to
releases/v5.x by [@&#8203;kane8n](https://redirect.github.com/kane8n) in
[https://github.com/go-git/go-git/pull/1567](https://redirect.github.com/go-git/go-git/pull/1567)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2

###
[`v5.16.1`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.1)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.0...v5.16.1)

##### What's Changed

- utils: merkletrie, Fix diff on sparse-checkout index. Fixes
[#&#8203;1406](https://redirect.github.com/go-git/go-git/issues/1406) to
releases/v5.x by [@&#8203;kane8n](https://redirect.github.com/kane8n) in
[https://github.com/go-git/go-git/pull/1561](https://redirect.github.com/go-git/go-git/pull/1561)

##### New Contributors

- [@&#8203;kane8n](https://redirect.github.com/kane8n) made their first
contribution in
[https://github.com/go-git/go-git/pull/1561](https://redirect.github.com/go-git/go-git/pull/1561)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-02-10 00:50:46 +00:00
Bryce Lampe
5b05d733ea Fix lint issues (#755)
Lint fixes in preparation of
https://github.com/pulumi/ci-mgmt/pull/2024.
2026-02-06 22:08:57 +00:00
pulumi-renovate[bot]
e9f6bbf15d Update first-party Pulumi dependencies (#717)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.212.0` ->
`3.219.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.212.0/3.219.0)
|
| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) |
indirect | minor | `v0.20.0` -> `v0.21.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.219.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32190-2026-02-05)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.218.0...v3.219.0)

##### Features

-   \[cli] Allow setting `requiredPulumiVersion` in Pulumi.yaml
[#&#8203;21627](https://redirect.github.com/pulumi/pulumi/pull/21627)

- \[cli/{install,package}] Allow using private packages as local
dependencies in components
[#&#8203;21664](https://redirect.github.com/pulumi/pulumi/pull/21664)

-   \[cli/policy] Add `pulumi policy install` command
[#&#8203;21652](https://redirect.github.com/pulumi/pulumi/pull/21652)

-   \[engine] Run analyzer calls in parallel
[#&#8203;21631](https://redirect.github.com/pulumi/pulumi/pull/21631)

-   \[programgen/dotnet] Codegen RequirePulumiVersion for Dotnet
[#&#8203;21621](https://redirect.github.com/pulumi/pulumi/pull/21621)

-   \[sdk/python] Add support for the `OnError` resource hook
[#&#8203;21644](https://redirect.github.com/pulumi/pulumi/pull/21644)

-   \[sdk/python] Add support for protobuf 6
[#&#8203;21647](https://redirect.github.com/pulumi/pulumi/pull/21647)

##### Bug Fixes

-   \[cli] Allow positional arguments to be passed to `convert` again
[#&#8203;21604](https://redirect.github.com/pulumi/pulumi/pull/21604)
[#&#8203;21614](https://redirect.github.com/pulumi/pulumi/pull/21614)

- \[engine] Download/install required policy packs in parallel with
plugins
[#&#8203;21651](https://redirect.github.com/pulumi/pulumi/pull/21651)

- \[cli/package] Correctly install packages that depend on other
packages for `pulumi package add` and `pulumi package get-schema`.
[#&#8203;21321](https://redirect.github.com/pulumi/pulumi/pull/21321)

- \[programgen/python] Fix panic when ranging over a resource output
that is an array of objects
[#&#8203;21679](https://redirect.github.com/pulumi/pulumi/pull/21679)

- \[sdk/python] Fix issue with generic subclasses of `dynamic.Resource`
[#&#8203;21670](https://redirect.github.com/pulumi/pulumi/pull/21670)

##### Miscellaneous

-   \[sdk/python] Relax pip version constraint
[#&#8203;21639](https://redirect.github.com/pulumi/pulumi/pull/21639)

###
[`v3.218.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32180-2026-01-29)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.217.1...v3.218.0)

##### Features

-   \[sdk/nodejs] Add support for the `OnError` resource hook

##### Bug Fixes

-   \[cli] Allow positional arguments to be passed to `convert` again

- \[cli/install] Correctly include git forge organizations as schema
namespaces when generating SDKs
[#&#8203;21579](https://redirect.github.com/pulumi/pulumi/pull/21579)

- \[cli/{install,package}] Correctly grab package names for Python &
NodeJS
[#&#8203;21577](https://redirect.github.com/pulumi/pulumi/pull/21577)

###
[`v3.217.1`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32171-2026-01-27)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.217.0...v3.217.1)

##### Features

-   \[sdk/go] Add support for the `OnError` resource hook
[#&#8203;21515](https://redirect.github.com/pulumi/pulumi/pull/21515)

##### Bug Fixes

- \[cli/install] Copy files when linking to be robust to copying across
file partitions
[#&#8203;21549](https://redirect.github.com/pulumi/pulumi/pull/21549)

- \[cli/install] Do not double install plugins with explicit
parameterizations
[#&#8203;21548](https://redirect.github.com/pulumi/pulumi/pull/21548)

-   \[cli/install] Copy files when linking instead of renaming
[#&#8203;21549](https://redirect.github.com/pulumi/pulumi/pull/21549)

**Full Changelog**:
https://github.com/pulumi/pulumi/compare/v3.217.0...v3.217.1

###
[`v3.217.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32170-2026-01-23)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.216.0...v3.217.0)

##### Features

- \[cli] Extract organization, team, and user from OIDC JWT claims
during login
[#&#8203;21462](https://redirect.github.com/pulumi/pulumi/pull/21462)

- \[engine] Add the `OnError` resource hook to allow for custom retry
policies
[#&#8203;21291](https://redirect.github.com/pulumi/pulumi/pull/21291)

-   \[cli/engine] Add --plan up flag
[#&#8203;21368](https://redirect.github.com/pulumi/pulumi/pull/21368)

-   \[sdk/nodejs] Add requirePulumiVersion to the Node.js SDK
[#&#8203;21528](https://redirect.github.com/pulumi/pulumi/pull/21528)
[#&#8203;21478](https://redirect.github.com/pulumi/pulumi/pull/21478)

-   \[sdk/python] Add require_pulumi_version to the Python SDK
[#&#8203;21528](https://redirect.github.com/pulumi/pulumi/pull/21528)
[#&#8203;21430](https://redirect.github.com/pulumi/pulumi/pull/21430)

-   \[sdk/go] Add CheckPulumiVersion to the Go SDK
[#&#8203;21528](https://redirect.github.com/pulumi/pulumi/pull/21528)
[#&#8203;21514](https://redirect.github.com/pulumi/pulumi/pull/21514)

##### Bug Fixes

-   \[auto/python] Implement `About` in Python automation API server
[#&#8203;21479](https://redirect.github.com/pulumi/pulumi/pull/21479)

- \[engine] When importing a state file that refers to the service
backed secret manager, make `stack import` reconfigure it for the target
stack if required
[#&#8203;20966](https://redirect.github.com/pulumi/pulumi/pull/20966)

- \[protobuf] Fix alias options being passed to Construct for remote
components
[#&#8203;21050](https://redirect.github.com/pulumi/pulumi/pull/21050)

-   \[sdk/nodejs] Fix issue with serialized async generators
[#&#8203;21484](https://redirect.github.com/pulumi/pulumi/pull/21484)

###
[`v3.216.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32160-2026-01-16)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.215.0...v3.216.0)

##### Features

-   \[build] Don't set PULUMI_ROOT with mise
[#&#8203;21457](https://redirect.github.com/pulumi/pulumi/pull/21457)

-   \[cli] Default to Pulumi Cloud when using an OIDC token for login
[#&#8203;21322](https://redirect.github.com/pulumi/pulumi/pull/21322)

-   \[engine] Add CheckPulumiVersion RPC to the engine
[#&#8203;21429](https://redirect.github.com/pulumi/pulumi/pull/21429)

-   \[protobuf] Remove ProviderHandshakeResponse.pulumi_version_range
[#&#8203;21438](https://redirect.github.com/pulumi/pulumi/pull/21438)

- \[sdk/nodejs] Allow dynamic providers to return inputs from read() for
accurate diffs after refresh
[#&#8203;21315](https://redirect.github.com/pulumi/pulumi/pull/21315)

-   \[sdk/nodejs] Add support for serializing async generators
[#&#8203;21410](https://redirect.github.com/pulumi/pulumi/pull/21410)

- \[sdk/python] Allow dynamic providers to return inputs from read() for
accurate diffs after refresh
[#&#8203;21315](https://redirect.github.com/pulumi/pulumi/pull/21315)

##### Bug Fixes

-   \[engine] Optimize StackReference performance
[#&#8203;21446](https://redirect.github.com/pulumi/pulumi/pull/21446)

-   \[cli/display] Fix message renderer on windows
[#&#8203;21401](https://redirect.github.com/pulumi/pulumi/pull/21401)

- \[sdk/nodejs] Fix RangeError in defaultErrorMessage when error objects
are large
[#&#8203;21409](https://redirect.github.com/pulumi/pulumi/pull/21409)

##### Miscellaneous

-   \[sdk/dotnet] Update dotnet to v3.97.0

###
[`v3.215.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32150-2026-01-07)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.214.1...v3.215.0)

##### Features

- \[cli/plugin] Allow plugins to specify a supported version range for
the CLI
[#&#8203;21335](https://redirect.github.com/pulumi/pulumi/pull/21335)

##### Bug Fixes

-   \[cli] Filter internal properties like \__defaults from diff display
[#&#8203;21359](https://redirect.github.com/pulumi/pulumi/pull/21359)

- \[cli/config] Make `config set --type bool` accept different spellings
of boolean values instead of only lowercase "true"
[#&#8203;21314](https://redirect.github.com/pulumi/pulumi/pull/21314)

- \[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
[#&#8203;21373](https://redirect.github.com/pulumi/pulumi/pull/21373)

##### Miscellaneous

-   \[cli] Update pulumi-dotnet to 3.96.1

-   \[cli/package] Remove superfluous version string
[#&#8203;21351](https://redirect.github.com/pulumi/pulumi/pull/21351)

###
[`v3.214.1`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32141-2026-01-03)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.214.0...v3.214.1)

##### Bug Fixes

- \[cli/package] Preserve existing behavior when `pulumi package add` is
used with a local provider
[#&#8203;21350](https://redirect.github.com/pulumi/pulumi/pull/21350)

- \[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
[#&#8203;21325](https://redirect.github.com/pulumi/pulumi/pull/21325)

###
[`v3.214.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32140-2025-12-30)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.213.0...v3.214.0)

##### Features

-   \[cli] Add --config and --config-path options to destroy and refresh
[#&#8203;21299](https://redirect.github.com/pulumi/pulumi/pull/21299)

- \[sdkgen] Add `OutputStyleOnly` flag to functions to not emit their
plain variants
[#&#8203;21198](https://redirect.github.com/pulumi/pulumi/pull/21198)

- \[sdk/python] Add support for `replacement_trigger` in the Python SDK
[#&#8203;20940](https://redirect.github.com/pulumi/pulumi/pull/20940)

##### Bug Fixes

- \[engine] Pass ignoreChanges when issuing no-diff updates that resolve
initErrors
[#&#8203;21319](https://redirect.github.com/pulumi/pulumi/pull/21319)

- \[programgen] Fix a bug in programgen binding to invokes from
parameterized packages
[#&#8203;21284](https://redirect.github.com/pulumi/pulumi/pull/21284)

- \[cli/plugin] Fix plugin download URL overrides for fallback mechanism
[#&#8203;21095](https://redirect.github.com/pulumi/pulumi/pull/21095)

##### Miscellaneous

-   \[pkg] Upgrade pulumi-java to 1.20.0

###
[`v3.213.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32130-2025-12-17)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.212.0...v3.213.0)

##### Bug Fixes

- \[sdkgen/go] Generate three-level nested builtin output types for Go
SDK
[#&#8203;21248](https://redirect.github.com/pulumi/pulumi/pull/21248)

##### Miscellaneous

-   \[pkg] Move plugin downloading from pkg into sdk
[#&#8203;21220](https://redirect.github.com/pulumi/pulumi/pull/21220)

</details>

<details>
<summary>pulumi/esc (github.com/pulumi/esc)</summary>

###
[`v0.21.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.21.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.20.0...v0.21.0)

##### Improvements

- Added support for `fn::split` built-in function to split strings into
arrays.
    [#&#8203;281](https://redirect.github.com/pulumi/esc/issues/281)
- Add native support for OIDC token exchange when logging into Pulumi
Cloud. Run `esc login --help` for more
information.
[#&#8203;607](https://redirect.github.com/pulumi/esc/pull/607)

##### Bug Fixes

##### Breaking changes

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-02-06 21:06:05 +00:00
pulumi-renovate[bot]
491f7de7d5 Update module github.com/pulumi/pulumi-go-provider to v1.3.0 (#748)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-go-provider](https://redirect.github.com/pulumi/pulumi-go-provider)
| require | minor | `v1.1.2` -> `v1.3.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi-go-provider
(github.com/pulumi/pulumi-go-provider)</summary>

###
[`v1.3.0`](https://redirect.github.com/pulumi/pulumi-go-provider/releases/tag/v1.3.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-go-provider/compare/v1.2.0...v1.3.0)

#### What's Changed

- Don't set a default value for `"displayName"` or `"namespace`" by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/452](https://redirect.github.com/pulumi/pulumi-go-provider/pull/452)
- Update module github.com/pulumi/pulumi/pkg/v3 to v3.217.0 by
[@&#8203;pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot]
in[https://github.com/pulumi/pulumi-go-provider/pull/464](https://redirect.github.com/pulumi/pulumi-go-provider/pull/464)4

#### New Contributors

-
[@&#8203;pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot]
made their first contribution
in[https://github.com/pulumi/pulumi-go-provider/pull/427](https://redirect.github.com/pulumi/pulumi-go-provider/pull/427)7
- [@&#8203;Frassle](https://redirect.github.com/Frassle) made their
first contribution in
[https://github.com/pulumi/pulumi-go-provider/pull/455](https://redirect.github.com/pulumi/pulumi-go-provider/pull/455)

**Full Changelog**:
https://github.com/pulumi/pulumi-go-provider/compare/v1.2.0...v1.3.0

###
[`v1.2.0`](https://redirect.github.com/pulumi/pulumi-go-provider/releases/tag/v1.2.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-go-provider/compare/v1.1.2...v1.2.0)

#### What's Changed

- Add old inputs to the rpc passthrough (and the provider in general) by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/414](https://redirect.github.com/pulumi/pulumi-go-provider/pull/414)
- Debug middleware/rpc by printing what the wrapped provider sees by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/415](https://redirect.github.com/pulumi/pulumi-go-provider/pull/415)
- `rpc.Provider` correctly handles wrapping providers without preview
support by [@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/416](https://redirect.github.com/pulumi/pulumi-go-provider/pull/416)
- Add an example of property comments for component resources by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/411](https://redirect.github.com/pulumi/pulumi-go-provider/pull/411)
- Use old inputs when calculating Diff for default infer by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/419](https://redirect.github.com/pulumi/pulumi-go-provider/pull/419)
- \[infer] Prevent deserialization errors with CustomDiff for Config by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/420](https://redirect.github.com/pulumi/pulumi-go-provider/pull/420)
- Fix `CustomDiff[*Config, *Config]` by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/421](https://redirect.github.com/pulumi/pulumi-go-provider/pull/421)
- Fix `GetSchema` by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/422](https://redirect.github.com/pulumi/pulumi-go-provider/pull/422)
- Correctly keep `DiffResponse`'s non-detailed diffs keys top-level by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/417](https://redirect.github.com/pulumi/pulumi-go-provider/pull/417)

#### New Contributors

- [@&#8203;andrzejressel](https://redirect.github.com/andrzejressel)
made their first contribution in
[https://github.com/pulumi/pulumi-go-provider/pull/418](https://redirect.github.com/pulumi/pulumi-go-provider/pull/418)

**Full Changelog**:
https://github.com/pulumi/pulumi-go-provider/compare/v1.1.2...v1.2.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: Bryce Lampe <bryce@pulumi.com>
2026-02-06 20:48:41 +00:00
pulumi-provider-automation[bot]
f5d459e624 Update GitHub Actions workflows. (#751)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 62def83b594d72ccf4eab97cdf5b566ebb910e83.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-03 05:54:15 +00:00
pulumi-provider-automation[bot]
d5e5c8a482 Update GitHub Actions workflows. (#750)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f51ba6a8731f22e9b3cf35393bf9c792097e4aa1.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-30 19:09:44 +00:00
pulumi-renovate[bot]
d0bb326600 Update module github.com/pulumi/providertest to v0.6.0 (#749)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/providertest](https://redirect.github.com/pulumi/providertest)
| require | minor | `v0.5.1-0.20251217173405-3861778549dd` -> `v0.6.0` |

---

### Release Notes

<details>
<summary>pulumi/providertest (github.com/pulumi/providertest)</summary>

###
[`v0.6.0`](https://redirect.github.com/pulumi/providertest/releases/tag/v0.6.0)

[Compare
Source](https://redirect.github.com/pulumi/providertest/compare/v0.5.1...v0.6.0)

##### What's Changed

- feat: Add local python SDK replacement option via pip by
[@&#8203;rshade](https://redirect.github.com/rshade) in
[https://github.com/pulumi/providertest/pull/150](https://redirect.github.com/pulumi/providertest/pull/150)

**Full Changelog**:
https://github.com/pulumi/providertest/compare/v0.5.1...v0.6.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-01-29 19:33:01 +00:00
pulumi-provider-automation[bot]
534bc6c172 Update GitHub Actions workflows. (#745)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 1131c4d395e39e42386bf9a4dfb975eb219d604b.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-29 05:54:00 +00:00
pulumi-provider-automation[bot]
570f83ca62 Update GitHub Actions workflows. (#743)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit a3bb44291e85389589513a73050a049a024bd800.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-28 05:43:20 +00:00
pulumi-provider-automation[bot]
b35af1d86d Update GitHub Actions workflows. (#742)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 5c1afa4cb1107d1ea52e86433fcd7d54b28925ab.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-26 16:00:41 +00:00
pulumi-provider-automation[bot]
62db1d7f3b Update GitHub Actions workflows. (#740)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit d825a77c6fb8405f61d1283d494a3a2c1cba3587.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-23 12:49:06 +00:00
pulumi-provider-automation[bot]
9b5a5d4371 Update GitHub Actions workflows. (#737)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 16d6357b115512b7bf916a73a75b78fa24fef858.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-16 05:39:51 +00:00
pulumi-provider-automation[bot]
8809a8c708 Update GitHub Actions workflows. (#735)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit dfe81431707efb057395e33fe5234f01031ecd95.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-15 05:40:12 +00:00
pulumi-provider-automation[bot]
cc1bda22e5 Update GitHub Actions workflows. (#734)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 329ced61750d1b5d3027894c5e0c79ac08f71378.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-13 05:38:49 +00:00
pulumi-provider-automation[bot]
f820f6547c Update GitHub Actions workflows. (#733)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit ea67003b42b286f2a9d25c2a5e878fc1aacf5c94.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-10 05:38:03 +00:00
pulumi-provider-automation[bot]
214793b929 Update GitHub Actions workflows. (#730)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 4cdb4b8cad405d730db594e8adb73ee1b875b4a6.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-30 05:45:22 +00:00
pulumi-provider-automation[bot]
9e8c685bc8 Update GitHub Actions workflows. (#728)
This PR was automatically generated by the
update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt
repo, from commit 021a1f6c9360e1b569457868b4c0c3ecbfc62ff4.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-23 19:01:30 +00:00
pulumi-provider-automation[bot]
09f7b32602 Update GitHub Actions workflows. (#727)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 6693889d5ebbe0416302e06ac701da21580fbd2d.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-23 15:40:07 +00:00
pulumi-provider-automation[bot]
1e00e5dc89 Update GitHub Actions workflows. (#724)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 90795a3949f95304f4bd3a9dea2ace1ca3465403.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-23 05:44:49 +00:00
pulumi-provider-automation[bot]
93fae0c1a4 Update GitHub Actions workflows. (#723)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 1901fce160a37d0c537d831ce6f96e72bf7c9427.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-20 05:44:19 +00:00
pulumi-provider-automation[bot]
4c85816954 Update GitHub Actions workflows. (#721)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 217fd547b64df90c7919b206f17362d4baec9aa3.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-19 20:07:45 +00:00
pulumi-provider-automation[bot]
4e3830ca83 Update GitHub Actions workflows. (#720)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 0b04a21b810fd7b4a412c1f42867a70f65c14758.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-19 05:44:14 +00:00
pulumi-provider-automation[bot]
3f329778cf Update GitHub Actions workflows. (#718)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f0ec8c55b928cc870e533b367aaba1f9af2330ad.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-18 05:44:56 +00:00
pulumi-provider-automation[bot]
c64d5baba6 Update GitHub Actions workflows. (#716)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 02f02bb0bfe879d167ed8f335b4950208454bafb.

---------

Co-authored-by: Pulumi Bot <bot@pulumi.com>
Co-authored-by: Bryce Lampe <bryce@pulumi.com>
2025-12-17 18:20:54 +00:00
pulumi-renovate[bot]
4c8968185c Update dependency @pulumi/pulumi to v3.212.0 (#710)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.211.0` ->
`3.212.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.211.0/3.212.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.212.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.212.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.211.0...v3.212.0)

##### 3.212.0 (2025-12-12)

##### Bug Fixes

-   \[yaml] Update pulumi-yaml to v1.26.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-12-12 22:13:17 +00:00
pulumi-renovate[bot]
7a75efe8c4 Update dependency @pulumi/pulumi to v3.211.0 (#708)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.210.0` ->
`3.211.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.210.0/3.211.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.211.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.211.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.210.0...v3.211.0)

#### 3.211.0 (2025-12-11)

##### Features

- \[cli/about] Print Node.js package manager information in `pulumi
about`
[#&#8203;21163](https://redirect.github.com/pulumi/pulumi/pull/21163)

- \[backend/diy] Add stack tags support for DIY backends (S3, Postgres,
file-based, etc.).

DIY backends now support stack tags functionality, bringing feature
parity with cloud backends.
This includes:

-   Full CRUD operations for stack tags (create, read, update, delete)
-   Automatic system tag injection (e.g., `pulumi:project`)
-   Tag filtering support in stack listing operations
-   Backward compatibility with existing stacks (no tags file required)
-   Atomic operations with caching for performance
-   Automatic cleanup of tag files when stacks are deleted

Tags are stored as separate `.pulumi-tags` files alongside stack
checkpoints, using a versioned
JSON format. The implementation works across all DIY backend storage
types including S3, Azure Blob,
Google Cloud Storage, PostgreSQL, and local file systems.

Example usage:

```bash
pulumi stack tag set environment production
pulumi stack tag set owner backend-team
pulumi stack ls --tag-filter environment=production
```

[#&#8203;19882](https://redirect.github.com/pulumi/pulumi/pull/19882)

- \[backend/service] Improve startup performance with the service as
backend
[#&#8203;21176](https://redirect.github.com/pulumi/pulumi/pull/21176)

- \[sdk/nodejs] Add support for `replacement_trigger` in the NodeJS SDK
[#&#8203;20939](https://redirect.github.com/pulumi/pulumi/pull/20939)

-   \[sdk/python] Allow setting version for python component providers
[#&#8203;21149](https://redirect.github.com/pulumi/pulumi/pull/21149)

##### Bug Fixes

- \[cli/package] Correctly identify the innermost Project/Plugin when
running `pulumi package add`
[#&#8203;21137](https://redirect.github.com/pulumi/pulumi/pull/21137)

- \[engine] Allow referencing multiple git/github/gitlab components from
the same repo
[#&#8203;21119](https://redirect.github.com/pulumi/pulumi/pull/21119)

- \[programgen/go] Account for name conflicts in resource creation
functions
[#&#8203;21107](https://redirect.github.com/pulumi/pulumi/pull/21107)

- \[sdk/python] Fix cancellation handling in a few places in the python
language host
[#&#8203;21145](https://redirect.github.com/pulumi/pulumi/pull/21145)

- \[sdkgen/go] Fix generation of lifted single-value calls in
parameterized SDKs
[#&#8203;21115](https://redirect.github.com/pulumi/pulumi/pull/21115)

##### Miscellaneous

- \[cli] Don't attempt to re-install plugin dependencies on load failure
for plugins based on git with a nested path
[#&#8203;21148](https://redirect.github.com/pulumi/pulumi/pull/21148)

- \[sdk/{dotnet,java,yaml}] Bump language runtimes for dotnet, java, and
yaml
[#&#8203;21201](https://redirect.github.com/pulumi/pulumi/pull/21201)

-   \[cli/engine] Add language runtime metadata to update metadata
[#&#8203;21186](https://redirect.github.com/pulumi/pulumi/pull/21186)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-12-12 05:11:26 +00:00
pulumi-renovate[bot]
16f3939ae0 Update dependency @pulumi/pulumi to v3.210.0 (#694)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.209.0` ->
`3.210.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.209.0/3.210.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.210.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.210.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.209.0...v3.210.0)

#### 3.210.0 (2025-12-03)

##### Features

-   \[cli/about] Print python toolchain information in `pulumi about`

-   \[sdk/java] Update java to v1.18

- \[components/nodejs] Local components will use the version from
package.json rather than 0.0.0
[#&#8203;21100](https://redirect.github.com/pulumi/pulumi/pull/21100)

- \[cli/package] Add `pulumi package delete` command to delete package
versions from the Pulumi Registry
[#&#8203;21069](https://redirect.github.com/pulumi/pulumi/pull/21069)

- \[cli/package] Always print the schema first in `package get-schema`,
then print any binding errors
[#&#8203;21080](https://redirect.github.com/pulumi/pulumi/pull/21080)

-   \[sdk/python] Require `grpcio>=1.75.1` on Python 3.14
[#&#8203;21113](https://redirect.github.com/pulumi/pulumi/pull/21113)

##### Bug Fixes

- \[sdk/nodejs] Fix ComponentResources transfering input arguments to
output properties automatically
[#&#8203;21094](https://redirect.github.com/pulumi/pulumi/pull/21094)

##### Miscellaneous

- \[sdk/nodejs] Remove
[@&#8203;types/uuid](https://redirect.github.com/types/uuid) type
declarations dev dependency
[#&#8203;21077](https://redirect.github.com/pulumi/pulumi/pull/21077)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-12-03 21:28:06 +00:00
pulumi-renovate[bot]
31065543d9 Update dependency @pulumi/pulumi to v3.209.0 (#682)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.208.0` ->
`3.209.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.208.0/3.209.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.209.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.209.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.208.0...v3.209.0)

##### 3.209.0 (2025-11-26)

##### Features

- \[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run `pulumi login --help` for more information.
[#&#8203;20974](https://redirect.github.com/pulumi/pulumi/pull/20974)

-   \[sdk/python] Allow older grpcio and protobuf dependencies
[#&#8203;21007](https://redirect.github.com/pulumi/pulumi/pull/21007)

- \[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
[#&#8203;21034](https://redirect.github.com/pulumi/pulumi/pull/21034)

##### Bug Fixes

- \[cli/install] Correctly install non-standard plugins.
See[https://github.com/pulumi/pulumi/issues/20953](https://redirect.github.com/pulumi/pulumi/issues/20953)3
for more information
[#&#8203;20983](https://redirect.github.com/pulumi/pulumi/pull/20983)

- \[cli/new] Create pyproject.toml for uv and poetry projects when using
--generate-only
[#&#8203;20979](https://redirect.github.com/pulumi/pulumi/pull/20979)

-   \[sdk/nodejs] Fix serialization errors due to SxS copies of the SDK
[#&#8203;21029](https://redirect.github.com/pulumi/pulumi/pull/21029)

-   \[sdk/python] Add `PropertyValue` runtime validation checks
[#&#8203;21058](https://redirect.github.com/pulumi/pulumi/pull/21058)

##### Miscellaneous

- \[engine] Don't send root directory and runtime options to language
plugins as command line arguments
[#&#8203;21054](https://redirect.github.com/pulumi/pulumi/pull/21054)

- \[sdk/{dotnet,java,yaml}] Bump language runtimes for yaml, dotnet and
java

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-11-26 16:17:55 +00:00
pulumi-renovate[bot]
68d5f3a0cb Update first-party Pulumi dependencies (#677)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [pulumi/esc-action](https://redirect.github.com/pulumi/esc-action) |
action | minor | `v1.4.0` -> `v1.5.0` |
|
[pulumi/provider-version-action](https://redirect.github.com/pulumi/provider-version-action)
| action | patch | `v1.6.0` -> `v1.6.1` |

---

### Release Notes

<details>
<summary>pulumi/esc-action (pulumi/esc-action)</summary>

###
[`v1.5.0`](https://redirect.github.com/pulumi/esc-action/releases/tag/v1.5.0)

[Compare
Source](https://redirect.github.com/pulumi/esc-action/compare/v1.4.0...v1.5.0)

- Fix line parsing when "=" is present
[https://github.com/pulumi/esc-action/pull/30](https://redirect.github.com/pulumi/esc-action/pull/30)

</details>

<details>
<summary>pulumi/provider-version-action
(pulumi/provider-version-action)</summary>

###
[`v1.6.1`](https://redirect.github.com/pulumi/provider-version-action/releases/tag/v1.6.1)

[Compare
Source](https://redirect.github.com/pulumi/provider-version-action/compare/v1.6.0...v1.6.1)

#### What's Changed

- Automate floating tag updates and document release process by
[@&#8203;EronWright](https://redirect.github.com/EronWright) in
[https://github.com/pulumi/provider-version-action/pull/17](https://redirect.github.com/pulumi/provider-version-action/pull/17)
- Update dependencies for v1.6.1 by
[@&#8203;EronWright](https://redirect.github.com/EronWright) in
[https://github.com/pulumi/provider-version-action/pull/18](https://redirect.github.com/pulumi/provider-version-action/pull/18)

#### New Contributors

- [@&#8203;EronWright](https://redirect.github.com/EronWright) made
their first contribution in
[https://github.com/pulumi/provider-version-action/pull/17](https://redirect.github.com/pulumi/provider-version-action/pull/17)

**Full Changelog**:
https://github.com/pulumi/provider-version-action/compare/v1...v1.6.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-11-26 01:13:49 +00:00
Pulumi Bot
98fc73df74 Update GitHub Actions workflows. (#676)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit ad6b9bc68e26fd3eeb270fe212ab46888a1580e3.
2025-11-22 05:45:33 +00:00
pulumi-renovate[bot]
2bf4175cae Update pulumi/esc-action action to v1.5.0 (#674)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [pulumi/esc-action](https://redirect.github.com/pulumi/esc-action) |
action | minor | `v1.4.0` -> `v1.5.0` |

---

### Release Notes

<details>
<summary>pulumi/esc-action (pulumi/esc-action)</summary>

###
[`v1.5.0`](https://redirect.github.com/pulumi/esc-action/releases/tag/v1.5.0)

[Compare
Source](https://redirect.github.com/pulumi/esc-action/compare/v1.4.0...v1.5.0)

- Fix line parsing when "=" is present
[https://github.com/pulumi/esc-action/pull/30](https://redirect.github.com/pulumi/esc-action/pull/30)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-11-21 06:06:38 +00:00
Pulumi Bot
345f4699a8 Update GitHub Actions workflows. (#673)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 8419353a43302449e0cd6d525c08e2d9f4479dd8.
2025-11-21 05:56:36 +00:00
pulumi-renovate[bot]
d5d676f8ec Update first-party Pulumi dependencies (#558)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.184.0` ->
`3.208.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.184.0/3.208.0)
|
| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) |
indirect | minor | `v0.17.0` -> `v0.20.0` |
| [pulumi/esc-action](https://redirect.github.com/pulumi/esc-action) |
action | minor | `v1.4.0` -> `v1.5.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.208.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.208.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.207.0...v3.208.0)

#### 3.208.0 (2025-11-20)

##### Features

- \[cli] Expose all command flags as env vars (e.g. --refresh can now be
set with PULUMI_OPTION_REFRESH)
[#&#8203;20868](https://redirect.github.com/pulumi/pulumi/pull/20868)

-   \[cli/install] Make `pulumi install` recurse into local packages
[#&#8203;20945](https://redirect.github.com/pulumi/pulumi/pull/20945)

- \[engine] Add a `replacement_trigger` resource option. Any change to
this value between program runs will trigger a replace of the resource
[#&#8203;20936](https://redirect.github.com/pulumi/pulumi/pull/20936)

- \[engine] Add a new builtin `Stash` resource which can be used to save
a value to state
[#&#8203;20819](https://redirect.github.com/pulumi/pulumi/pull/20819)

-   \[protobuf] Add `Language.Template` RPC to protos
[#&#8203;20948](https://redirect.github.com/pulumi/pulumi/pull/20948)

-   \[sdk/go] Add support for `replacement_trigger` in the Go SDK
[#&#8203;20937](https://redirect.github.com/pulumi/pulumi/pull/20937)

##### Bug Fixes

- \[engine] Fix duplicate resource snapshot integrity issue with aliases
[#&#8203;20926](https://redirect.github.com/pulumi/pulumi/pull/20926)

- \[engine] Allow resources marked as `Delete` to be targeted, and take
them into account for dependency calculation
[#&#8203;20962](https://redirect.github.com/pulumi/pulumi/pull/20962)

- \[engine] Fix a panic when previewing and import of a resource that
wants to delete and then replace due to diffs
[#&#8203;20997](https://redirect.github.com/pulumi/pulumi/pull/20997)

-   \[pkg] Include invalid property names in bind errors
[#&#8203;20989](https://redirect.github.com/pulumi/pulumi/pull/20989)

- \[sdk/python] Don’t raise when looking up a stack reference output
that does not exist
[#&#8203;20938](https://redirect.github.com/pulumi/pulumi/pull/20938)

- \[sdkgen/python] Ensure resource args accept typeddicts when no
language info is specified
[#&#8203;20982](https://redirect.github.com/pulumi/pulumi/pull/20982)

##### Miscellaneous

- \[cli] Document the \[template|url] argument in `pulumi up` command
help text
[#&#8203;20996](https://redirect.github.com/pulumi/pulumi/pull/20996)

###
[`v3.207.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32070-2025-11-12)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.206.0...v3.207.0)

##### Features

- \[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
[#&#8203;20817](https://redirect.github.com/pulumi/pulumi/pull/20817)

- \[engine] Add `ReplaceWith` resource option to allow one resource's
replace operations to trigger another's
[#&#8203;20693](https://redirect.github.com/pulumi/pulumi/pull/20693)

-   \[sdkgen/python] Allow all PEP440 version specifiers to be used

##### Bug Fixes

-   \[cli/import] Return errors when an import fails
[#&#8203;20904](https://redirect.github.com/pulumi/pulumi/pull/20904)

- \[engine] Fix parenting of resources in some cases in `refresh
--run-program`
[#&#8203;20894](https://redirect.github.com/pulumi/pulumi/pull/20894)

-   \[engine] Fix StackReference secrets performance
[#&#8203;20908](https://redirect.github.com/pulumi/pulumi/pull/20908)

-   \[programgen] Do not panic when re-writing type-invalid PCL
[#&#8203;20770](https://redirect.github.com/pulumi/pulumi/pull/20770)

- \[sdk/go] Fix import path in instructions when linking a package in Go
[#&#8203;20888](https://redirect.github.com/pulumi/pulumi/pull/20888)

-   \[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
[#&#8203;20913](https://redirect.github.com/pulumi/pulumi/pull/20913)

- \[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests

- \[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
[#&#8203;20917](https://redirect.github.com/pulumi/pulumi/pull/20917)

##### Miscellaneous

-   \[engine] Stop sending ConfigPropertyMap as part of RunRequest
[#&#8203;20887](https://redirect.github.com/pulumi/pulumi/pull/20887)

###
[`v3.206.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32060-2025-11-05)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.205.0...v3.206.0)

##### Features

- \[protobuf] Pass a `preview` flag to invokes so they can tell if
they're being called during a preview
[#&#8203;20827](https://redirect.github.com/pulumi/pulumi/pull/20827)

- \[cli/about] Include PULUMI_\* environment variables in the `pulumi
about` output
[#&#8203;20855](https://redirect.github.com/pulumi/pulumi/pull/20855)

- \[auto/go] Get event log over gRPC instead of trying to read it from a
text file
[#&#8203;20822](https://redirect.github.com/pulumi/pulumi/pull/20822)

- \[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
[#&#8203;20824](https://redirect.github.com/pulumi/pulumi/pull/20824)

- \[auto/python] Get event log over gRPC instead of trying to read it
from a text file
[#&#8203;20833](https://redirect.github.com/pulumi/pulumi/pull/20833)

- \[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
[#&#8203;20797](https://redirect.github.com/pulumi/pulumi/pull/20797)

- \[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
[#&#8203;20842](https://redirect.github.com/pulumi/pulumi/pull/20842)

##### Bug Fixes

- \[engine] Fix duplicate resource snapshot integrity issue, when
running `pulumi up --refresh --run-program` and when a resource
`PendingReplacement` exists in the snapshot
[#&#8203;20812](https://redirect.github.com/pulumi/pulumi/pull/20812)

- \[engine] Support floating point NaN and Inf values in resource state
[#&#8203;20843](https://redirect.github.com/pulumi/pulumi/pull/20843)

##### Miscellaneous

-   \[sdk/go] Use Language.Link to link Go packages
[#&#8203;20811](https://redirect.github.com/pulumi/pulumi/pull/20811)

###
[`v3.205.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32050-2025-10-28)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.204.0...v3.205.0)

##### Bug Fixes

- \[cli/display] Improve how the severity is displayed for policy
violations
[#&#8203;20805](https://redirect.github.com/pulumi/pulumi/pull/20805)

- \[engine] Fix an issue where `refresh --run-program` could potentially
run forever
[#&#8203;20781](https://redirect.github.com/pulumi/pulumi/pull/20781)

###
[`v3.204.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32040-2025-10-23)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.203.0...v3.204.0)

##### Features

- \[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
[#&#8203;20762](https://redirect.github.com/pulumi/pulumi/pull/20762)

-   \[engine] Support overriding policy severity on violations
[#&#8203;20767](https://redirect.github.com/pulumi/pulumi/pull/20767)

- \[backend/service] Send journal entries to the backend if it's
supported
[#&#8203;20343](https://redirect.github.com/pulumi/pulumi/pull/20343)

##### Bug Fixes

- \[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using `destroy --run-program`
[#&#8203;20692](https://redirect.github.com/pulumi/pulumi/pull/20692)

- \[engine] Fix import error to contain the import ID of non-existent
resources
[#&#8203;20753](https://redirect.github.com/pulumi/pulumi/pull/20753)

- \[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
[#&#8203;20774](https://redirect.github.com/pulumi/pulumi/pull/20774)

- \[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
[#&#8203;20769](https://redirect.github.com/pulumi/pulumi/pull/20769)

-   \[sdkgen/go] Fix codegen of scalar return SDK functions
[#&#8203;20754](https://redirect.github.com/pulumi/pulumi/pull/20754)

- \[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
[#&#8203;20747](https://redirect.github.com/pulumi/pulumi/pull/20747)

##### Miscellaneous

-   \[sdk/nodejs] Use Language.Link to link Node.js packages
[#&#8203;20715](https://redirect.github.com/pulumi/pulumi/pull/20715)

###
[`v3.203.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32030-2025-10-15)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.202.0...v3.203.0)

##### Features

-   \[cli/display] Display policy severity for violations
[#&#8203;20746](https://redirect.github.com/pulumi/pulumi/pull/20746)

-   \[cli/package] Show functions in `package info`
[#&#8203;20733](https://redirect.github.com/pulumi/pulumi/pull/20733)

##### Bug Fixes

- \[engine] Make sure errors from the journaler are not shown to the
user
[#&#8203;20740](https://redirect.github.com/pulumi/pulumi/pull/20740)

-   \[backend/diy] Fix casing of stack/latest when importing stacks
[#&#8203;20727](https://redirect.github.com/pulumi/pulumi/pull/20727)

- \[cli/package] Fix 'required' flag for resource inputs in `package
info`
[#&#8203;20731](https://redirect.github.com/pulumi/pulumi/pull/20731)

- \[programgen] Revert
[#&#8203;20345](https://redirect.github.com/pulumi/pulumi/issues/20345)
[#&#8203;20714](https://redirect.github.com/pulumi/pulumi/pull/20714)

- \[programgen/{dotnet,nodejs}] Propagate local dependencies for
parameterized packages during convert down to GenerateProject
[#&#8203;20706](https://redirect.github.com/pulumi/pulumi/pull/20706)

- \[sdkgen/python] Fix python invokes for functions returning map types
[#&#8203;20719](https://redirect.github.com/pulumi/pulumi/pull/20719)

##### Miscellaneous

-   \[sdk/python] Use Language.Link to link python packages
[#&#8203;20612](https://redirect.github.com/pulumi/pulumi/pull/20612)

###
[`v3.202.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32020-2025-10-10)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.201.0...v3.202.0)

##### Features

-   \[auto] Add SetAllConfigJson method to automation APIs
[#&#8203;20709](https://redirect.github.com/pulumi/pulumi/pull/20709)

-   \[cli/config] Add `--json` input support to `pulumi config set-all`
[#&#8203;19427](https://redirect.github.com/pulumi/pulumi/pull/19427)

-   \[cli/display] Add error summary at the end of Resource changes
[#&#8203;20658](https://redirect.github.com/pulumi/pulumi/pull/20658)

- \[components/{go,nodejs}] Send component inputs to be saved in state.
This brings NodeJS and Go inline with Python behaviour
[#&#8203;20357](https://redirect.github.com/pulumi/pulumi/pull/20357)

-   \[sdk/python] Add support for Python 3.14
[#&#8203;20433](https://redirect.github.com/pulumi/pulumi/pull/20433)

-   \[sdk/python] Add the `hide_diffs` resource option
[#&#8203;20655](https://redirect.github.com/pulumi/pulumi/pull/20655)

##### Bug Fixes

- \[engine] Fix assert when a resource that's not targeted on a destroy
is marked as Delete
[#&#8203;20684](https://redirect.github.com/pulumi/pulumi/pull/20684)

-   \[sdk/nodejs] Allow compiled local SDKs to be parameterized
[#&#8203;20685](https://redirect.github.com/pulumi/pulumi/pull/20685)

- \[sdk/nodejs] Handle RangeErrors from util.inspect stringifying error
objects
[#&#8203;20705](https://redirect.github.com/pulumi/pulumi/pull/20705)

###
[`v3.201.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32010-2025-10-06)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.200.0...v3.201.0)

##### Features

-   \[sdkgen/go] Support non-object return types in functions
[#&#8203;20646](https://redirect.github.com/pulumi/pulumi/pull/20646)

##### Bug Fixes

-   \[backend/service] Fix the --insecure flag in `pulumi login`

###
[`v3.200.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32000-2025-10-03)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.199.0...v3.200.0)

##### Features

- \[cli] Look for .cmd and .ps1 extensions as well on Windows when
looking for executables
[#&#8203;20637](https://redirect.github.com/pulumi/pulumi/pull/20637)

-   \[sdk/go] Add a new resource option: `HideDiffs`
[#&#8203;20631](https://redirect.github.com/pulumi/pulumi/pull/20631)

-   \[sdk/nodejs] Add a new resource option: `hideDiffs`
[#&#8203;20631](https://redirect.github.com/pulumi/pulumi/pull/20631)

-   \[sdkgen/python] Support non-object return types in functions
[#&#8203;20624](https://redirect.github.com/pulumi/pulumi/pull/20624)

##### Bug Fixes

-   \[build] Use ruff to auto fix lints in python
[#&#8203;20644](https://redirect.github.com/pulumi/pulumi/pull/20644)

-   \[sdk/nodejs] Make new arguments to `initialize` optional
[#&#8203;20650](https://redirect.github.com/pulumi/pulumi/pull/20650)

-   \[sdkgen/nodejs] Generate a .gitignore file inside local SDKs
[#&#8203;20643](https://redirect.github.com/pulumi/pulumi/pull/20643)

- \[cli/state] Treat providers that are marked as parents in a move as
providers still instead of as regular resources
[#&#8203;20639](https://redirect.github.com/pulumi/pulumi/pull/20639)

- \[cli/state] Exclude root stack correctly when moving resources and
when --include-parents is passed

###
[`v3.199.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31990-2025-10-01)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.198.0...v3.199.0)

##### Features

-   \[cli/about] Add `pulumi about env` to help
[#&#8203;20633](https://redirect.github.com/pulumi/pulumi/pull/20633)

- \[cli/{about,new}] Add environment variables to override template
repository settings. The new PULUMI_TEMPLATE_GIT_REPOSITORY,
PULUMI_TEMPLATE_BRANCH, PULUMI_POLICY_TEMPLATE_GIT_REPOSITORY, and
PULUMI_POLICY_TEMPLATE_BRANCH environment variables allow runtime
customization of template sources
[#&#8203;20615](https://redirect.github.com/pulumi/pulumi/pull/20615)

- \[cli/{install,package}] Add support for package references in plugins
[#&#8203;20524](https://redirect.github.com/pulumi/pulumi/pull/20524)

- \[sdk/nodejs] Pass options, name, and type to ComponentResources
initialize methods
[#&#8203;20618](https://redirect.github.com/pulumi/pulumi/pull/20618)

-   \[cli/policy] Send vcs metadata when publishing policy packs
[#&#8203;20528](https://redirect.github.com/pulumi/pulumi/pull/20528)

##### Bug Fixes

-   \[cli/display] Always send diag events to stderr in the diff display
[#&#8203;20632](https://redirect.github.com/pulumi/pulumi/pull/20632)

-   \[components] Stop including auth info in plugin name
[#&#8203;20620](https://redirect.github.com/pulumi/pulumi/pull/20620)

-   \[engine] Support the import option in resource transforms
[#&#8203;20586](https://redirect.github.com/pulumi/pulumi/pull/20586)

- \[programgen] Fix panic in parseProxyApply when encoutering warning
diagnostics
[#&#8203;20583](https://redirect.github.com/pulumi/pulumi/pull/20583)

- \[sdk/nodejs] Don't attempt to serialise function values for resource
inputs/outputs
[#&#8203;20621](https://redirect.github.com/pulumi/pulumi/pull/20621)

###
[`v3.198.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31980-2025-09-26)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.197.0...v3.198.0)

##### Features

-   \[engine] Expand snapshot integrity check for resources
[#&#8203;20519](https://redirect.github.com/pulumi/pulumi/pull/20519)

- \[sdk/go] Refactor Go policy SDK to have access to a pulumi Context
object
[#&#8203;20570](https://redirect.github.com/pulumi/pulumi/pull/20570)

- \[sdk/python] Allow registered resources to be retrieved from the mock
monitor for test assertions
[#&#8203;20540](https://redirect.github.com/pulumi/pulumi/pull/20540)

##### Bug Fixes

- \[engine] Fix snapshot integrity error with `run-program --refresh`,
when a provider has a dependency that isn't being created
[#&#8203;20541](https://redirect.github.com/pulumi/pulumi/pull/20541)

-   \[engine] Remove unneeded data from policy summary events
[#&#8203;20589](https://redirect.github.com/pulumi/pulumi/pull/20589)

-   \[sdk] Fix plugin killing during cancellation
[#&#8203;20543](https://redirect.github.com/pulumi/pulumi/pull/20543)

-   \[sdk/go] Fix \[Unm/M]arshalProperties to return nil when given nil
[#&#8203;20544](https://redirect.github.com/pulumi/pulumi/pull/20544)

##### Miscellaneous

-   \[protobuf] Add loader_target to LanguageRuntime.LinkRequest
[#&#8203;20552](https://redirect.github.com/pulumi/pulumi/pull/20552)

- \[cli/package] Move InstallPackage from cmd/packagecmd to cmd/packages
[#&#8203;20550](https://redirect.github.com/pulumi/pulumi/pull/20550)

-   \[cli/package] Move stdout/stderr IO out of GenSDK and LinkPackage
[#&#8203;20546](https://redirect.github.com/pulumi/pulumi/pull/20546)

-   \[sdk] Move PluginSpec.Install to pkg/workspace.InstallPluginContent
[#&#8203;20537](https://redirect.github.com/pulumi/pulumi/pull/20537)

-   \[sdk/yaml] Bump pulumi-yaml to 1.23.2
[#&#8203;20588](https://redirect.github.com/pulumi/pulumi/pull/20588)

###
[`v3.197.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31970-2025-09-17)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.196.0...v3.197.0)

##### Features

-   \[cli] Send new policy fields when publishing a policy pack

-   \[sdk/dotnet] Update dotnet to v3.88
[#&#8203;20512](https://redirect.github.com/pulumi/pulumi/pull/20512)

##### Bug Fixes

- \[engine] Fix a panic in preview, that could happen in some cases when
default providers get updated
[#&#8203;20511](https://redirect.github.com/pulumi/pulumi/pull/20511)

-   \[components/python] Fix parenting of python components
[#&#8203;20508](https://redirect.github.com/pulumi/pulumi/pull/20508)

- \[sdk/python] Fix hang when shutting down in certain error conditions
[#&#8203;20484](https://redirect.github.com/pulumi/pulumi/pull/20484)

-   \[sdk/python] Fix license-files entry for python package
[#&#8203;20506](https://redirect.github.com/pulumi/pulumi/pull/20506)

###
[`v3.196.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31960-2025-09-12)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.195.0...v3.196.0)

##### Miscellaneous

-   \[sdk] Add policy summary events apitypes
[#&#8203;20443](https://redirect.github.com/pulumi/pulumi/pull/20443)

-   \[sdk] Add new policy fields apitypes
[#&#8203;20491](https://redirect.github.com/pulumi/pulumi/pull/20491)

-   \[protobuf] Add support for indicating "not applicable" policies
[#&#8203;20492](https://redirect.github.com/pulumi/pulumi/pull/20492)

-   \[protobuf] Add new analyzer policy fields
[#&#8203;20494](https://redirect.github.com/pulumi/pulumi/pull/20494)

###
[`v3.195.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31950-2025-09-10)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.194.0...v3.195.0)

##### Features

- \[engine] Add support for capturing program stack traces as part of
resource registration
[#&#8203;20430](https://redirect.github.com/pulumi/pulumi/pull/20430)

- \[sdk/go] Registered resources can now be retrieved from the mock
monitor for test assertions
[#&#8203;20472](https://redirect.github.com/pulumi/pulumi/pull/20472)

- \[sdk/go] The current exports map is now available for unit testing
through `GetCurrentExportMap`
[#&#8203;20471](https://redirect.github.com/pulumi/pulumi/pull/20471)

##### Bug Fixes

- \[pkg/go] Fix an issue where v3.194.0 of the
`github.com/pulumi/pulumi/pkg/v3` module depends on APIs from
`github.com/pulumi/pulumi/sdk/v3` that haven't been released
[#&#8203;20487](https://redirect.github.com/pulumi/pulumi/issues/20487)

###
[`v3.194.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31940-2025-09-08)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.193.0...v3.194.0)

##### Features

-   \[cli] Log diagnostics to stderr instead of stdout
[#&#8203;20461](https://redirect.github.com/pulumi/pulumi/pull/20461)

- \[cli/display] Change the default for --show-full-output from true to
false
[#&#8203;20467](https://redirect.github.com/pulumi/pulumi/pull/20467)

-   \[cli/display] Fix the --show-full-output the flag
[#&#8203;20464](https://redirect.github.com/pulumi/pulumi/pull/20464)

-   \[sdk/go] Show a message that the Go program is being compiled
[#&#8203;20460](https://redirect.github.com/pulumi/pulumi/pull/20460)

##### Bug Fixes

-   \[engine] Make ignoreChanges work better for arrays
[#&#8203;20465](https://redirect.github.com/pulumi/pulumi/pull/20465)

- \[programgen] Fix panic in RewriteApplies when encountering warning
diagnostics
[#&#8203;20453](https://redirect.github.com/pulumi/pulumi/pull/20453)

##### Miscellaneous

- \[cli] No longer require the `PULUMI_EXPERIMENTAL` flag for Private
Registry template operations (`pulumi template publish`, registry-based
template resolution in `pulumi new`), while registry-backed template
resolution in `pulumi new` may still be disabled using
`PULUMI_DISABLE_REGISTRY_RESOLVE=true pulumi new`
[#&#8203;20458](https://redirect.github.com/pulumi/pulumi/pull/20458)

-   \[sdk/yaml] Bump pulumi-yaml to 1.23.1

###
[`v3.193.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31930-2025-09-04)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.192.0...v3.193.0)

##### Bug Fixes

- \[cli] Use "Private Registry", not cloud or Pulumi registry, in CLI
output
[#&#8203;20436](https://redirect.github.com/pulumi/pulumi/pull/20436)

- \[cli/display] Avoid printing a double new line when showing secrets
in the outputs
[#&#8203;20435](https://redirect.github.com/pulumi/pulumi/pull/20435)

-   \[cli/display] Fix coloring of cobra error messages on windows

- \[cli/{install,package}] Fix local package resolution when
PULUMI_EXPERIMENTAL=true by including local packages in registry
fallback logic
[#&#8203;20413](https://redirect.github.com/pulumi/pulumi/pull/20413)

- \[cli/new] Fail when running with --language without --ai in
non-interactive mode
[#&#8203;20415](https://redirect.github.com/pulumi/pulumi/pull/20415)

- \[cli/package] Fix not using already-installed package in 'pulumi
package add' when PULUMI_EXPERIMENTAL=1

##### Miscellaneous

-   \[cli] Start the pprof server when receving SIGUSR1
[#&#8203;20392](https://redirect.github.com/pulumi/pulumi/pull/20392)

-   \[cli/display] Replace ijc/Gotty terminfo package with xo/terminfo
[#&#8203;20446](https://redirect.github.com/pulumi/pulumi/pull/20446)

- \[cli/display] Use the passed through writer in ShowProgressOutput
instead of loading a new terminfo

###
[`v3.192.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31920-2025-08-29)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.191.0...v3.192.0)

##### Features

- \[cli/state] Add pulumi state taint/untaint commands to force
replacement of resources upon next update
[#&#8203;20380](https://redirect.github.com/pulumi/pulumi/pull/20380)

- \[sdk/nodejs] Add `previewDestroy` to allow dry-runs of `destroy`
commands
[#&#8203;20371](https://redirect.github.com/pulumi/pulumi/pull/20371)

##### Bug Fixes

- \[engine] Fix a bug causing hooks to never pass correctly to remote Go
components
[#&#8203;20390](https://redirect.github.com/pulumi/pulumi/pull/20390)

-   \[sdk/go] Fix source position information
[#&#8203;20351](https://redirect.github.com/pulumi/pulumi/pull/20351)

- \[sdk/nodejs] Fix function serialisation that contains minified
classes
[#&#8203;19345](https://redirect.github.com/pulumi/pulumi/pull/19345)

- \[sdkgen/nodejs] Limit
[@&#8203;types](https://redirect.github.com/types) packages used during
local SDK generation
[#&#8203;20387](https://redirect.github.com/pulumi/pulumi/pull/20387)

-   \[sdk/python] Set ThreadPoolExecutor max_workers to parallelism \* 4
[#&#8203;20362](https://redirect.github.com/pulumi/pulumi/pull/20362)

-   \[sdk/python] Handle `-v` flag passed to policy packs
[#&#8203;20373](https://redirect.github.com/pulumi/pulumi/pull/20373)

-   \[sdk/python] Forward errors raised in callbacks to the caller
[#&#8203;20381](https://redirect.github.com/pulumi/pulumi/pull/20381)

##### Miscellaneous

-   \[cli] Log stack trace when interrupted when using verbose logging
[#&#8203;20364](https://redirect.github.com/pulumi/pulumi/pull/20364)

- \[cli] Print the location of the log file when running with the
verbose flag
[#&#8203;20365](https://redirect.github.com/pulumi/pulumi/pull/20365)

-   \[sdk/python] Remove custom typing stubs
[#&#8203;20384](https://redirect.github.com/pulumi/pulumi/pull/20384)

###
[`v3.191.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31910-2025-08-21)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.190.0...v3.191.0)

##### Features

-   \[cli] Document the `PULUMI_ENABLE_STREAMING_JSON_PREVIEW` envvar.
[#&#8203;20328](https://redirect.github.com/pulumi/pulumi/pull/20328)

##### Bug Fixes

- \[engine] Check providers returning 'version' or '\__internal' in
their inputs
[#&#8203;20313](https://redirect.github.com/pulumi/pulumi/pull/20313)

-   \[engine] Fix a panic with `refresh --run-program`
[#&#8203;20337](https://redirect.github.com/pulumi/pulumi/pull/20337)

- \[engine] Fix an infinite loop from passing unordered resources to the
dependency system when using --refresh

- \[programgen] Emit warnings instead of errors in non-strict mode when
binding resource blocks
[#&#8203;20347](https://redirect.github.com/pulumi/pulumi/pull/20347)

- \[programgen] Simplify range value types when it is derived from
object of objects and warn on unknown properties
[#&#8203;20345](https://redirect.github.com/pulumi/pulumi/pull/20345)

- \[programgen] Warn instead of erroring out when traversing a NoneType
in PCL
[#&#8203;20342](https://redirect.github.com/pulumi/pulumi/pull/20342)

-   \[cli/display] Escape non-graphic characters in URNs
[#&#8203;20295](https://redirect.github.com/pulumi/pulumi/pull/20295)

- \[cli/import] Disambiguate duplicate resource names by their types
when importing
[#&#8203;20348](https://redirect.github.com/pulumi/pulumi/pull/20348)

-   \[cli/new] Don't prompt for ai or template when passing --yes
[#&#8203;20256](https://redirect.github.com/pulumi/pulumi/pull/20256)

##### Miscellaneous

-   \[cli] Log version and CLI metadata
[#&#8203;20334](https://redirect.github.com/pulumi/pulumi/pull/20334)

-   \[cli/package] Pass ParameterizeParameters to SchemaFromSchemaSource
[#&#8203;20324](https://redirect.github.com/pulumi/pulumi/pull/20324)

###
[`v3.190.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31900-2025-08-15)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.189.0...v3.190.0)

##### Features

- \[engine] Don't error on `ignoreChanges` paths that are missing old
data, there is nothing to ignore in those cases and we just use the new
data
[#&#8203;20278](https://redirect.github.com/pulumi/pulumi/pull/20278)

##### Bug Fixes

- \[cli] Fix `destroy --exclude-protected --remove` returning an error
for empty stacks that could safely be removed
[#&#8203;20283](https://redirect.github.com/pulumi/pulumi/pull/20283)

- \[cli] Fix `pulumi template publish` failing with relative paths by
normalizing to absolute paths before archive creation
[#&#8203;20301](https://redirect.github.com/pulumi/pulumi/pull/20301)

- \[cli/import] Use mapped name instead of logical name for resource
references during import code generation
[#&#8203;20300](https://redirect.github.com/pulumi/pulumi/pull/20300)

- \[pkg] Make TypeScript code generation use 'declare' keyword instead
of definite assertion operator, to avoid setting all fields to undefined
when targeting environments new enough
[#&#8203;20261](https://redirect.github.com/pulumi/pulumi/pull/20261)

-   \[sdkgen/nodejs] Make TypeScript a full dependency of local SDKs
[#&#8203;20272](https://redirect.github.com/pulumi/pulumi/pull/20272)

##### Miscellaneous

- \[build] Updates protobuf and grpc to v5, bumping dependencies in the
Go, Node.js, and Python SDKs
[#&#8203;19588](https://redirect.github.com/pulumi/pulumi/pull/19588)

-   \[build] Update latest Go version to 1.25
[#&#8203;20284](https://redirect.github.com/pulumi/pulumi/pull/20284)

-   \[sdkgen/nodejs] Target ES2020 for generated SDKs
[#&#8203;20276](https://redirect.github.com/pulumi/pulumi/pull/20276)

###
[`v3.189.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31890-2025-08-12)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.188.0...v3.189.0)

##### Features

-   \[sdk] Remove CacheMS from CLIVersionResponse
[#&#8203;20264](https://redirect.github.com/pulumi/pulumi/pull/20264)

-   \[sdk/go] Calculate PluginInfo.Size on demand
[#&#8203;20241](https://redirect.github.com/pulumi/pulumi/pull/20241)

- \[auto/python] Surface `json` option to `pulumi preview` calls in
Python when using the `pulumi.automation` package.
[#&#8203;20233](https://redirect.github.com/pulumi/pulumi/pull/20233)

##### Bug Fixes

- \[cli/package] Fix incorrect console URLs being displayed after
publishing a policy
[#&#8203;20255](https://redirect.github.com/pulumi/pulumi/pull/20255)

-   \[engine] Fix race when reading plugin stdout
[#&#8203;20242](https://redirect.github.com/pulumi/pulumi/pull/20242)

-   \[sdk/nodejs] Fix component providers when using pnpm
[#&#8203;20253](https://redirect.github.com/pulumi/pulumi/pull/20253)

##### Miscellaneous

- \[pkg] Make TypeScript code generation use nullish coalesce operator
for required property checks, as well as state and args accessing
whenever sensible

- \[sdk/nodejs] Fix swapped stderr/stdout callback comments in
PreviewOptions interface
[#&#8203;20250](https://redirect.github.com/pulumi/pulumi/pull/20250)

-   \[sdkgen] Don’t create empty maps for language specific overrides
[#&#8203;20237](https://redirect.github.com/pulumi/pulumi/pull/20237)

###
[`v3.188.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31880-2025-08-07)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.187.0...v3.188.0)

##### Features

- \[cli] Add `--remove-backups` flag to `pulumi stack rm` for DIY
backends
[#&#8203;20203](https://redirect.github.com/pulumi/pulumi/pull/20203)

##### Bug Fixes

-   \[cli] Fix cancellation when running via some CLI wrapper tools
[#&#8203;20195](https://redirect.github.com/pulumi/pulumi/pull/20195)

-   \[cli] Fix concurrent read/write during plugin downloads
[#&#8203;20223](https://redirect.github.com/pulumi/pulumi/pull/20223)

-   \[cli] Restore terminal mode on panic
[#&#8203;20224](https://redirect.github.com/pulumi/pulumi/pull/20224)

-   \[engine] Fix panic in refreshes due to concurrent map writes
[#&#8203;20206](https://redirect.github.com/pulumi/pulumi/pull/20206)

- \[sdkgen] Warn about refs of the form
"#/resources/pulumi:providers:<pkg>"
[#&#8203;20192](https://redirect.github.com/pulumi/pulumi/pull/20192)

-   \[cli/display] Show changed outputs in preview
[#&#8203;20161](https://redirect.github.com/pulumi/pulumi/pull/20161)

- \[cli/engine] Make `--exclude` correctly handle wildcards in all cases
[#&#8203;20158](https://redirect.github.com/pulumi/pulumi/pull/20158)

- \[sdk/go] Fix running against old CLI versions without
SignalAndWaitForShutdown
[#&#8203;20212](https://redirect.github.com/pulumi/pulumi/pull/20212)

-   \[sdk/python] Fix dependency installation in uv workspaces
[#&#8203;20218](https://redirect.github.com/pulumi/pulumi/pull/20218)

##### Miscellaneous

-   \[cli] Update pulumi-dotnet to 3.87.0
[#&#8203;20222](https://redirect.github.com/pulumi/pulumi/pull/20222)

-   \[cli/env] Bump esc to v0.17.0
[#&#8203;20197](https://redirect.github.com/pulumi/pulumi/pull/20197)

###
[`v3.187.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31870-2025-07-31)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.186.0...v3.187.0)

##### Features

-   \[cli] Support for writing v4 checkpoints/deployments
[#&#8203;20159](https://redirect.github.com/pulumi/pulumi/pull/20159)

- \[cli] Add support for qualified registry template names in `pulumi
new`
[#&#8203;20138](https://redirect.github.com/pulumi/pulumi/pull/20138)

- \[cli/import] Enable `pulumi import` to always `--generate-resources`
when converting `--from` state files
[#&#8203;20178](https://redirect.github.com/pulumi/pulumi/pull/20178)

-   \[yaml] Allow config values to be parsed with type `object`
[#&#8203;20132](https://redirect.github.com/pulumi/pulumi/pull/20132)

- \[auto/python] Allow for `on_error` callbacks in commands to capture
stderr incrementally
[#&#8203;20019](https://redirect.github.com/pulumi/pulumi/pull/20019)

-   \[sdk/nodejs] Add option of Bun as a package manager
[#&#8203;18412](https://redirect.github.com/pulumi/pulumi/pull/18412)

-   \[sdk/nodejs] Copy `getRootDirectory` to the pulumi module
[#&#8203;20173](https://redirect.github.com/pulumi/pulumi/pull/20173)

-   \[sdk/python] Copy `get_root_directory` to the pulumi module
[#&#8203;20172](https://redirect.github.com/pulumi/pulumi/pull/20172)

##### Bug Fixes

- \[cli] Fix un-taring registry-backed templates which come in .tar.gz
format
[#&#8203;20135](https://redirect.github.com/pulumi/pulumi/pull/20135)

- \[cli] Stop passing Accept: application/x-tar to registry template
download URLs to avoid signature mismatch
[#&#8203;20133](https://redirect.github.com/pulumi/pulumi/pull/20133)

- \[engine] Fix a panic with `up --refresh --run-program` and resource
replacements
[#&#8203;20147](https://redirect.github.com/pulumi/pulumi/pull/20147)

- \[engine] Untargeted resources in `destroy` now correctly register as
same steps
[#&#8203;20061](https://redirect.github.com/pulumi/pulumi/pull/20061)

- \[cli/engine] Fix hang when waiting for program that would never
complete
[#&#8203;20153](https://redirect.github.com/pulumi/pulumi/pull/20153)

-   \[sdk/nodejs] Fix delete hooks in inline automation API programs
[#&#8203;20143](https://redirect.github.com/pulumi/pulumi/pull/20143)

-   \[sdk/python] Set features inside construct
[#&#8203;20141](https://redirect.github.com/pulumi/pulumi/pull/20141)

##### Miscellaneous

- \[sdk/nodejs] Bump TypeScript target to ES2020 for plugins and policy
packs
[#&#8203;20148](https://redirect.github.com/pulumi/pulumi/pull/20148)

###
[`v3.186.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31860-2025-07-25)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.185.0...v3.186.0)

##### Features

- \[engine] Send `Cancel` message to language runtime plugins on engine
shutdown
[#&#8203;20007](https://redirect.github.com/pulumi/pulumi/pull/20007)

-   \[engine] Pass stack tags to policy plugins on startup
[#&#8203;20084](https://redirect.github.com/pulumi/pulumi/pull/20084)

- \[yaml] Expose `object` as a possible config type in preparation for
`pulumi-yaml` support
[#&#8203;20129](https://redirect.github.com/pulumi/pulumi/pull/20129)

##### Bug Fixes

- \[cli/engine] --exclude and --exclude-protected flags now work
together correctly for `destroy` commands
[#&#8203;20120](https://redirect.github.com/pulumi/pulumi/pull/20120)

-   \[engine] Fix a datarace in the engine event system
[#&#8203;20105](https://redirect.github.com/pulumi/pulumi/pull/20105)

- \[engine] Fix a panic in the engine when running `up --refresh
--run-program` and finding a deleted resource

- \[sdk/nodejs] Avoid "Cannot convert object to primitive value" error
when running into type errors
[#&#8203;20092](https://redirect.github.com/pulumi/pulumi/pull/20092)

- \[sdk/nodejs] Don’t use automatic ESM mode when `—import` or
`—require` is set
[#&#8203;20091](https://redirect.github.com/pulumi/pulumi/pull/20091)

-   \[sdk/nodejs] Fix callback server hang & delete hooks in Node.js
[#&#8203;20109](https://redirect.github.com/pulumi/pulumi/pull/20109)

-   \[sdk/nodejs] Don’t report leaked promises when we exit abnormally
[#&#8203;20128](https://redirect.github.com/pulumi/pulumi/pull/20128)

- \[cli/package] Force new style Go modules to be written out when using
`package add`
[#&#8203;20011](https://redirect.github.com/pulumi/pulumi/pull/20011)

-   \[sdk/python] Run uv sync on uv command
[#&#8203;20117](https://redirect.github.com/pulumi/pulumi/pull/20117)

##### Miscellaneous

-   \[yaml] Update yaml to 1.21.3
[#&#8203;20118](https://redirect.github.com/pulumi/pulumi/pull/20118)

###
[`v3.185.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31850-2025-07-21)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.184.0...v3.185.0)

##### Features

- \[cli/{install,package}] Allow using `pulumi package add` with
registry identifiers
[#&#8203;19928](https://redirect.github.com/pulumi/pulumi/pull/19928)

##### Bug Fixes

- \[engine] Fix a snapshot integrity issue with `destroy --run-program`
and resource reads
[#&#8203;20078](https://redirect.github.com/pulumi/pulumi/pull/20078)

-   \[sdkgen/python] Remove unnecessary `import copy`
[#&#8203;20089](https://redirect.github.com/pulumi/pulumi/pull/20089)

-   \[sdkgen/python] Support properties named "builtins"
[#&#8203;20085](https://redirect.github.com/pulumi/pulumi/pull/20085)

</details>

<details>
<summary>pulumi/esc (github.com/pulumi/esc)</summary>

###
[`v0.20.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.20.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.19.0...v0.20.0)

##### Improvements

-   Added deletion protection for environments:
- Use `esc env settings set
[<org-name>/][<project-name>/]<environment-name> deletion-protected
true` to enable deletion protection
- Use `esc env settings get
[<org-name>/][<project-name>/]<environment-name> [deletion-protected]`
to check the current status
- When enabled, environments cannot be deleted until protection is
disabled
    -   Deletion protection is disabled by default for new environments

##### Bug Fixes

- Environment declarations are now returned even in the face of syntax
errors.

##### Breaking changes

###
[`v0.19.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.19.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.18.0...v0.19.0)

##### Improvements

- Added support for Open Approvals
[#&#8203;592](https://redirect.github.com/pulumi/esc/pull/592)

##### Bug Fixes

##### Breaking changes

###
[`v0.18.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.18.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.17.0...v0.18.0)

##### Improvements

- Added support for `fn::concat` built-in function to concatenate
arrays.
    [#&#8203;582](https://redirect.github.com/pulumi/esc/pull/582)

##### Bug Fixes

##### Breaking changes

</details>

<details>
<summary>pulumi/esc-action (pulumi/esc-action)</summary>

###
[`v1.5.0`](https://redirect.github.com/pulumi/esc-action/releases/tag/v1.5.0)

[Compare
Source](https://redirect.github.com/pulumi/esc-action/compare/v1.4.0...v1.5.0)

- Fix line parsing when "=" is present
[https://github.com/pulumi/esc-action/pull/30](https://redirect.github.com/pulumi/esc-action/pull/30)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xOS4wIiwidXBkYXRlZEluVmVyIjoiMzkuMjY0LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImltcGFjdC9uby1jaGFuZ2Vsb2ctcmVxdWlyZWQiXX0=-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2025-11-20 21:38:09 +00:00
pulumi-renovate[bot]
f1ff9e765f Update vulnerable dependencies [SECURITY] (#671)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/containerd/containerd/v2](https://redirect.github.com/containerd/containerd)
| indirect | patch | `v2.0.3` -> `v2.0.7` |
|
[github.com/go-viper/mapstructure/v2](https://redirect.github.com/go-viper/mapstructure)
| indirect | minor | `v2.0.0` -> `v2.4.0` |
| [github.com/ulikunitz/xz](https://redirect.github.com/ulikunitz/xz) |
indirect | patch | `v0.5.12` -> `v0.5.15` |
| golang.org/x/crypto | indirect | minor | `v0.39.0` -> `v0.45.0` |

### GitHub Vulnerability Alerts

####
[CVE-2024-40635](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)

### Impact
A bug was found in containerd where containers launched with a User set
as a `UID:GID` larger than the maximum 32-bit signed integer can cause
an overflow condition where the container ultimately runs as root (UID
0). This could cause unexpected behavior for environments that require
containers to run as a non-root user.

### Patches
This bug has been fixed in the following containerd versions: 

* 2.0.4 (Fixed in
1a43cb6a10)
* 1.7.27 (Fixed in
05044ec0a9)
* 1.6.38 (Fixed in
cf158e884c)

Users should update to these versions to resolve the issue.

### Workarounds
Ensure that only trusted images are used and that only trusted users
have permissions to import images.

### Credits
The containerd project would like to thank [Benjamin
Koltermann](https://redirect.github.com/p4ck3t0) and
[emxll](https://redirect.github.com/emxll) for responsibly disclosing
this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

### References
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635

### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

####
[CVE-2025-47291](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff)

# Impact

A bug was found in the containerd's CRI implementation where containerd
doesn't put usernamespaced containers under the Kubernetes' cgroup
hierarchy, therefore some Kubernetes limits are not honored. This may
cause a denial of service of the Kubernetes node.

# Patches

This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should
update to these versions to resolve the issue.

# Workarounds

Disable usernamespaced pods in Kubernetes temporarily.

# Credits

The containerd project would like to thank Rodrigo Campos Catelin and
Piotr Rogowski for responsibly disclosing this issue in accordance with
the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

#  For more information
If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

####
[CVE-2024-25621](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)

### Impact

An overly broad default permission vulnerability was found in
containerd.

- `/var/lib/containerd` was created with the permission bits 0o711,
while it should be created with 0o700
- Allowed local users on the host to potentially access the metadata
store and the content store
- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755,
while it should be created with 0o700
- Allowed local users on the host to potentially access the contents of
Kubernetes local volumes. The contents of volumes might include setuid
binaries, which could allow a local user on the host to elevate
privileges on the host.
- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created
with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.
When the `temp` directory path is specified in the daemon configuration,
that directory was also created with 0o711, while it should be created
with 0o700.

### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing
directories.

> [!NOTE]
>
> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task`
are still created with 0o711.
> This is an expected behavior for supporting userns-remapped
containers.

### Workarounds

The system administrator on the host can manually chmod the directories
to not
have group or world accessible permisisons:

```
chmod 700 /var/lib/containerd
chmod 700 /run/containerd/io.containerd.grpc.v1.cri
chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim
```

An alternative mitigation would be to run containerd in [rootless
mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).

### Credits

The containerd project would like to thank David Leadbeater for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

####
[CVE-2025-64329](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)

### Impact

A bug was found in containerd's CRI Attach implementation where a user
can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., [`kubectl
attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/))
could increase the memory usage of containerd.

### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.

### Workarounds

Set up an admission controller to control accesses to `pods/attach`
resources.
e.g., [Validating Admission
Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).

### Credits

The containerd project would like to thank @&#8203;Wheat2018 for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

### References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

---

### containerd has an integer overflow in User ID handling in
github.com/containerd/containerd
[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) /
[GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)
/ [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528)

<details>
<summary>More information</summary>

#### Details
containerd has an integer overflow in User ID handling in
github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)
-
[05044ec0a9)
-
[1a43cb6a10)
-
[cf158e884c)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3528) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### containerd has an integer overflow in User ID handling
[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) /
[GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)
/ [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528)

<details>
<summary>More information</summary>

#### Details
##### Impact
A bug was found in containerd where containers launched with a User set
as a `UID:GID` larger than the maximum 32-bit signed integer can cause
an overflow condition where the container ultimately runs as root (UID
0). This could cause unexpected behavior for environments that require
containers to run as a non-root user.

##### Patches
This bug has been fixed in the following containerd versions: 

* 2.0.4 (Fixed in
1a43cb6a10)
* 1.7.27 (Fixed in
05044ec0a9)
* 1.6.38 (Fixed in
cf158e884c)

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images are used and that only trusted users
have permissions to import images.

##### Credits
The containerd project would like to thank [Benjamin
Koltermann](https://redirect.github.com/p4ck3t0) and
[emxll](https://redirect.github.com/emxll) for responsibly disclosing
this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### References
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 4.6 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)
-
[https://nvd.nist.gov/vuln/detail/CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635)
-
[05044ec0a9)
-
[1a43cb6a10)
-
[cf158e884c)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)
-
[https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html](https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-265r-hfxg-fhmg) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI plugin: Incorrect cgroup hierarchy assignment for
containers running in usernamespaced Kubernetes pods.
[CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291) /
[GHSA-cxfp-7pvr-95ff](https://redirect.github.com/advisories/GHSA-cxfp-7pvr-95ff)
/ [GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701)

<details>
<summary>More information</summary>

#### Details
##### Impact

A bug was found in the containerd's CRI implementation where containerd
doesn't put usernamespaced containers under the Kubernetes' cgroup
hierarchy, therefore some Kubernetes limits are not honored. This may
cause a denial of service of the Kubernetes node.

##### Patches

This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should
update to these versions to resolve the issue.

##### Workarounds

Disable usernamespaced pods in Kubernetes temporarily.

##### Credits

The containerd project would like to thank Rodrigo Campos Catelin and
Piotr Rogowski for responsibly disclosing this issue in accordance with
the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

#####  For more information
If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: Unknown
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff)
-
[https://nvd.nist.gov/vuln/detail/CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)
-
[https://pkg.go.dev/vuln/GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-cxfp-7pvr-95ff) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Incorrect cgroup assignment for containers running in usernamespaced
Kubernetes pods in github.com/containerd/containerd
[CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291) /
[GHSA-cxfp-7pvr-95ff](https://redirect.github.com/advisories/GHSA-cxfp-7pvr-95ff)
/ [GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701)

<details>
<summary>More information</summary>

#### Details
Incorrect cgroup assignment for containers running in usernamespaced
Kubernetes pods in github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3701) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### containerd affected by a local privilege escalation via wide
permissions on CRI directory
[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) /
[GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w)

<details>
<summary>More information</summary>

#### Details
##### Impact

An overly broad default permission vulnerability was found in
containerd.

- `/var/lib/containerd` was created with the permission bits 0o711,
while it should be created with 0o700
- Allowed local users on the host to potentially access the metadata
store and the content store
- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755,
while it should be created with 0o700
- Allowed local users on the host to potentially access the contents of
Kubernetes local volumes. The contents of volumes might include setuid
binaries, which could allow a local user on the host to elevate
privileges on the host.
- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created
with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.
When the `temp` directory path is specified in the daemon configuration,
that directory was also created with 0o711, while it should be created
with 0o700.

##### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing
directories.

> [!NOTE]
>
> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task`
are still created with 0o711.
> This is an expected behavior for supporting userns-remapped
containers.

##### Workarounds

The system administrator on the host can manually chmod the directories
to not
have group or world accessible permisisons:

```
chmod 700 /var/lib/containerd
chmod 700 /run/containerd/io.containerd.grpc.v1.cri
chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim
```

An alternative mitigation would be to run containerd in [rootless
mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).

##### Credits

The containerd project would like to thank David Leadbeater for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

#### Severity
- CVSS Score: 7.3 / 10 (High)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)
-
[https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)
-
[7c59e8e9e9)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)
-
[https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-pwhc-rpq9-4c8w) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI server: Host memory exhaustion through Attach
goroutine leak
[CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) /
[GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2)

<details>
<summary>More information</summary>

#### Details
##### Impact

A bug was found in containerd's CRI Attach implementation where a user
can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., [`kubectl
attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/))
could increase the memory usage of containerd.

##### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.

##### Workarounds

Set up an admission controller to control accesses to `pods/attach`
resources.
e.g., [Validating Admission
Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).

##### Credits

The containerd project would like to thank @&#8203;Wheat2018 for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

#### Severity
- CVSS Score: Unknown
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)
-
[https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329)
-
[083b53cd6f)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-m6hq-p25p-ffr2) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

####
[GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)

### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value:


1a66224d5e/mapstructure.go (L679-L686)


1a66224d5e/mapstructure.go (L726-L730)


1a66224d5e/mapstructure.go (L783-L787)

& more.

### PoC

To reproduce with OpenBao:

```
$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}
```

### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

####
[GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)

### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value via `strconv` helpers:


8c61ec1924/mapstructure.go (L720-L727)


8c61ec1924/mapstructure.go (L791-L798)


8c61ec1924/decode_hooks.go (L180)

& more. These are different code paths than are fixed in the previous
iteration at
https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.

### PoC

To reproduce with OpenBao:

```
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"

--> server logs:

2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
```

### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

---

### mapstructure May Leak Sensitive Information in Logs When Processing
Malformed Data

[GHSA-fv92-fjc5-jj9h](https://redirect.github.com/advisories/GHSA-fv92-fjc5-jj9h)
/ [GO-2025-3787](https://pkg.go.dev/vuln/GO-2025-3787)

<details>
<summary>More information</summary>

#### Details
##### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

##### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value:


1a66224d5e/mapstructure.go (L679-L686)


1a66224d5e/mapstructure.go (L726-L730)


1a66224d5e/mapstructure.go (L783-L787)

& more.

##### PoC

To reproduce with OpenBao:

```
$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}
```

##### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)
-
[https://github.com/go-viper/mapstructure](https://redirect.github.com/go-viper/mapstructure)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-fv92-fjc5-jj9h) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### May leak sensitive information in logs when processing malformed
data in github.com/go-viper/mapstructure

[GHSA-fv92-fjc5-jj9h](https://redirect.github.com/advisories/GHSA-fv92-fjc5-jj9h)
/ [GO-2025-3787](https://pkg.go.dev/vuln/GO-2025-3787)

<details>
<summary>More information</summary>

#### Details
May leak sensitive information in logs when processing malformed data in
github.com/go-viper/mapstructure

#### Severity
Unknown

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3787) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Go-viper's mapstructure May Leak Sensitive Information in Logs in
github.com/go-viper/mapstructure

[GHSA-2464-8j7c-4cjm](https://redirect.github.com/advisories/GHSA-2464-8j7c-4cjm)
/ [GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900)

<details>
<summary>More information</summary>

#### Details
Go-viper's mapstructure May Leak Sensitive Information in Logs in
github.com/go-viper/mapstructure

#### Severity
Unknown

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)
-
[742921c9ba)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3900) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### go-viper's mapstructure May Leak Sensitive Information in Logs When
Processing Malformed Data

[GHSA-2464-8j7c-4cjm](https://redirect.github.com/advisories/GHSA-2464-8j7c-4cjm)
/ [GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900)

<details>
<summary>More information</summary>

#### Details
##### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

##### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value via `strconv` helpers:


8c61ec1924/mapstructure.go (L720-L727)


8c61ec1924/mapstructure.go (L791-L798)


8c61ec1924/decode_hooks.go (L180)

& more. These are different code paths than are fixed in the previous
iteration at
https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.

##### PoC

To reproduce with OpenBao:

```
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"

--> server logs:

2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
```

##### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)
-
[742921c9ba)
-
[https://github.com/go-viper/mapstructure](https://redirect.github.com/go-viper/mapstructure)
-
[https://pkg.go.dev/vuln/GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-2464-8j7c-4cjm) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

####
[CVE-2025-58058](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9)

### Summary

It is possible to put data in front of an LZMA-encoded byte stream
without detecting the situation while reading the header. This can lead
to increased memory consumption because the current implementation
allocates the full decoding buffer directly after reading the header.
The LZMA header doesn't include a magic number or has a checksum to
detect such an issue according to the
[specification](https://redirect.github.com/jljusten/LZMA-SDK/blob/master/DOC/lzma-specification.txt).

Note that the code recognizes the issue later while reading the stream,
but at this time the memory allocation has already been done.

### Mitigations

The release v0.5.15 includes following mitigations:

- The ReaderConfig DictCap field is now interpreted as a limit for the
dictionary size.
- The default is 2 Gigabytes - 1 byte (2^31-1 bytes).
- Users can check with the [Reader.Header] method what the actual values
are in their LZMA files and set a smaller limit using ReaderConfig.
- The dictionary size will not exceed the larger of the file size and
the minimum dictionary size. This is another measure to prevent huge
memory allocations for the dictionary.
- The code supports stream sizes only up to a pebibyte (1024^5).

Note that the original v0.5.14 version had a compiler error for 32 bit
platforms, which has been fixed by v0.5.15.

### Methods affected

Only software that uses
[lzma.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#NewReader)
or
[lzma.ReaderConfig.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#ReaderConfig.NewReader)
is affected. There is no issue for software using the xz functionality.

I thank  @&#8203;GregoryBuligin for his report, which is provided below.

### Summary
When unpacking a large number of LZMA archives, even in a single
goroutine, if the first byte of the archive file is 0 (a zero byte added
to the beginning), an error __writeMatch: distance out of range__
occurs. Memory consumption spikes sharply, and the GC clearly cannot
handle this situation.

### Details
Judging by the error __writeMatch: distance out of range__, the problems
occur in the code around this function.

c8314b8f21/lzma/decoderdict.go (L81)

### PoC
Run a function similar to this one in 1 or several goroutines on a
multitude of LZMA archives that have a 0 (a zero byte) added to the
beginning.
```
const ProjectLocalPath = "some/path"
const TmpDir = "tmp"

func UnpackLZMA(lzmaFile string) error {
	file, err := os.Open(lzmaFile)
	if err != nil {
		return err
	}
	defer file.Close()

	reader, err := lzma.NewReader(bufio.NewReader(file))
	if err != nil {
		return err
	}

	tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix)
	if err != nil {
		return err
	}
	defer func() {
		tmpFile.Close()
		_ = os.Remove(tmpFile.Name())
	}()

	sha256Hasher := sha256.New()
	multiWriter := io.MultiWriter(tmpFile, sha256Hasher)

	if _, err = io.Copy(multiWriter, reader); err != nil {
		return err
	}

	unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil))
	unpackDir := filepath.Join(
		ProjectLocalPath, unpackHash[:2],
	)
	_ = os.MkdirAll(unpackDir, DirPerm)

	unpackPath := filepath.Join(unpackDir, unpackHash)

	return os.Rename(tmpFile.Name(), unpackPath)
}
```

### Impact
Servers with a small amount of RAM that download and unpack a large
number of unverified LZMA archives

---

### github.com/ulikunitz/xz leaks memory when decoding a corrupted
multiple LZMA archives
[CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) /
[GHSA-jc7w-c686-c4v9](https://redirect.github.com/advisories/GHSA-jc7w-c686-c4v9)
/ [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922)

<details>
<summary>More information</summary>

#### Details
##### Summary

It is possible to put data in front of an LZMA-encoded byte stream
without detecting the situation while reading the header. This can lead
to increased memory consumption because the current implementation
allocates the full decoding buffer directly after reading the header.
The LZMA header doesn't include a magic number or has a checksum to
detect such an issue according to the
[specification](https://redirect.github.com/jljusten/LZMA-SDK/blob/master/DOC/lzma-specification.txt).

Note that the code recognizes the issue later while reading the stream,
but at this time the memory allocation has already been done.

##### Mitigations

The release v0.5.15 includes following mitigations:

- The ReaderConfig DictCap field is now interpreted as a limit for the
dictionary size.
- The default is 2 Gigabytes - 1 byte (2^31-1 bytes).
- Users can check with the [Reader.Header] method what the actual values
are in their LZMA files and set a smaller limit using ReaderConfig.
- The dictionary size will not exceed the larger of the file size and
the minimum dictionary size. This is another measure to prevent huge
memory allocations for the dictionary.
- The code supports stream sizes only up to a pebibyte (1024^5).

Note that the original v0.5.14 version had a compiler error for 32 bit
platforms, which has been fixed by v0.5.15.

##### Methods affected

Only software that uses
[lzma.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#NewReader)
or
[lzma.ReaderConfig.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#ReaderConfig.NewReader)
is affected. There is no issue for software using the xz functionality.

I thank  @&#8203;GregoryBuligin for his report, which is provided below.

##### Summary
When unpacking a large number of LZMA archives, even in a single
goroutine, if the first byte of the archive file is 0 (a zero byte added
to the beginning), an error __writeMatch: distance out of range__
occurs. Memory consumption spikes sharply, and the GC clearly cannot
handle this situation.

##### Details
Judging by the error __writeMatch: distance out of range__, the problems
occur in the code around this function.

c8314b8f21/lzma/decoderdict.go (L81)

##### PoC
Run a function similar to this one in 1 or several goroutines on a
multitude of LZMA archives that have a 0 (a zero byte) added to the
beginning.
```
const ProjectLocalPath = "some/path"
const TmpDir = "tmp"

func UnpackLZMA(lzmaFile string) error {
	file, err := os.Open(lzmaFile)
	if err != nil {
		return err
	}
	defer file.Close()

	reader, err := lzma.NewReader(bufio.NewReader(file))
	if err != nil {
		return err
	}

	tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix)
	if err != nil {
		return err
	}
	defer func() {
		tmpFile.Close()
		_ = os.Remove(tmpFile.Name())
	}()

	sha256Hasher := sha256.New()
	multiWriter := io.MultiWriter(tmpFile, sha256Hasher)

	if _, err = io.Copy(multiWriter, reader); err != nil {
		return err
	}

	unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil))
	unpackDir := filepath.Join(
		ProjectLocalPath, unpackHash[:2],
	)
	_ = os.MkdirAll(unpackDir, DirPerm)

	unpackPath := filepath.Join(unpackDir, unpackHash)

	return os.Rename(tmpFile.Name(), unpackPath)
}
```

##### Impact
Servers with a small amount of RAM that download and unpack a large
number of unverified LZMA archives

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9)
-
[https://nvd.nist.gov/vuln/detail/CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058)
-
[88ddf1d0d9)
-
[https://github.com/ulikunitz/xz](https://redirect.github.com/ulikunitz/xz)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-jc7w-c686-c4v9) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Memory leaks when decoding a corrupted multiple LZMA archives in
github.com/ulikunitz/xz
[CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) /
[GHSA-jc7w-c686-c4v9](https://redirect.github.com/advisories/GHSA-jc7w-c686-c4v9)
/ [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922)

<details>
<summary>More information</summary>

#### Details
Memory leaks when decoding a corrupted multiple LZMA archives in
github.com/ulikunitz/xz

#### Severity
Unknown

#### References
-
[https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9)
-
[88ddf1d0d9)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3922) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

#### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181)

SSH servers parsing GSSAPI authentication requests do not validate the
number of mechanisms specified in the request, allowing an attacker to
cause unbounded memory consumption.

#### [CVE-2025-47914](https://nvd.nist.gov/vuln/detail/CVE-2025-47914)

SSH Agent servers do not validate the size of messages when processing
new identity requests, which may cause the program to panic if the
message is malformed due to an out of bounds read.

---

### Release Notes

<details>
<summary>containerd/containerd
(github.com/containerd/containerd/v2)</summary>

###
[`v2.0.7`](https://redirect.github.com/containerd/containerd/releases/tag/v2.0.7):
containerd 2.0.7

[Compare
Source](https://redirect.github.com/containerd/containerd/compare/v2.0.6...v2.0.7)

Welcome to the v2.0.7 release of containerd!

The seventh patch release for containerd 2.0 includes various bug fixes
and updates.

##### Security Updates

-   **containerd**
-
[**GHSA-pwhc-rpq9-4c8w**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)
-
[**GHSA-m6hq-p25p-ffr2**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)

-   **runc**
-
[**GHSA-qw9x-cqr3-wc7r**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
-
[**GHSA-cgrx-mc8f-2prm**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm)
-
[**GHSA-9493-h29p-rfm2**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2)

##### Highlights

##### Container Runtime Interface (CRI)

- **Disable event subscriber during task cleanup**
([#&#8203;12406](https://redirect.github.com/containerd/containerd/pull/12406))
- **Add SystemdCgroup to default runtime options**
([#&#8203;12254](https://redirect.github.com/containerd/containerd/pull/12254))
- **Fix userns with container image VOLUME mounts that need copy**
([#&#8203;12241](https://redirect.github.com/containerd/containerd/pull/12241))

##### Image Distribution

- **Add dial timeout field to hosts toml configuration**
([#&#8203;12136](https://redirect.github.com/containerd/containerd/pull/12136))

##### Runtime

- **Update runc binary to v1.3.3**
([#&#8203;12479](https://redirect.github.com/containerd/containerd/pull/12479))
- **Fix lost container logs from quickly closing io**
([#&#8203;12376](https://redirect.github.com/containerd/containerd/pull/12376))
- **Create bootstrap.json with 0644 permission**
([#&#8203;12184](https://redirect.github.com/containerd/containerd/pull/12184))
- **Fix pidfd leak in UnshareAfterEnterUserns**
([#&#8203;12178](https://redirect.github.com/containerd/containerd/pull/12178))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

##### Contributors

-   Austin Vazquez
-   Phil Estes
-   Rodrigo Campos
-   Wei Fu
-   Akihiro Suda
-   Derek McGowan
-   Maksym Pavlenko
-   ningmingxiao
-   Kirtana Ashok
-   Akhil Mohan
-   Andrew Halaney
-   Jin Dong
-   Jose Fernandez
-   Mike Baynton
-   Philip Laine
-   Swagat Bora
-   wheat2018

##### Changes

<details><summary>56 commits</summary>
<p>

- Prepare release notes for v2.0.7
([#&#8203;12482](https://redirect.github.com/containerd/containerd/pull/12482))
-
[`4931e24f1`](4931e24f16)
Prepare release notes for v2.0.7
-
[`205bc4f2d`](205bc4f2db)
Update mailmap
-
[`5f708b76a`](5f708b76a4)
Merge commit from fork
-
[`8cd112d82`](8cd112d829)
Fix directory permissions
-
[`05290b5bc`](05290b5bc8)
Merge commit from fork
-
[`4d1edf4ad`](4d1edf4add)
fix goroutine leak of container Attach
- Update runc binary to v1.3.3
([#&#8203;12479](https://redirect.github.com/containerd/containerd/pull/12479))
-
[`b46dc6a67`](b46dc6a67c)
runc: Update runc binary to v1.3.3
- ci: bump Go 1.24.9; 1.25.3
([#&#8203;12361](https://redirect.github.com/containerd/containerd/pull/12361))
-
[`5e9c82178`](5e9c821780)
Update GHA runners to use latest images for basic binaries build
-
[`7f59248dc`](7f59248dcd)
Update GHA runners to use latest image for most jobs
-
[`e1373e8a8`](e1373e8a8a)
ci: bump Go 1.24.9, 1.25.3
-
[`e1a910a6a`](e1a910a6a9)
ci: bump Go 1.24.8; 1.25.2
-
[`fd04b7f17`](fd04b7f176)
move exclude-dirs to issues.exclude-dirs
-
[`b49377975`](b493779751)
update golangci-lint to v1.64.2
-
[`6e45022a1`](6e45022a1e)
build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
-
[`09ce0f2a1`](09ce0f2a1e)
build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
-
[`de63a740b`](de63a740b8)
build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
- Fix lost container logs from quickly closing io
([#&#8203;12376](https://redirect.github.com/containerd/containerd/pull/12376))
-
[`f953ee8a3`](f953ee8a3c)
bugfix:fix container logs lost because io close too quickly
- CI: update Fedora to 43
([#&#8203;12448](https://redirect.github.com/containerd/containerd/pull/12448))
-
[`f6f15f513`](f6f15f5135)
CI: update Fedora to 43
- Disable event subscriber during task cleanup
([#&#8203;12406](https://redirect.github.com/containerd/containerd/pull/12406))
-
[`2a2329cbd`](2a2329cbd0)
cri/server/podsandbox: disable event subscriber
- CI: skip ubuntu-24.04-arm on private repos
([#&#8203;12428](https://redirect.github.com/containerd/containerd/pull/12428))
-
[`dfb954743`](dfb9547437)
CI: skip ubuntu-24.04-arm on private repos
- Remove additional fuzzers from instrumentation repo
([#&#8203;12420](https://redirect.github.com/containerd/containerd/pull/12420))
-
[`f6b02f6bb`](f6b02f6bb8)
Remove additional fuzzers from CI
- runc:Update runc binary to v1.3.1
([#&#8203;12275](https://redirect.github.com/containerd/containerd/pull/12275))
-
[`75c13ee3f`](75c13ee3fc)
runc:Update runc binary to v1.3.1
- Add SystemdCgroup to default runtime options
([#&#8203;12254](https://redirect.github.com/containerd/containerd/pull/12254))
-
[`427cdd06c`](427cdd06c9)
add SystemdCgroup to default runtime options
- install-runhcs-shim: fetch target commit instead of tags
([#&#8203;12255](https://redirect.github.com/containerd/containerd/pull/12255))
-
[`0b35e19fb`](0b35e19fb1)
install-runhcs-shim: fetch target commit instead of tags
- Fix userns with container image VOLUME mounts that need copy
([#&#8203;12241](https://redirect.github.com/containerd/containerd/pull/12241))
-
[`3212afc2f`](3212afc2f2)
integration: Add test for directives with userns
-
[`b855c6e10`](b855c6e103)
cri: Fix userns with Dockerfile VOLUME mounts that need copy
- Fix overlayfs issues related to user namespace
([#&#8203;12223](https://redirect.github.com/containerd/containerd/pull/12223))
-
[`05c0c99f4`](05c0c99f43)
core/mount: Retry unmounting idmapped directories
-
[`afdede4ce`](afdede4ced)
core/mount: Test cleanup of DoPrepareIDMappedOverlay()
-
[`47205f814`](47205f814d)
core/mount: Properly cleanup on doPrepareIDMappedOverlay errors
-
[`6f4abd970`](6f4abd970a)
core/mount: Don't call nil function on errors
-
[`a2f0d65d7`](a2f0d65d78)
core/mount: Only idmap once per overlayfs, not per layer
-
[`1c32accd7`](1c32accd71)
Make ovl idmap mounts read-only
- ci: bump Go 1.23.12, 1.24.6
([#&#8203;12187](https://redirect.github.com/containerd/containerd/pull/12187))
-
[`9e72e91e6`](9e72e91e63)
ci: bump Go 1.23.12, 1.24.6
- Create bootstrap.json with 0644 permission
([#&#8203;12184](https://redirect.github.com/containerd/containerd/pull/12184))
-
[`009622e04`](009622e042)
fix: create bootstrap.json with 0644 permission
- Fix pidfd leak in UnshareAfterEnterUserns
([#&#8203;12178](https://redirect.github.com/containerd/containerd/pull/12178))
    -   [`5bec0a332`](https://redirec

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2025-11-20 20:33:06 +00:00
Pulumi Bot
c7ab0e0f35 Update GitHub Actions workflows. (#669)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 9575e75e5316d699a77abf48a351abe840e1bed5.
2025-11-20 05:54:04 +00:00
pulumi-renovate[bot]
b1e526630c Update module golang.org/x/crypto to v0.45.0 [SECURITY] (#668)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| golang.org/x/crypto | require | minor | `v0.39.0` -> `v0.45.0` |

### GitHub Vulnerability Alerts

#### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181)

SSH servers parsing GSSAPI authentication requests do not validate the
number of mechanisms specified in the request, allowing an attacker to
cause unbounded memory consumption.

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2025-11-20 02:14:14 +00:00
Pulumi Bot
32ecb82eb6 Update GitHub Actions workflows. (#667)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f76cbff100ad8e6e3192b379edb5bcf1f536eb3e.
2025-11-15 05:55:02 +00:00
Pulumi Bot
77b931b32c Update GitHub Actions workflows. (#666)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit ed916848970fd62ea0f62c7e6ac674d4d5ca05ef.
2025-11-14 05:58:25 +00:00
Pulumi Bot
487acd799c Update GitHub Actions workflows. (#663)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 962009a157587c5c11d686e51206a2d312bc4618.
2025-11-11 05:53:59 +00:00
Pulumi Bot
8e273d9f68 Update GitHub Actions workflows. (#662)
This PR was automatically generated by the
update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt
repo, from commit 52b77e4c448dd747630cff0918ade69cef3b4f16.
2025-11-10 15:47:40 -08:00
Pulumi Bot
faffc8cc45 Update GitHub Actions workflows. (#633)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 5619381e924fbac90750f41b6a27cadcd11c4c2d.
2025-10-22 05:56:54 +00:00
Alberto Pose
2b1230f252 Introduce ${GOTEST} Makefile variable to override test runner. (#632)
Allow to use other tools like `gotestsum` locally.
2025-10-20 15:20:48 +01:00
Pulumi Bot
eaf5461bbc Update GitHub Actions workflows. (#631)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f0bcdaf5cb0825e542d0a2eb71f05d538135a9bc.
2025-10-18 05:52:38 +00:00
Alberto Pose
38e65a3f81 Remove URL and Token arguments from CacheFromGitHubActions. (#626)
Fixes #75

Arguments URL and Token have been removed but `$ACTIONS_CACHE_URL` and
`$ACTIONS_RUNTIME_TOKEN` env variables could be injected if desired.

---------

Co-authored-by: Bryce Lampe <bryce@pulumi.com>
v0.0.15
2025-10-17 11:00:40 +01:00
Pulumi Bot
1811524e66 Update GitHub Actions workflows. (#629)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 16969054030269fefacac22b8536d1f80ed8e2d9.
2025-10-16 05:52:39 +00:00