50 Commits

Author	SHA1	Message	Date
pulumi-renovate[bot]	f1ff9e765f	Update vulnerable dependencies [SECURITY] (#671) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/containerd/containerd/v2](https://redirect.github.com/containerd/containerd) | indirect | patch | `v2.0.3` -> `v2.0.7` | | [github.com/go-viper/mapstructure/v2](https://redirect.github.com/go-viper/mapstructure) | indirect | minor | `v2.0.0` -> `v2.4.0` | | [github.com/ulikunitz/xz](https://redirect.github.com/ulikunitz/xz) | indirect | patch | `v0.5.12` -> `v0.5.15` | | golang.org/x/crypto | indirect | minor | `v0.39.0` -> `v0.45.0` | ### GitHub Vulnerability Alerts #### [CVE-2024-40635](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg) ### Impact A bug was found in containerd where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. ### Patches This bug has been fixed in the following containerd versions: * 2.0.4 (Fixed in https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20) * 1.7.27 (Fixed in https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da) * 1.6.38 (Fixed in https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a) Users should update to these versions to resolve the issue. ### Workarounds Ensure that only trusted images are used and that only trusted users have permissions to import images. ### Credits The containerd project would like to thank [Benjamin Koltermann](https://redirect.github.com/p4ck3t0) and [emxll](https://redirect.github.com/emxll) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ### References * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635 ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io) #### [CVE-2025-47291](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff) # Impact A bug was found in the containerd's CRI implementation where containerd doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. # Patches This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. # Workarounds Disable usernamespaced pods in Kubernetes temporarily. # Credits The containerd project would like to thank Rodrigo Campos Catelin and Piotr Rogowski for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). # For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at security@containerd.io To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io) #### [CVE-2024-25621](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w) ### Impact An overly broad default permission vulnerability was found in containerd. - `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store - `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700 - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host. - `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700 The directory paths may differ depending on the daemon configuration. When the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700. ### Patches This bug has been fixed in the following containerd versions: * 2.2.0 * 2.1.5 * 2.0.7 * 1.7.29 Users should update to these versions to resolve the issue. These updates automatically change the permissions of the existing directories. > [!NOTE] > > `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711. > This is an expected behavior for supporting userns-remapped containers. ### Workarounds The system administrator on the host can manually chmod the directories to not have group or world accessible permisisons: ``` chmod 700 /var/lib/containerd chmod 700 /run/containerd/io.containerd.grpc.v1.cri chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim ``` An alternative mitigation would be to run containerd in [rootless mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md). ### Credits The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) #### [CVE-2025-64329](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2) ### Impact A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. Repetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd. ### Patches This bug has been fixed in the following containerd versions: * 2.2.0 * 2.1.5 * 2.0.7 * 1.7.29 Users should update to these versions to resolve the issue. ### Workarounds Set up an admission controller to control accesses to `pods/attach` resources. e.g., [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/). ### Credits The containerd project would like to thank @&#8203;Wheat2018 for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ### References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329 ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) --- ### containerd has an integer overflow in User ID handling in github.com/containerd/containerd [CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) / [GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg) / [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528) <details> <summary>More information</summary> #### Details containerd has an integer overflow in User ID handling in github.com/containerd/containerd #### Severity Unknown #### References - [https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg) - [https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da](https://redirect.github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da) - [https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20](https://redirect.github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20) - [https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a](https://redirect.github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3528) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### containerd has an integer overflow in User ID handling [CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) / [GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg) / [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528) <details> <summary>More information</summary> #### Details ##### Impact A bug was found in containerd where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. ##### Patches This bug has been fixed in the following containerd versions: * 2.0.4 (Fixed in https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20) * 1.7.27 (Fixed in https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da) * 1.6.38 (Fixed in https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a) Users should update to these versions to resolve the issue. ##### Workarounds Ensure that only trusted images are used and that only trusted users have permissions to import images. ##### Credits The containerd project would like to thank [Benjamin Koltermann](https://redirect.github.com/p4ck3t0) and [emxll](https://redirect.github.com/emxll) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ##### References * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635 ##### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io) #### Severity - CVSS Score: 4.6 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N` #### References - [https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg) - [https://nvd.nist.gov/vuln/detail/CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) - [https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da](https://redirect.github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da) - [https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20](https://redirect.github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20) - [https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a](https://redirect.github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a) - [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) - [https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html](https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-265r-hfxg-fhmg) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. [CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291) / [GHSA-cxfp-7pvr-95ff](https://redirect.github.com/advisories/GHSA-cxfp-7pvr-95ff) / [GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701) <details> <summary>More information</summary> #### Details ##### Impact A bug was found in the containerd's CRI implementation where containerd doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. ##### Patches This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. ##### Workarounds Disable usernamespaced pods in Kubernetes temporarily. ##### Credits The containerd project would like to thank Rodrigo Campos Catelin and Piotr Rogowski for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ##### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at security@containerd.io To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io) #### Severity - CVSS Score: Unknown - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff) - [https://nvd.nist.gov/vuln/detail/CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291) - [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) - [https://pkg.go.dev/vuln/GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-cxfp-7pvr-95ff) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd [CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291) / [GHSA-cxfp-7pvr-95ff](https://redirect.github.com/advisories/GHSA-cxfp-7pvr-95ff) / [GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701) <details> <summary>More information</summary> #### Details Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd #### Severity Unknown #### References - [https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3701) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### containerd affected by a local privilege escalation via wide permissions on CRI directory [CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) / [GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w) <details> <summary>More information</summary> #### Details ##### Impact An overly broad default permission vulnerability was found in containerd. - `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store - `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700 - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host. - `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700 The directory paths may differ depending on the daemon configuration. When the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700. ##### Patches This bug has been fixed in the following containerd versions: * 2.2.0 * 2.1.5 * 2.0.7 * 1.7.29 Users should update to these versions to resolve the issue. These updates automatically change the permissions of the existing directories. > [!NOTE] > > `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711. > This is an expected behavior for supporting userns-remapped containers. ##### Workarounds The system administrator on the host can manually chmod the directories to not have group or world accessible permisisons: ``` chmod 700 /var/lib/containerd chmod 700 /run/containerd/io.containerd.grpc.v1.cri chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim ``` An alternative mitigation would be to run containerd in [rootless mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md). ##### Credits The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ##### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) #### Severity - CVSS Score: 7.3 / 10 (High) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H` #### References - [https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w) - [https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) - [https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5](https://redirect.github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5) - [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) - [https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pwhc-rpq9-4c8w) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### containerd CRI server: Host memory exhaustion through Attach goroutine leak [CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) / [GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2) <details> <summary>More information</summary> #### Details ##### Impact A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. Repetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd. ##### Patches This bug has been fixed in the following containerd versions: * 2.2.0 * 2.1.5 * 2.0.7 * 1.7.29 Users should update to these versions to resolve the issue. ##### Workarounds Set up an admission controller to control accesses to `pods/attach` resources. e.g., [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/). ##### Credits The containerd project would like to thank @&#8203;Wheat2018 for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ##### References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329 ##### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) #### Severity - CVSS Score: Unknown - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2) - [https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) - [https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df](https://redirect.github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df) - [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m6hq-p25p-ffr2) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> #### [GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h) ### Summary Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. ### Details OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50 ```go _, _, err := d.getPrimitive(field, schema) if err != nil { return fmt.Errorf("error converting input for field %q: %w", field, err) } ``` where this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193 ```go func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) { raw, ok := d.Raw[k] if !ok { return nil, false, nil } switch t := schema.Type; t { case TypeBool: var result bool if err := mapstructure.WeakDecode(raw, &result); err != nil { return nil, false, err } return result, true, nil ``` Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value: https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L679-L686 https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L726-L730 https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L783-L787 & more. ### PoC To reproduce with OpenBao: ``` $ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300 ``` and in a new tab: ``` $ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass Success! Enabled userpass auth method at: userpass/ $ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf" {"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]} ``` ### Impact This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided). This was rated 4.5 Medium by HashiCorp in the past iteration. #### [GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm) ### Summary Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. ### Details OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50 ```go _, _, err := d.getPrimitive(field, schema) if err != nil { return fmt.Errorf("error converting input for field %q: %w", field, err) } ``` where this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193 ```go func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) { raw, ok := d.Raw[k] if !ok { return nil, false, nil } switch t := schema.Type; t { case TypeBool: var result bool if err := mapstructure.WeakDecode(raw, &result); err != nil { return nil, false, err } return result, true, nil ``` Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers: https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727 https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798 https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180 & more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h. ### PoC To reproduce with OpenBao: ``` $ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300 ``` and in a new tab: ``` $ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass Success! Enabled userpass auth method at: userpass/ $ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf" --> server logs: 2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\"" ``` ### Impact This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided). This was rated 4.5 Medium by HashiCorp in the past iteration. --- ### mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data [GHSA-fv92-fjc5-jj9h](https://redirect.github.com/advisories/GHSA-fv92-fjc5-jj9h) / [GO-2025-3787](https://pkg.go.dev/vuln/GO-2025-3787) <details> <summary>More information</summary> #### Details ##### Summary Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. ##### Details OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50 ```go _, _, err := d.getPrimitive(field, schema) if err != nil { return fmt.Errorf("error converting input for field %q: %w", field, err) } ``` where this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193 ```go func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) { raw, ok := d.Raw[k] if !ok { return nil, false, nil } switch t := schema.Type; t { case TypeBool: var result bool if err := mapstructure.WeakDecode(raw, &result); err != nil { return nil, false, err } return result, true, nil ``` Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value: https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L679-L686 https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L726-L730 https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L783-L787 & more. ##### PoC To reproduce with OpenBao: ``` $ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300 ``` and in a new tab: ``` $ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass Success! Enabled userpass auth method at: userpass/ $ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf" {"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]} ``` ##### Impact This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided). This was rated 4.5 Medium by HashiCorp in the past iteration. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N` #### References - [https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h) - [https://github.com/go-viper/mapstructure](https://redirect.github.com/go-viper/mapstructure) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fv92-fjc5-jj9h) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure [GHSA-fv92-fjc5-jj9h](https://redirect.github.com/advisories/GHSA-fv92-fjc5-jj9h) / [GO-2025-3787](https://pkg.go.dev/vuln/GO-2025-3787) <details> <summary>More information</summary> #### Details May leak sensitive information in logs when processing malformed data in github.com/go-viper/mapstructure #### Severity Unknown #### References - [https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3787) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure [GHSA-2464-8j7c-4cjm](https://redirect.github.com/advisories/GHSA-2464-8j7c-4cjm) / [GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900) <details> <summary>More information</summary> #### Details Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure #### Severity Unknown #### References - [https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm) - [https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c](https://redirect.github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3900) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data [GHSA-2464-8j7c-4cjm](https://redirect.github.com/advisories/GHSA-2464-8j7c-4cjm) / [GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900) <details> <summary>More information</summary> #### Details ##### Summary Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. ##### Details OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50 ```go _, _, err := d.getPrimitive(field, schema) if err != nil { return fmt.Errorf("error converting input for field %q: %w", field, err) } ``` where this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193 ```go func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) { raw, ok := d.Raw[k] if !ok { return nil, false, nil } switch t := schema.Type; t { case TypeBool: var result bool if err := mapstructure.WeakDecode(raw, &result); err != nil { return nil, false, err } return result, true, nil ``` Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers: https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727 https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798 https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180 & more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h. ##### PoC To reproduce with OpenBao: ``` $ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300 ``` and in a new tab: ``` $ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass Success! Enabled userpass auth method at: userpass/ $ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf" --> server logs: 2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\"" ``` ##### Impact This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided). This was rated 4.5 Medium by HashiCorp in the past iteration. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N` #### References - [https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm) - [https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c](https://redirect.github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c) - [https://github.com/go-viper/mapstructure](https://redirect.github.com/go-viper/mapstructure) - [https://pkg.go.dev/vuln/GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2464-8j7c-4cjm) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> #### [CVE-2025-58058](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9) ### Summary It is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the [specification](https://redirect.github.com/jljusten/LZMA-SDK/blob/master/DOC/lzma-specification.txt). Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. ### Mitigations The release v0.5.15 includes following mitigations: - The ReaderConfig DictCap field is now interpreted as a limit for the dictionary size. - The default is 2 Gigabytes - 1 byte (2^31-1 bytes). - Users can check with the [Reader.Header] method what the actual values are in their LZMA files and set a smaller limit using ReaderConfig. - The dictionary size will not exceed the larger of the file size and the minimum dictionary size. This is another measure to prevent huge memory allocations for the dictionary. - The code supports stream sizes only up to a pebibyte (1024^5). Note that the original v0.5.14 version had a compiler error for 32 bit platforms, which has been fixed by v0.5.15. ### Methods affected Only software that uses [lzma.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#NewReader) or [lzma.ReaderConfig.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#ReaderConfig.NewReader) is affected. There is no issue for software using the xz functionality. I thank @&#8203;GregoryBuligin for his report, which is provided below. ### Summary When unpacking a large number of LZMA archives, even in a single goroutine, if the first byte of the archive file is 0 (a zero byte added to the beginning), an error __writeMatch: distance out of range__ occurs. Memory consumption spikes sharply, and the GC clearly cannot handle this situation. ### Details Judging by the error __writeMatch: distance out of range__, the problems occur in the code around this function. https://github.com/ulikunitz/xz/blob/c8314b8f21e9c5e25b52da07544cac14db277e89/lzma/decoderdict.go#L81 ### PoC Run a function similar to this one in 1 or several goroutines on a multitude of LZMA archives that have a 0 (a zero byte) added to the beginning. ``` const ProjectLocalPath = "some/path" const TmpDir = "tmp" func UnpackLZMA(lzmaFile string) error { file, err := os.Open(lzmaFile) if err != nil { return err } defer file.Close() reader, err := lzma.NewReader(bufio.NewReader(file)) if err != nil { return err } tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix) if err != nil { return err } defer func() { tmpFile.Close() _ = os.Remove(tmpFile.Name()) }() sha256Hasher := sha256.New() multiWriter := io.MultiWriter(tmpFile, sha256Hasher) if _, err = io.Copy(multiWriter, reader); err != nil { return err } unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil)) unpackDir := filepath.Join( ProjectLocalPath, unpackHash[:2], ) _ = os.MkdirAll(unpackDir, DirPerm) unpackPath := filepath.Join(unpackDir, unpackHash) return os.Rename(tmpFile.Name(), unpackPath) } ``` ### Impact Servers with a small amount of RAM that download and unpack a large number of unverified LZMA archives --- ### github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives [CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) / [GHSA-jc7w-c686-c4v9](https://redirect.github.com/advisories/GHSA-jc7w-c686-c4v9) / [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922) <details> <summary>More information</summary> #### Details ##### Summary It is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the [specification](https://redirect.github.com/jljusten/LZMA-SDK/blob/master/DOC/lzma-specification.txt). Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. ##### Mitigations The release v0.5.15 includes following mitigations: - The ReaderConfig DictCap field is now interpreted as a limit for the dictionary size. - The default is 2 Gigabytes - 1 byte (2^31-1 bytes). - Users can check with the [Reader.Header] method what the actual values are in their LZMA files and set a smaller limit using ReaderConfig. - The dictionary size will not exceed the larger of the file size and the minimum dictionary size. This is another measure to prevent huge memory allocations for the dictionary. - The code supports stream sizes only up to a pebibyte (1024^5). Note that the original v0.5.14 version had a compiler error for 32 bit platforms, which has been fixed by v0.5.15. ##### Methods affected Only software that uses [lzma.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#NewReader) or [lzma.ReaderConfig.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#ReaderConfig.NewReader) is affected. There is no issue for software using the xz functionality. I thank @&#8203;GregoryBuligin for his report, which is provided below. ##### Summary When unpacking a large number of LZMA archives, even in a single goroutine, if the first byte of the archive file is 0 (a zero byte added to the beginning), an error __writeMatch: distance out of range__ occurs. Memory consumption spikes sharply, and the GC clearly cannot handle this situation. ##### Details Judging by the error __writeMatch: distance out of range__, the problems occur in the code around this function. https://github.com/ulikunitz/xz/blob/c8314b8f21e9c5e25b52da07544cac14db277e89/lzma/decoderdict.go#L81 ##### PoC Run a function similar to this one in 1 or several goroutines on a multitude of LZMA archives that have a 0 (a zero byte) added to the beginning. ``` const ProjectLocalPath = "some/path" const TmpDir = "tmp" func UnpackLZMA(lzmaFile string) error { file, err := os.Open(lzmaFile) if err != nil { return err } defer file.Close() reader, err := lzma.NewReader(bufio.NewReader(file)) if err != nil { return err } tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix) if err != nil { return err } defer func() { tmpFile.Close() _ = os.Remove(tmpFile.Name()) }() sha256Hasher := sha256.New() multiWriter := io.MultiWriter(tmpFile, sha256Hasher) if _, err = io.Copy(multiWriter, reader); err != nil { return err } unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil)) unpackDir := filepath.Join( ProjectLocalPath, unpackHash[:2], ) _ = os.MkdirAll(unpackDir, DirPerm) unpackPath := filepath.Join(unpackDir, unpackHash) return os.Rename(tmpFile.Name(), unpackPath) } ``` ##### Impact Servers with a small amount of RAM that download and unpack a large number of unverified LZMA archives #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) - [https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2](https://redirect.github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2) - [https://github.com/ulikunitz/xz](https://redirect.github.com/ulikunitz/xz) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jc7w-c686-c4v9) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz [CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) / [GHSA-jc7w-c686-c4v9](https://redirect.github.com/advisories/GHSA-jc7w-c686-c4v9) / [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922) <details> <summary>More information</summary> #### Details Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz #### Severity Unknown #### References - [https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9) - [https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2](https://redirect.github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3922) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> #### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181) SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. #### [CVE-2025-47914](https://nvd.nist.gov/vuln/detail/CVE-2025-47914) SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. --- ### Release Notes <details> <summary>containerd/containerd (github.com/containerd/containerd/v2)</summary> ### [`v2.0.7`](https://redirect.github.com/containerd/containerd/releases/tag/v2.0.7): containerd 2.0.7 [Compare Source](https://redirect.github.com/containerd/containerd/compare/v2.0.6...v2.0.7) Welcome to the v2.0.7 release of containerd! The seventh patch release for containerd 2.0 includes various bug fixes and updates. ##### Security Updates - **containerd** - [**GHSA-pwhc-rpq9-4c8w**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w) - [**GHSA-m6hq-p25p-ffr2**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2) - **runc** - [**GHSA-qw9x-cqr3-wc7r**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r) - [**GHSA-cgrx-mc8f-2prm**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm) - [**GHSA-9493-h29p-rfm2**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2) ##### Highlights ##### Container Runtime Interface (CRI) - **Disable event subscriber during task cleanup** ([#&#8203;12406](https://redirect.github.com/containerd/containerd/pull/12406)) - **Add SystemdCgroup to default runtime options** ([#&#8203;12254](https://redirect.github.com/containerd/containerd/pull/12254)) - **Fix userns with container image VOLUME mounts that need copy** ([#&#8203;12241](https://redirect.github.com/containerd/containerd/pull/12241)) ##### Image Distribution - **Add dial timeout field to hosts toml configuration** ([#&#8203;12136](https://redirect.github.com/containerd/containerd/pull/12136)) ##### Runtime - **Update runc binary to v1.3.3** ([#&#8203;12479](https://redirect.github.com/containerd/containerd/pull/12479)) - **Fix lost container logs from quickly closing io** ([#&#8203;12376](https://redirect.github.com/containerd/containerd/pull/12376)) - **Create bootstrap.json with 0644 permission** ([#&#8203;12184](https://redirect.github.com/containerd/containerd/pull/12184)) - **Fix pidfd leak in UnshareAfterEnterUserns** ([#&#8203;12178](https://redirect.github.com/containerd/containerd/pull/12178)) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues. ##### Contributors - Austin Vazquez - Phil Estes - Rodrigo Campos - Wei Fu - Akihiro Suda - Derek McGowan - Maksym Pavlenko - ningmingxiao - Kirtana Ashok - Akhil Mohan - Andrew Halaney - Jin Dong - Jose Fernandez - Mike Baynton - Philip Laine - Swagat Bora - wheat2018 ##### Changes <details><summary>56 commits</summary> <p> - Prepare release notes for v2.0.7 ([#&#8203;12482](https://redirect.github.com/containerd/containerd/pull/12482)) - [`4931e24f1`](https://redirect.github.com/containerd/containerd/commit/4931e24f169091cb4e425b7bfdd4fb0d3c20543b) Prepare release notes for v2.0.7 - [`205bc4f2d`](https://redirect.github.com/containerd/containerd/commit/205bc4f2dbce3df32d2d5140a3d039332b02dbe6) Update mailmap - [`5f708b76a`](https://redirect.github.com/containerd/containerd/commit/5f708b76a41a1cf56e167971e271c7581cb2f8cb) Merge commit from fork - [`8cd112d82`](https://redirect.github.com/containerd/containerd/commit/8cd112d8295bafcf4a992816ff9e07f5a78ff71b) Fix directory permissions - [`05290b5bc`](https://redirect.github.com/containerd/containerd/commit/05290b5bc8fd938c8f77856927a280a1d5eec7b6) Merge commit from fork - [`4d1edf4ad`](https://redirect.github.com/containerd/containerd/commit/4d1edf4addf8c31b096680f04fee499cabc75439) fix goroutine leak of container Attach - Update runc binary to v1.3.3 ([#&#8203;12479](https://redirect.github.com/containerd/containerd/pull/12479)) - [`b46dc6a67`](https://redirect.github.com/containerd/containerd/commit/b46dc6a67cc575a83db083f71dcdbc722605c841) runc: Update runc binary to v1.3.3 - ci: bump Go 1.24.9; 1.25.3 ([#&#8203;12361](https://redirect.github.com/containerd/containerd/pull/12361)) - [`5e9c82178`](https://redirect.github.com/containerd/containerd/commit/5e9c821780ff705c47406bf7a72d476da398135c) Update GHA runners to use latest images for basic binaries build - [`7f59248dc`](https://redirect.github.com/containerd/containerd/commit/7f59248dcd66cb0c418669a880e0c1d7e48e0dfa) Update GHA runners to use latest image for most jobs - [`e1373e8a8`](https://redirect.github.com/containerd/containerd/commit/e1373e8a8abf94b28507972694f8aea17f1b10c5) ci: bump Go 1.24.9, 1.25.3 - [`e1a910a6a`](https://redirect.github.com/containerd/containerd/commit/e1a910a6a989b2cb0ed1ae4fda42eacbb6361e4b) ci: bump Go 1.24.8; 1.25.2 - [`fd04b7f17`](https://redirect.github.com/containerd/containerd/commit/fd04b7f176ec52d17e0014d07d045d6fa79bd620) move exclude-dirs to issues.exclude-dirs - [`b49377975`](https://redirect.github.com/containerd/containerd/commit/b493779751d070255648e6b1e75dc9af8516c347) update golangci-lint to v1.64.2 - [`6e45022a1`](https://redirect.github.com/containerd/containerd/commit/6e45022a1e01fd1c78217df3b271d7735b8c4440) build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0 - [`09ce0f2a1`](https://redirect.github.com/containerd/containerd/commit/09ce0f2a1ee5b1524c95c3831ed124e5d4fd0a2b) build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2 - [`de63a740b`](https://redirect.github.com/containerd/containerd/commit/de63a740b8108c62bf018cf1f508bb9e5842bfd2) build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 - Fix lost container logs from quickly closing io ([#&#8203;12376](https://redirect.github.com/containerd/containerd/pull/12376)) - [`f953ee8a3`](https://redirect.github.com/containerd/containerd/commit/f953ee8a3c1feeaa60a3c9d386afa424040d56de) bugfix:fix container logs lost because io close too quickly - CI: update Fedora to 43 ([#&#8203;12448](https://redirect.github.com/containerd/containerd/pull/12448)) - [`f6f15f513`](https://redirect.github.com/containerd/containerd/commit/f6f15f5135d313309a76fc6545e7cf86653d2f6e) CI: update Fedora to 43 - Disable event subscriber during task cleanup ([#&#8203;12406](https://redirect.github.com/containerd/containerd/pull/12406)) - [`2a2329cbd`](https://redirect.github.com/containerd/containerd/commit/2a2329cbd02dc5e1a3010730fab01c618dad768c) cri/server/podsandbox: disable event subscriber - CI: skip ubuntu-24.04-arm on private repos ([#&#8203;12428](https://redirect.github.com/containerd/containerd/pull/12428)) - [`dfb954743`](https://redirect.github.com/containerd/containerd/commit/dfb95474370ef22c4555178a3d7cc34df2a3f5bc) CI: skip ubuntu-24.04-arm on private repos - Remove additional fuzzers from instrumentation repo ([#&#8203;12420](https://redirect.github.com/containerd/containerd/pull/12420)) - [`f6b02f6bb`](https://redirect.github.com/containerd/containerd/commit/f6b02f6bb81dc079f60d421347c931c73d4227e7) Remove additional fuzzers from CI - runc:Update runc binary to v1.3.1 ([#&#8203;12275](https://redirect.github.com/containerd/containerd/pull/12275)) - [`75c13ee3f`](https://redirect.github.com/containerd/containerd/commit/75c13ee3fc3657ee419395e20820d1cbd4bb2f88) runc:Update runc binary to v1.3.1 - Add SystemdCgroup to default runtime options ([#&#8203;12254](https://redirect.github.com/containerd/containerd/pull/12254)) - [`427cdd06c`](https://redirect.github.com/containerd/containerd/commit/427cdd06c9d093ede03384c550a440b0522e44ba) add SystemdCgroup to default runtime options - install-runhcs-shim: fetch target commit instead of tags ([#&#8203;12255](https://redirect.github.com/containerd/containerd/pull/12255)) - [`0b35e19fb`](https://redirect.github.com/containerd/containerd/commit/0b35e19fb118b5144a75397522e476d0571ae9ef) install-runhcs-shim: fetch target commit instead of tags - Fix userns with container image VOLUME mounts that need copy ([#&#8203;12241](https://redirect.github.com/containerd/containerd/pull/12241)) - [`3212afc2f`](https://redirect.github.com/containerd/containerd/commit/3212afc2f2d464157bcb24663360ee7dfa7207e6) integration: Add test for directives with userns - [`b855c6e10`](https://redirect.github.com/containerd/containerd/commit/b855c6e10372eb43d51186ab156cdce3d9eefb04) cri: Fix userns with Dockerfile VOLUME mounts that need copy - Fix overlayfs issues related to user namespace ([#&#8203;12223](https://redirect.github.com/containerd/containerd/pull/12223)) - [`05c0c99f4`](https://redirect.github.com/containerd/containerd/commit/05c0c99f432b341152b54ce49d9b43c5cf3d131f) core/mount: Retry unmounting idmapped directories - [`afdede4ce`](https://redirect.github.com/containerd/containerd/commit/afdede4ced8c848191062b31dfcff1352161a844) core/mount: Test cleanup of DoPrepareIDMappedOverlay() - [`47205f814`](https://redirect.github.com/containerd/containerd/commit/47205f814d552a4eea9935375dd2f0874e107e5b) core/mount: Properly cleanup on doPrepareIDMappedOverlay errors - [`6f4abd970`](https://redirect.github.com/containerd/containerd/commit/6f4abd970aeea241f07edc1e0fd74f69a9a05979) core/mount: Don't call nil function on errors - [`a2f0d65d7`](https://redirect.github.com/containerd/containerd/commit/a2f0d65d78871832da6d2aa452aeeb180cd6d8f5) core/mount: Only idmap once per overlayfs, not per layer - [`1c32accd7`](https://redirect.github.com/containerd/containerd/commit/1c32accd71d34e3cb5798214adf26911609d11f1) Make ovl idmap mounts read-only - ci: bump Go 1.23.12, 1.24.6 ([#&#8203;12187](https://redirect.github.com/containerd/containerd/pull/12187)) - [`9e72e91e6`](https://redirect.github.com/containerd/containerd/commit/9e72e91e63a75147f2a082565fc580babee8af06) ci: bump Go 1.23.12, 1.24.6 - Create bootstrap.json with 0644 permission ([#&#8203;12184](https://redirect.github.com/containerd/containerd/pull/12184)) - [`009622e04`](https://redirect.github.com/containerd/containerd/commit/009622e0424fa4234d67272339fb7e282c302190) fix: create bootstrap.json with 0644 permission - Fix pidfd leak in UnshareAfterEnterUserns ([#&#8203;12178](https://redirect.github.com/containerd/containerd/pull/12178)) - [`5bec0a332`](https://redirec </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through Friday ( * * * * 1-5 ) (UTC). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> --------- Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com> Co-authored-by: pulumi-bot <bot@pulumi.com>	2025-11-20 20:33:06 +00:00
pulumi-renovate[bot]	b1e526630c	Update module golang.org/x/crypto to v0.45.0 [SECURITY] (#668) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | golang.org/x/crypto | require | minor | `v0.39.0` -> `v0.45.0` | ### GitHub Vulnerability Alerts #### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181) SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through Friday ( * * * * 1-5 ) (UTC). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19--> --------- Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com> Co-authored-by: pulumi-bot <bot@pulumi.com>	2025-11-20 02:14:14 +00:00
Alberto Pose	38e65a3f81	Remove URL and Token arguments from CacheFromGitHubActions. (#626) ... Fixes #75 Arguments URL and Token have been removed but `$ACTIONS_CACHE_URL` and `$ACTIONS_RUNTIME_TOKEN` env variables could be injected if desired. --------- Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2025-10-17 11:00:40 +01:00
Pulumi Bot	3b7e31b388	Automated upgrade: bump pulumi/pulumi to 3.192.0 (#592) ... Automated upgrade: bump pulumi/pulumi to 3.192.0 --------- Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2025-09-05 14:36:43 -07:00
Matthew (Matt) Jeffryes	b7d239127c	Update pulumi/pulumi dependency to 3.187.0 (#568) ... Fixes https://github.com/pulumi/pulumi-docker-build/issues/551 (sort of - the underlying problem that this repo pins SDK dependencies that don't get automatically update by the workflow still exists, but it should at least work until the codegen APIs change again.)	2025-08-12 14:47:58 -07:00
pulumi-renovate[bot]	41be3ce857	Update first-party Pulumi dependencies (#530) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi) ([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs)) | dependencies | minor | [`3.165.0` -> `3.184.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.165.0/3.184.0) | | [github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild](https://redirect.github.com/pulumi/pulumi-docker-build) | require | patch | `v0.0.11` -> `v0.0.12` | | [github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3](https://redirect.github.com/pulumi/pulumi-dotnet) | require | minor | `v3.0.0-20250515194217-855e3e4c894c` -> `v3.85.1` | | [github.com/pulumi/pulumi-go-provider](https://redirect.github.com/pulumi/pulumi-go-provider) | require | minor | `v1.0.0-rc.2` -> `v1.1.0` | | [github.com/pulumi/pulumi-java/pkg](https://redirect.github.com/pulumi/pulumi-java) | require | minor | `v1.11.0` -> `v1.16.0` | | [github.com/pulumi/pulumi-yaml](https://redirect.github.com/pulumi/pulumi-yaml) | require | minor | `v1.17.0` -> `v1.21.2` | | [github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi) | require | minor | `v3.169.0` -> `v3.184.0` | | [github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3](https://redirect.github.com/pulumi/pulumi) | require | minor | `v3.0.0-20250508095305-a4bdc94d01aa` -> `v3.184.0` | | [github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3](https://redirect.github.com/pulumi/pulumi) | require | minor | `v3.0.0-20250508095305-a4bdc94d01aa` -> `v3.184.0` | | [github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3](https://redirect.github.com/pulumi/pulumi) | require | minor | `v3.0.0-20250508095305-a4bdc94d01aa` -> `v3.184.0` | | [pulumi/actions](https://redirect.github.com/pulumi/actions) | action | minor | `v6.3.0` -> `v6.5.0` | --- ### Release Notes <details> <summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary> ### [`v3.184.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.184.0) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.183.0...v3.184.0) ##### 3.184.0 (2025-07-18) ##### Features - \[sdk/go] Allow setting resource hooks in transforms [#&#8203;20058](https://redirect.github.com/pulumi/pulumi/pull/20058) - \[sdk/nodejs] Allow setting resource hooks in transforms [#&#8203;20057](https://redirect.github.com/pulumi/pulumi/pull/20057) ##### Bug Fixes - \[auto/go] Fix refresh/destroy with inline programs and --run-program flag - \[cli/package] Fix `package add` command when using uv 0.8.0 or later [#&#8203;20075](https://redirect.github.com/pulumi/pulumi/pull/20075) - \[sdk/nodejs] Fix before exit handler - \[programgen/python] Fix imports of packages and modules with multiple name parts, such as "devOps" [#&#8203;20053](https://redirect.github.com/pulumi/pulumi/pull/20053) ##### Miscellaneous - \[sdk/nodejs] Simplify determining the Node.js entrypoint and respect package.exports [#&#8203;19985](https://redirect.github.com/pulumi/pulumi/pull/19985) ### [`v3.183.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.183.0) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.182.0...v3.183.0) ##### 3.183.0 (2025-07-16) ##### Features - \[cli] Support reading v4 checkpoints/deployments [#&#8203;20046](https://redirect.github.com/pulumi/pulumi/pull/20046) - \[cli] Allow transforms to set resource hooks [#&#8203;20051](https://redirect.github.com/pulumi/pulumi/pull/20051) - \[protobuf] Add hooks to TransformResourceOptions [#&#8203;20050](https://redirect.github.com/pulumi/pulumi/pull/20050) - \[auto/{go,nodejs,python}] Support --run-program for inline programs in refresh and destroy operations [#&#8203;19912](https://redirect.github.com/pulumi/pulumi/pull/19912) - \[cli/new] Reflect templates published with `pulumi template publish` in the results of `pulumi new` [#&#8203;19940](https://redirect.github.com/pulumi/pulumi/pull/19940) - \[sdk/nodejs] Automatic ESM configuration [#&#8203;19980](https://redirect.github.com/pulumi/pulumi/pull/19980) - \[sdk/python] Allow setting resource hooks in transforms [#&#8203;20052](https://redirect.github.com/pulumi/pulumi/pull/20052) ##### Bug Fixes - \[cli] Fix a panic in the `console` command when a non-existant stack was passed as a --stack argument [#&#8203;20043](https://redirect.github.com/pulumi/pulumi/pull/20043) - \[sdk/nodejs] Try to normalize component names when auto-inferring them [#&#8203;20048](https://redirect.github.com/pulumi/pulumi/pull/20048) - \[sdk/python/automation] Fix wrong name after stack rename [#&#8203;20028](https://redirect.github.com/pulumi/pulumi/pull/20028) ##### Miscellaneous - \[pkg] Update pulumi-java to v1.16.0 [#&#8203;20063](https://redirect.github.com/pulumi/pulumi/pull/20063) ### [`v3.182.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.182.0) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.181.0...v3.182.0) ##### 3.182.0 (2025-07-14) ##### Features - \[engine] Implement ResourceHooks in the engine [#&#8203;19874](https://redirect.github.com/pulumi/pulumi/pull/19874) - \[engine] Prevent destroy without running the program if any resource have delete hooks [#&#8203;19933](https://redirect.github.com/pulumi/pulumi/pull/19933) - \[engine] Send `Cancel` message to analyzer plugins on engine shutdown [#&#8203;20015](https://redirect.github.com/pulumi/pulumi/pull/20015) - \[sdk/go] Implement ResourceHooks in the Go SDK [#&#8203;20002](https://redirect.github.com/pulumi/pulumi/pull/20002) - \[sdk/nodejs] Implement ResourceHooks in the Node.js SDK [#&#8203;19946](https://redirect.github.com/pulumi/pulumi/pull/19946) - \[sdk/python] Implement ResourceHooks in the Python SDK [#&#8203;19876](https://redirect.github.com/pulumi/pulumi/pull/19876) ##### Bug Fixes - \[cli] Fix `stack select` when local default-org differs from the service setting for default-org [#&#8203;20010](https://redirect.github.com/pulumi/pulumi/pull/20010) - \[cli/new] Fix the AI prompt flow of pulumi new command [#&#8203;19998](https://redirect.github.com/pulumi/pulumi/pull/19998) - \[engine] Fix an issue where the engine would not issue creates and deletes in the correct order for delete before create replacements where dependencies had changed [#&#8203;19945](https://redirect.github.com/pulumi/pulumi/pull/19945) - \[engine] Handle cancellation during construct [#&#8203;19976](https://redirect.github.com/pulumi/pulumi/pull/19976) - \[engine] Run after delete hooks for component resources [#&#8203;20025](https://redirect.github.com/pulumi/pulumi/pull/20025) - \[sdk/{go,nodejs,python}] Pass resource hooks through to construct [#&#8203;20016](https://redirect.github.com/pulumi/pulumi/pull/20016) - \[sdkgen/go] Fix panic in SDK go generator for a map\[string]map\[string]union type [#&#8203;19731](https://redirect.github.com/pulumi/pulumi/pull/19731) - \[sdk/python] Log safely in Python in the presence of `PULUMI_ERROR_OUTPUT_STRING` [#&#8203;18903](https://redirect.github.com/pulumi/pulumi/pull/18903) ##### Miscellaneous - \[sdk/{go,nodejs,python}] Add PULUMI_AUTOMATION_API [#&#8203;19974](https://redirect.github.com/pulumi/pulumi/pull/19974) - \[sdk/{go,nodejs,python}] Add type and name to ResourceHookArgs [#&#8203;20017](https://redirect.github.com/pulumi/pulumi/pull/20017) ### [`v3.181.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31810-2025-06-27) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.180.0...v3.181.0) ##### Features - \[auto/nodejs] Add `previewRefresh` to allow dry-runs of `refresh` commands [#&#8203;19948](https://redirect.github.com/pulumi/pulumi/pull/19948) - \[auto] Support providing runProgram to `preview` and `up` in auto sdk [#&#8203;19729](https://redirect.github.com/pulumi/pulumi/pull/19729) - \[cli] Warn more aggressively for very old CLI versions [#&#8203;19894](https://redirect.github.com/pulumi/pulumi/pull/19894) - \[cli] Add `pulumi template publish` experimental command to publish templates to the Pulumi Registry [#&#8203;19864](https://redirect.github.com/pulumi/pulumi/pull/19864) - \[cli/plugin] Allow `plugin run` to run local binary plugins [#&#8203;19903](https://redirect.github.com/pulumi/pulumi/pull/19903) - \[auto/python] Add `preview_refresh` to allow dry-runs of `refresh` commands [#&#8203;19900](https://redirect.github.com/pulumi/pulumi/pull/19900) - \[auto/python] Add `preview_destroy` to allow dry-runs of `destroy` commands [#&#8203;19947](https://redirect.github.com/pulumi/pulumi/pull/19947) - \[engine] Add `SignalAndWaitForShutdown` RPC call [#&#8203;19837](https://redirect.github.com/pulumi/pulumi/pull/19837) - \[engine] Add lifecycle protobuf definitions [#&#8203;19746](https://redirect.github.com/pulumi/pulumi/pull/19746) ##### Bug Fixes - \[engine] Restore asset and archive hash values after transforms [#&#8203;19960](https://redirect.github.com/pulumi/pulumi/pull/19960) - \[cli] Make it possible for inline automation programs to be used with refresh/destroy [#&#8203;19916](https://redirect.github.com/pulumi/pulumi/pull/19916) - \[cli] Do not assume that package sources without file path prefixes (`./`, `../`) are file paths [#&#8203;19930](https://redirect.github.com/pulumi/pulumi/pull/19930) - \[engine] Fix untargeted resources not always being sent to stack analysis [#&#8203;19943](https://redirect.github.com/pulumi/pulumi/pull/19943) [#&#8203;19926](https://redirect.github.com/pulumi/pulumi/pull/19926) - \[engine] Fix a panic when mixing --target, --refresh, and provider upgrades [#&#8203;19935](https://redirect.github.com/pulumi/pulumi/pull/19935) - \[engine] Fix transforms holding onto engine locks during execution, instead of just during collection [#&#8203;19950](https://redirect.github.com/pulumi/pulumi/pull/19950) - \[engine] Synthesize delete steps for views during preview [#&#8203;19952](https://redirect.github.com/pulumi/pulumi/pull/19952) - \[sdk/nodejs] Fix the use of parameterised packages and mocks [#&#8203;19917](https://redirect.github.com/pulumi/pulumi/pull/19917) ### [`v3.180.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31800-2025-06-26) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.178.0...v3.180.0) ##### Features - \[auto] Support providing runProgram to `preview` and `up` in auto sdk [#&#8203;19729](https://redirect.github.com/pulumi/pulumi/pull/19729) - \[cli] Warn more aggressively for very old CLI versions [#&#8203;19894](https://redirect.github.com/pulumi/pulumi/pull/19894) - \[cli] Add `pulumi template publish` experimental command to publish templates to the Pulumi Registry [#&#8203;19864](https://redirect.github.com/pulumi/pulumi/pull/19864) - \[cli/plugin] Allow `plugin run` to run local binary plugins [#&#8203;19903](https://redirect.github.com/pulumi/pulumi/pull/19903) - \[auto/python] Add `preview_refresh` to allow dry-runs of `refresh` commands [#&#8203;19900](https://redirect.github.com/pulumi/pulumi/pull/19900) - \[auto/python] Add `preview_destroy` to allow dry-runs of `destroy` commands [#&#8203;19947](https://redirect.github.com/pulumi/pulumi/pull/19947) - \[engine] Add `SignalAndWaitForShutdown` RPC call [#&#8203;19837](https://redirect.github.com/pulumi/pulumi/pull/19837) - \[engine] Add lifecycle protobuf definitions [#&#8203;19746](https://redirect.github.com/pulumi/pulumi/pull/19746) ##### Bug Fixes - \[cli] Make it possible for inline automation programs to be used with refresh/destroy [#&#8203;19916](https://redirect.github.com/pulumi/pulumi/pull/19916) - \[cli] Do not assume that package sources without file path prefixes (`./`, `../`) are file paths [#&#8203;19930](https://redirect.github.com/pulumi/pulumi/pull/19930) - \[engine] Fix untargeted resources not always being sent to stack analysis [#&#8203;19943](https://redirect.github.com/pulumi/pulumi/pull/19943) [#&#8203;19926](https://redirect.github.com/pulumi/pulumi/pull/19926) - \[engine] Fix a panic when mixing --target, --refresh, and provider upgrades [#&#8203;19935](https://redirect.github.com/pulumi/pulumi/pull/19935) - \[engine] Fix transforms holding onto engine locks during execution, instead of just during collection [#&#8203;19950](https://redirect.github.com/pulumi/pulumi/pull/19950) - \[engine] Synthesize delete steps for views during preview [#&#8203;19952](https://redirect.github.com/pulumi/pulumi/pull/19952) - \[sdk/nodejs] Fix the use of parameterised packages and mocks [#&#8203;19917](https://redirect.github.com/pulumi/pulumi/pull/19917) ### [`v3.178.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31780-2025-06-20) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.177.0...v3.178.0) ##### Features - \[protobuf] Allow providers to request to --refresh by default from partial failures ##### Bug Fixes - \[auto/go] Fix destroy with debug option results in `unknown flag --debug` error [#&#8203;19885](https://redirect.github.com/pulumi/pulumi/pull/19885) - \[backend/diy] Allow DIY backend to remove stacks that are empty except for their root stack resource, inline with the behaviour of the cloud backend [#&#8203;19883](https://redirect.github.com/pulumi/pulumi/pull/19883) - \[auto/python] Fix parallelism issue when running inline programs with the automation API [#&#8203;19855](https://redirect.github.com/pulumi/pulumi/pull/19855) - \[cli] Fix `pulumi stack select` unnecessarily fetching stack metadata. The `pulumi stack select` command now only fetches stack names instead of complete metadata, since the selection UI only displays stack names. This significantly improves performance, especially for DIY backends where metadata fetching can be slow. Previously, the command was fetching the same metadata as `pulumi stack ls` (last update time, resource count, etc.) but never displaying this information to the user, causing unnecessary delays during stack selection. [#&#8203;19760](https://redirect.github.com/pulumi/pulumi/pull/19760) - \[cli/install] Don't consult the registry when `--file` is specified [#&#8203;19859](https://redirect.github.com/pulumi/pulumi/pull/19859) - \[engine] Fix policy pack versions for remediations from python policy packs [#&#8203;19856](https://redirect.github.com/pulumi/pulumi/pull/19856) - \[engine] Fix views with --refresh --run-program [#&#8203;19877](https://redirect.github.com/pulumi/pulumi/pull/19877) ##### Miscellaneous - \[ci] Make `make install` install all subprojects [#&#8203;19892](https://redirect.github.com/pulumi/pulumi/pull/19892) - \[cli] Update dotnet, java and yaml language runtimes [#&#8203;19896](https://redirect.github.com/pulumi/pulumi/pull/19896) - \[cli/env] Bump esc to 0.14.3 [#&#8203;19886](https://redirect.github.com/pulumi/pulumi/pull/19886) ### [`v3.177.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31770-2025-06-13) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.176.0...v3.177.0) ##### Features - \[sdk/yaml] Enable support for views by default [#&#8203;19847](https://redirect.github.com/pulumi/pulumi/pull/19847) ##### Bug Fixes - \[auto/nodejs] Fix stack name in object after rename operations [#&#8203;19836](https://redirect.github.com/pulumi/pulumi/pull/19836) - \[cli] Respect `--generate-only` when `convert`ing local SDKs ### [`v3.176.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31760-2025-06-12) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.175.0...v3.176.0) ##### Features - \[engine] Enable support for views by default [#&#8203;19813](https://redirect.github.com/pulumi/pulumi/pull/19813) - \[cli/install] Resolve plugin download URLs by referencing the Pulumi Registry [#&#8203;19762](https://redirect.github.com/pulumi/pulumi/pull/19762) - \[cli/plugin] Improve the error message when installing unknown resource plugins [#&#8203;19773](https://redirect.github.com/pulumi/pulumi/pull/19773) - \[sdk/go] Add experimental policy as code SDK [#&#8203;19670](https://redirect.github.com/pulumi/pulumi/pull/19670) ##### Bug Fixes - \[cli] Fix `package add` always reporting providers as crashing [#&#8203;19769](https://redirect.github.com/pulumi/pulumi/pull/19769) - \[programgen] Fix panic in programgen - \[cli/display] Send output about installing policy packs to stderr instead of stdout [#&#8203;19816](https://redirect.github.com/pulumi/pulumi/pull/19816) - \[sdk/{go,nodejs,python}] Fix use of parameterized packages in mocks [#&#8203;19722](https://redirect.github.com/pulumi/pulumi/pull/19722) ##### Miscellaneous - \[engine] Close SourceIterator [#&#8203;19740](https://redirect.github.com/pulumi/pulumi/pull/19740) - \[pkg] Update go.opentelemetry.io/otel to v1.36.0 [#&#8203;19822](https://redirect.github.com/pulumi/pulumi/pull/19822) ### [`v3.175.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31750-2025-06-05) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.174.0...v3.175.0) ##### Bug Fixes - \[engine] Use the new resource goal in `refresh --run-program` with aliases instead of the old one [#&#8203;19578](https://redirect.github.com/pulumi/pulumi/pull/19578) - \[engine] Fix panic when importing resources. [#&#8203;19750](https://redirect.github.com/pulumi/pulumi/pull/19750) ### [`v3.174.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31740-2025-06-04) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.173.0...v3.174.0) ##### Features - \[auto/go] Add PolicyPacks to preview/up options [#&#8203;19702](https://redirect.github.com/pulumi/pulumi/pull/19702) - \[engine] Overhaul of how the import option works, the engine can now import and then update a resource in a single deployment [#&#8203;19339](https://redirect.github.com/pulumi/pulumi/pull/19339) - \[yaml] Update YAML to 1.19.2 [#&#8203;19727](https://redirect.github.com/pulumi/pulumi/pull/19727) - \[sdkgen/python] Add sdkgen for non object method invoke return values [#&#8203;19660](https://redirect.github.com/pulumi/pulumi/pull/19660) ##### Bug Fixes - \[engine] Fix loading of non-client language runtimes when running inline programs [#&#8203;19713](https://redirect.github.com/pulumi/pulumi/pull/19713) - \[engine] Revert recent changes to the config system [#&#8203;19721](https://redirect.github.com/pulumi/pulumi/pull/19721) - \[sdk] Fix of breaking change to WithMocks which splits interface for MethodCall [#&#8203;19687](https://redirect.github.com/pulumi/pulumi/pull/19687) ##### Miscellaneous - \[cli] Ensure logs and tracing are fully written out before exiting [#&#8203;19714](https://redirect.github.com/pulumi/pulumi/pull/19714) - \[engine] Log callbacks requests [#&#8203;19691](https://redirect.github.com/pulumi/pulumi/pull/19691) - \[sdk/nodejs] Require Node.js >= 20 [#&#8203;19697](https://redirect.github.com/pulumi/pulumi/pull/19697) ### [`v3.173.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31730-2025-05-29) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.172.0...v3.173.0) ##### Bug Fixes - \[sdk/go] Revert breaking change to WithMocks [#&#8203;19683](https://redirect.github.com/pulumi/pulumi/pull/19683) ### [`v3.172.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31720-2025-05-29) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.171.0...v3.172.0) ##### Features - \[protobuf] Extend provider protocol to allow providers to request to --refresh resources by default [#&#8203;19487](https://redirect.github.com/pulumi/pulumi/pull/19487) - \[sdk/go] Add sdk support for scalar call returns from providers [#&#8203;19589](https://redirect.github.com/pulumi/pulumi/pull/19589) ##### Bug Fixes - \[auto/python] Revert: Add `on_error` callback for capturing incremental stderr output, which used a library not compatible with Windows [#&#8203;19649](https://redirect.github.com/pulumi/pulumi/pull/19649) - \[cli] Improve error message when stack select is run in non-interactive mode [#&#8203;19628](https://redirect.github.com/pulumi/pulumi/pull/19628) - \[cli] Fix `up --refresh --run-program` to use the new program based refresh logic [#&#8203;19667](https://redirect.github.com/pulumi/pulumi/pull/19667) - \[sdkgen] Fix data race in codegen type conversions [#&#8203;19604](https://redirect.github.com/pulumi/pulumi/pull/19604) - \[cli/config] Warn about YAML null being read as empty string [#&#8203;19483](https://redirect.github.com/pulumi/pulumi/pull/19483) - \[cli/display] Fix color of Copilot summarize-error so its more readable on light terminals [#&#8203;19644](https://redirect.github.com/pulumi/pulumi/pull/19644) - \[cli/engine] Shut down plugins more gracefully when the CLI is shutting down [#&#8203;19603](https://redirect.github.com/pulumi/pulumi/pull/19603) - \[programgen/python] Add pulumi as reserved keyword in binder to fix python codegen issues [#&#8203;19277](https://redirect.github.com/pulumi/pulumi/pull/19277) ##### Miscellaneous - \[sdk/python] Remove workaround for UWP reparse point issue [#&#8203;19627](https://redirect.github.com/pulumi/pulumi/pull/19627) ### [`v3.171.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31710-2025-05-21) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.170.0...v3.171.0) ##### Features - \[cli] Add `pulumi esc` as an alias for `pulumi env` [#&#8203;19610](https://redirect.github.com/pulumi/pulumi/pull/19610) - \[engine] Elide `StackReference` outputs that fail to decrypt [#&#8203;19533](https://redirect.github.com/pulumi/pulumi/pull/19533) - \[programgen] Ensure convert uses the output project directory as the working directory [#&#8203;19582](https://redirect.github.com/pulumi/pulumi/pull/19582) - \[cli/display] Release explain-preview and summarize-error Copilot features [#&#8203;19544](https://redirect.github.com/pulumi/pulumi/pull/19544) - \[cli/engine] Enable debugging of source based plugins, using `--attach-debugger plugin=<name>` [#&#8203;19553](https://redirect.github.com/pulumi/pulumi/pull/19553) - \[cli/install] Allow `pulumi install` to install dependencies inside plugin project folders [#&#8203;19580](https://redirect.github.com/pulumi/pulumi/pull/19580) - \[auto/python] Add `on_error` callback for capturing incremental stderr output [#&#8203;19541](https://redirect.github.com/pulumi/pulumi/pull/19541) - \[programgen/nodejs] Add `callSingle` to the NodeJS SDK to support non-object method return values [#&#8203;19387](https://redirect.github.com/pulumi/pulumi/pull/19387) - \[programgen/python] Add sdk support for scalar call returns from providers [#&#8203;19419](https://redirect.github.com/pulumi/pulumi/pull/19419) - \[sdk/python] Add new provider interface to `pulumi.provider.experimental.provider` [#&#8203;19080](https://redirect.github.com/pulumi/pulumi/pull/19080) - \[sdk/python] Support enum references in component providers [#&#8203;19471](https://redirect.github.com/pulumi/pulumi/pull/19471) ##### Bug Fixes - \[cli] Enumerate supported CI systems deterministically [#&#8203;19593](https://redirect.github.com/pulumi/pulumi/pull/19593) - \[engine] Make the engine respect errors from plugin Handshake methods [#&#8203;19595](https://redirect.github.com/pulumi/pulumi/pull/19595) - \[cli/install] Fix installation of python policies to default to virtualenv rather than site-packages [#&#8203;19570](https://redirect.github.com/pulumi/pulumi/pull/19570) ### [`v3.170.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31700-2025-05-15) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.169.0...v3.170.0) ##### Features - \[engine] The engine now defers policy pack installation to the language hosts [#&#8203;19477](https://redirect.github.com/pulumi/pulumi/pull/19477) - \[programgen] Copy assets emitted from converter plugins to target directory of the generated projects [#&#8203;19500](https://redirect.github.com/pulumi/pulumi/pull/19500) - \[programgen] Add GeneratedProjectDirectory to ConvertProgramRequest for converter plugins [#&#8203;19513](https://redirect.github.com/pulumi/pulumi/pull/19513) - \[sdk/nodejs] Pass `ignoreChanges`, `replaceOnChanges`, `customTimeouts`, `retainOnDelete`, and `deletedWith` to the provider constructor [#&#8203;19496](https://redirect.github.com/pulumi/pulumi/pull/19496) - \[sdk/nodejs] Pass `ignoreChanges`, `replaceOnChanges`, `customTimeouts`, `retainOnDelete`, and `deletedWith` to the provider constructor [#&#8203;19494](https://redirect.github.com/pulumi/pulumi/pull/19494) ##### Bug Fixes - \[auto/python] Fix hang in automation API operations [#&#8203;19539](https://redirect.github.com/pulumi/pulumi/pull/19539) - \[cli/config] Config system now maintains types based on the YAML type from the config file [#&#8203;19503](https://redirect.github.com/pulumi/pulumi/pull/19503) - \[cli/install] Don't overwrite versions embedded in the plugin spec ##### Miscellaneous - \[engine] Split analyzer handshake into handshake and stackconfigure [#&#8203;19506](https://redirect.github.com/pulumi/pulumi/pull/19506) - \[sdk] Add optional cache duration to CLIVersionResponse apitype [#&#8203;19523](https://redirect.github.com/pulumi/pulumi/pull/19523) - \[sdk/go] Accept `context.Context` in `workspace.GetPluginInfo` and `workspace.GetPluginPath`. [#&#8203;19527](https://redirect.github.com/pulumi/pulumi/pull/19527) - \[sdk/go] Accept `context.Context` wherever new `plugin.Context`s are created. [#&#8203;19526](https://redirect.github.com/pulumi/pulumi/pull/19526) ### [`v3.169.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31690-2025-05-08) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.168.0...v3.169.0) ##### Features - \[cli] Add `--run-program` to `preview` and `up` for use with `--refresh` [#&#8203;19449](https://redirect.github.com/pulumi/pulumi/pull/19449) - \[engine] Use language runtimes `RunPlugin` method for booting policy packs - \[pkg] Add MainContext to allow for provider cancelation [#&#8203;19445](https://redirect.github.com/pulumi/pulumi/pull/19445) - \[auto/{nodejs,python}] Add --config-file option to Automation API operations (Preview, Up, Refresh, Destroy) for NodeJS, and Python ##### Bug Fixes - \[engine] Fix `refresh --run-program` hanging on non-trivial programs [#&#8203;19448](https://redirect.github.com/pulumi/pulumi/pull/19448) - \[programgen/nodejs] Fix generating imports for functions in 3-rd party packages such as [@&#8203;pulumiverse/scaleway](https://redirect.github.com/pulumiverse/scaleway) [#&#8203;19410](https://redirect.github.com/pulumi/pulumi/pull/19410) ### [`v3.168.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31680-2025-05-07) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.167.0...v3.168.0) ##### Features - \[cli] Consider unresolved references a validation error; add the `--allow-dangling-references` flag to opt out of this behaviour [#&#8203;19216](https://redirect.github.com/pulumi/pulumi/pull/19216) - \[sdk] Support Node.js 24 [#&#8203;19420](https://redirect.github.com/pulumi/pulumi/pull/19420) - \[cli/state] Add pulumi state protect [#&#8203;19355](https://redirect.github.com/pulumi/pulumi/pull/19355) - \[sdk/go] Update to Go 1.23 [#&#8203;19118](https://redirect.github.com/pulumi/pulumi/pull/19118) - \[sdk/go] Add a Delete method to property.Map [#&#8203;19384](https://redirect.github.com/pulumi/pulumi/pull/19384) - \[sdk/go] Support private GitHub and GitLab instances, when installing plugins directly from a repository [#&#8203;19377](https://redirect.github.com/pulumi/pulumi/pull/19377) - \[sdk/python] Support Resource References [#&#8203;19226](https://redirect.github.com/pulumi/pulumi/pull/19226) ##### Bug Fixes - \[engine] Adjust analyzer handshake request that stack configuration is optional [#&#8203;19435](https://redirect.github.com/pulumi/pulumi/pull/19435) - \[cli/display] Fix race condition when rendering progress events [#&#8203;19434](https://redirect.github.com/pulumi/pulumi/pull/19434) - \[cli/package] Make sure namespaces from Git Plugins are always lowercase [#&#8203;19441](https://redirect.github.com/pulumi/pulumi/pull/19441) - \[cli/plugin] Allow creating analyzer plugins without config [#&#8203;19393](https://redirect.github.com/pulumi/pulumi/pull/19393) [#&#8203;19395](https://redirect.github.com/pulumi/pulumi/pull/19395) ##### Miscellaneous - \[cli] Update yaml, java & dotnet ### [`v3.167.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31670-2025-05-01) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.166.0...v3.167.0) ##### Features - \[auto/nodejs] Add `onError` callback for capturing incremental stderr output [#&#8203;19372](https://redirect.github.com/pulumi/pulumi/pull/19372) - \[pkg] Allow for hyphens in function names [#&#8203;19352](https://redirect.github.com/pulumi/pulumi/pull/19352) - \[auto/python] Add the ability to configure a remote executor image [#&#8203;19304](https://redirect.github.com/pulumi/pulumi/pull/19304) - \[sdk/yaml] Update pulumi-yaml to v1.18.0 [#&#8203;19381](https://redirect.github.com/pulumi/pulumi/pull/19381) ##### Bug Fixes - \[auto/nodejs] Fix flag mismatch with preview-only refresh operations [#&#8203;19370](https://redirect.github.com/pulumi/pulumi/pull/19370) - \[cli/plugin] Allow creating analyzer plugins without config [#&#8203;19392](https://redirect.github.com/pulumi/pulumi/pull/19392) - \[auto/python] Fix flag mismatch with preview-only refresh operations [#&#8203;19373](https://redirect.github.com/pulumi/pulumi/pull/19373) ### [`v3.166.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31660-2025-04-29) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.165.0...v3.166.0) ##### Features - \[engine] Add Handshake to analyzer plugins [#&#8203;19328](https://redirect.github.com/pulumi/pulumi/pull/19328) - \[auto/go] Add `--exclude` and `--exclude-dependents` to the Automation API [#&#8203;19333](https://redirect.github.com/pulumi/pulumi/pull/19333) - \[auto/python] Add `--exclude` and `--exclude-dependents` to the Automation API [#&#8203;19310](https://redirect.github.com/pulumi/pulumi/pull/19310) - \[cli/package] Introduce `pulumi package info` to show information about a package - \[sdk/python] Decorate resources and enums with their type token [#&#8203;19357](https://redirect.github.com/pulumi/pulumi/pull/19357) ##### Bug Fixes - \[cli] Always save fully qualified stack names to the settings file [#&#8203;19336](https://redirect.github.com/pulumi/pulumi/pull/19336) - \[engine] Fix error message when trying to load plugins in private repositories with no authentication [#&#8203;19331](https://redirect.github.com/pulumi/pulumi/pull/19331) - \[sdk/nodejs] Return complete package descriptors for dependencies [#&#8203;19346](https://redirect.github.com/pulumi/pulumi/pull/19346) ##### Miscellaneous - \[cli/package] Mark package publish command as non-experimental [#&#8203;19356](https://redirect.github.com/pulumi/pulumi/pull/19356) - \[sdk/python] Move pulumi.provider.experimental.provider to pulumi.provider.experimental.component </details> <details> <summary>pulumi/pulumi-docker-build (github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild)</summary> ### [`v0.0.12`](https://redirect.github.com/pulumi/pulumi-docker-build/compare/v0.0.11...v0.0.12) [Compare Source](https://redirect.github.com/pulumi/pulumi-docker-build/compare/v0.0.11...v0.0.12) </details> <details> <summary>pulumi/pulumi-dotnet (github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3)</summary> ### [`v3.85.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3851---2025-07-11) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.85.0...v3.85.1) ##### Bug Fixes - \[sdk] Pick versioned artifacts when publishing [#&#8203;667](https://redirect.github.com/pulumi/pulumi-dotnet/pull/667) ### [`v3.85.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3850---2025-07-11) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.84.0...v3.85.0) ##### Improvements - \[sdk] Implement resource hooks in the .Net SDK [#&#8203;663](https://redirect.github.com/pulumi/pulumi-dotnet/pull/663) ##### Bug Fixes - \[sdk] Disable stack auto parenting for resources that are read from the engine [#&#8203;615](https://redirect.github.com/pulumi/pulumi-dotnet/pull/615) ##### Improvements - \[sdk/provider] Send old inputs to diff and update and delete [#&#8203;650](https://redirect.github.com/pulumi/pulumi-dotnet/pull/650) ### [`v3.84.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3840---2025-06-18) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.83.2...v3.84.0) ##### Improvements - \[sdk] Add support for invoke transforms [#&#8203;606](https://redirect.github.com/pulumi/pulumi-dotnet/pull/606) ### [`v3.83.2`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3832---2025-06-12) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.82.1...v3.83.2) ##### Bug Fixes - \[build] Fix release process [#&#8203;643](https://redirect.github.com/pulumi/pulumi-dotnet/pull/643) - \[runtime] Respect grpc cancellation to stop running subcommands when the engine has requested it [#&#8203;642](https://redirect.github.com/pulumi/pulumi-dotnet/pull/642) ### [`v3.82.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3821---2025-05-28) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.82.0...v3.82.1) ##### Bug Fixes - \[runtime] Fix gen-sdk fails if there are dangling references [#&#8203;614](https://redirect.github.com/pulumi/pulumi-dotnet/pull/614) ### [`v3.82.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3820---2025-05-21) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.81.0...v3.82.0) ##### Improvements - \[runtime] Enable debugging providers using --attach-debugger=plugins [#&#8203;600](https://redirect.github.com/pulumi/pulumi-dotnet/pull/600) ### [`v3.81.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3810---2025-05-15) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.80.0...v3.81.0) ##### Improvements - \[sdk] Update PropertyValue to track secretness and dependencies directly on PropertyValue [#&#8203;591](https://redirect.github.com/pulumi/pulumi-dotnet/pull/591) ##### Bug Fixes - \[sdk] Component output properties are no longer overwritten with `unknown` [#&#8203;595](https://redirect.github.com/pulumi/pulumi-dotnet/pull/595) ##### Improvements - \[sdk/auto] Expose `--remote-executor-*` flags in the Automation API [#&#8203;587](https://redirect.github.com/pulumi/pulumi-dotnet/pull/587) ### [`v3.80.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3800---2025-05-07) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.79.0...v3.80.0) ##### Improvements - \[sdk/auto] Add --run-program to destory and refresh operations [#&#8203;580](https://redirect.github.com/pulumi/pulumi-dotnet/pull/580) - \[sdk/auto] Add `--exclude` and `--exclude-dependents` to the Automation API [#&#8203;582](https://redirect.github.com/pulumi/pulumi-dotnet/pull/582) ### [`v3.79.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3790---2025-04-24) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.78.0...v3.79.0) ##### Bug Fixes - \[sdk] Fix deserialising InputMap<T> with unknown values [#&#8203;570](https://redirect.github.com/pulumi/pulumi-dotnet/pull/570) ##### Improvements - \[sdk/auto] Adds the `ConfigFile` option to all operation options in the Automation API (UpOptions, PreviewOptions, RefreshOptions, DestroyOptions) to support specifyin [#&#8203;573](https://redirect.github.com/pulumi/pulumi-dotnet/pull/573) ### [`v3.78.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3780---2025-04-08) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.77.0...v3.78.0) ##### Bug Fixes - \[sdk] Async context is now captured from the main program and restored in transform functions [#&#8203;561](https://redirect.github.com/pulumi/pulumi-dotnet/pull/561) - \[sdk] Use the invariant culture when converting strings/numbers, replace some readonly fields with readonly properties in `Pulumi.Experimental`, and rename some generic type parameters to follow the standard naming convention of being prefixed by `T`, e.g. `InputMap<V>` => `InputMap<TValue>` [#&#8203;564](https://redirect.github.com/pulumi/pulumi-dotnet/pull/564) ##### Improvements - \[sdk/auto] Add the `--preview-only` flag to the `destroy` command in the Automation API [#&#8203;554](https://redirect.github.com/pulumi/pulumi-dotnet/pull/554) - \[sdk/provider] Replaced `PropertyValue.TryUnwrap` with `Unwrap` [#&#8203;562](https://redirect.github.com/pulumi/pulumi-dotnet/pull/562) ##### Bug Fixes - \[sdk/provider] Add missing support for EnumType to PropertyValueSerializer [#&#8203;557](https://redirect.github.com/pulumi/pulumi-dotnet/pull/557) ### [`v3.77.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3770---2025-03-27) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.76.1...v3.77.0) ##### Bug Fixes - \[sdk] Exclude resource references from property dependencies for packaged components [#&#8203;488](https://redirect.github.com/pulumi/pulumi-dotnet/pull/488) ##### Improvements - \[sdk/auto] Add --show-reads Support for Pulumi Up & Preview [#&#8203;542](https://redirect.github.com/pulumi/pulumi-dotnet/pull/542) - \[sdk/provider] Infer package name and namespace in ComponentProviderHost [#&#8203;555](https://redirect.github.com/pulumi/pulumi-dotnet/pull/555) - \[sdk/provider] Default the version of ComponentProviderHost to 0.0.0 [#&#8203;556](https://redirect.github.com/pulumi/pulumi-dotnet/pull/556) ##### Bug Fixes - \[sdk/provider] Handle logging arguments in provider's getEngineAddress [#&#8203;536](https://redirect.github.com/pulumi/pulumi-dotnet/pull/536) ### [`v3.76.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3761---2025-03-10) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.76.0...v3.76.1) ### [`v3.76.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3760---2025-03-10) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.75.2...v3.76.0) ##### Improvements - \[sdk] Make OutputConstructorAttribute optional [#&#8203;438](https://redirect.github.com/pulumi/pulumi-dotnet/pull/438) - \[sdk] Log a warning when trying to convert outputs to strings [#&#8203;525](https://redirect.github.com/pulumi/pulumi-dotnet/pull/525) - \[sdk/auto] Add `pulumi install` to Automation Api [#&#8203;426](https://redirect.github.com/pulumi/pulumi-dotnet/pull/426) - \[sdk/auto] Add `--refresh` to preview, up and destroy commands [#&#8203;431](https://redirect.github.com/pulumi/pulumi-dotnet/pull/431) ##### Bug Fixes - \[sdk/converter] Fix conversion for nested Output<T> [#&#8203;527](https://redirect.github.com/pulumi/pulumi-dotnet/pull/527) ### [`v3.75.2`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3752---2025-02-26) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.75.1...v3.75.2) ##### Bug Fixes - \[runtime] Revert changes to target net8 in provider SDKs [#&#8203;515](https://redirect.github.com/pulumi/pulumi-dotnet/pull/515) ### [`v3.75.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3751---2025-02-26) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.75.0...v3.75.1) Follow up release after v3.75, this reverts the updates to targeting net8. ### [`v3.75.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3750---2025-02-26) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.74.0...v3.75.0) ##### Improvements - \[sdk] updated pulumi submodule and go.mod sdk/pkg and excluded failing conformance tests [#&#8203;482](https://redirect.github.com/pulumi/pulumi-dotnet/pull/482) - \[sdk] Support parameterization for remote component resources [#&#8203;502](https://redirect.github.com/pulumi/pulumi-dotnet/pull/502) ##### bug-fixes - \[sdk] Fix inconsistent behavior of inheritance for InputAttribute and OutputAttribute [#&#8203;506](https://redirect.github.com/pulumi/pulumi-dotnet/pull/506) ##### Improvements - \[sdk/auto] Add the `--preview-only` flag for the `refresh` command [#&#8203;496](https://redirect.github.com/pulumi/pulumi-dotnet/pull/496) - \[sdk/provider] Schema Analyzer to infer component schemas from classes [#&#8203;468](https://redirect.github.com/pulumi/pulumi-dotnet/pull/468) - \[sdk/provider] Implement component provider host for auto-inferred components [#&#8203;507](https://redirect.github.com/pulumi/pulumi-dotnet/pull/507) ### [`v3.74.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3740---2025-02-19) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.73.0...v3.74.0) ##### Improvements - \[sdk] Add ability to disable ToString on Output<T> [#&#8203;461](https://redirect.github.com/pulumi/pulumi-dotnet/pull/461) ##### bug-fixes - \[sdk] Handle null in InputMap/List implicit conversions [#&#8203;459](https://redirect.github.com/pulumi/pulumi-dotnet/pull/459) - \[sdk] Fix the Provider and Providers option when used in resource transforms [#&#8203;460](https://redirect.github.com/pulumi/pulumi-dotnet/pull/460) - \[sdk] Fix adding the same value to InputMap multiple times [#&#8203;462](https://redirect.github.com/pulumi/pulumi-dotnet/pull/462) ### [`v3.73.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3730---2025-02-06) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.72.0...v3.73.0) ##### Improvements - \[sdk] InputMap and InputList no longer flatten nested unknowns/secrets to apply to the whole object. [#&#8203;449](https://redirect.github.com/pulumi/pulumi-dotnet/pull/449) ##### Bug Fixes - \[runtime] Don't parse runtime options at startup, defer to the options sent for specific methods [#&#8203;451](https://redirect.github.com/pulumi/pulumi-dotnet/pull/451) ### [`v3.72.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3720---2025-01-30) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.71.1...v3.72.0) ##### Bug Fixes - \[sdk] Avoid calling invokes with dependencies on unknown resources [#&#8203;441](https://redirect.github.com/pulumi/pulumi-dotnet/pull/441) - \[sdk] Wait for resources in the input property dependencies [#&#8203;444](https://redirect.github.com/pulumi/pulumi-dotnet/pull/444) ##### Improvements - \[runtime] Plugins with msbuild warnings can still be run [#&#8203;437](https://redirect.github.com/pulumi/pulumi-dotnet/pull/437) - \[runtime] Implement GetRequiredPackages to replace GetRequiredPlugins [#&#8203;440](https://redirect.github.com/pulumi/pulumi-dotnet/pull/440) ### [`v3.71.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3711---2024-12-19) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.71.0...v3.71.1) ##### Bug Fixes - \[sdk] Await background tasks during inline deployment [#&#8203;420](https://redirect.github.com/pulumi/pulumi-dotnet/pull/420) - \[sdk] Fix parameterized explicit providers [#&#8203;435](https://redirect.github.com/pulumi/pulumi-dotnet/pull/435) - \[runtime] Fix the language plugin to return a version [#&#8203;390](https://redirect.github.com/pulumi/pulumi-dotnet/pull/390) ### [`v3.71.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3710---2024-12-05) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.70.0...v3.71.0) ##### Improvements - \[sdk] Allow specifying dependencies for output invokes [#&#8203;412](https://redirect.github.com/pulumi/pulumi-dotnet/pull/412) - \[sdk/provider] Add Parameterize to the provider interface [#&#8203;404](https://redirect.github.com/pulumi/pulumi-dotnet/pull/404) ### [`v3.70.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3700---2024-11-27) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.69.0...v3.70.0) ##### Bug Fixes - \[sdk/auto] Fix warning for inline programs [#&#8203;388](https://redirect.github.com/pulumi/pulumi-dotnet/pull/388) ##### Improvements - \[runtime] Reduce binary size by stripping debug information [#&#8203;411](https://redirect.github.com/pulumi/pulumi-dotnet/pull/411) ### [`v3.69.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3690---2024-11-21) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.68.0...v3.69.0) ##### Improvements - \[sdk] Make Pulumi.RunException public [#&#8203;364](https://redirect.github.com/pulumi/pulumi-dotnet/pull/364) - \[sdk] Add `DeferredOutput` for resolving some output/input cycles [#&#8203;385](https://redirect.github.com/pulumi/pulumi-dotnet/pull/385) ##### bug-fixes - \[sdk] Support input lists and maps in JsonSerializer.SerializeAsync and JsonSerializer.DeserializeAsync [#&#8203;372](https://redirect.github.com/pulumi/pulumi-dotnet/pull/372) - \[sdk] Fix publishing to set a required property used by the Automation Api to Install Pulumi cli [#&#8203;393](https://redirect.github.com/pulumi/pulumi-dotnet/pull/393) ##### Improvements - \[sdk/auto] Lessen the strictness of `OperationTypeConverter` to allow unknown operations [#&#8203;350](https://redirect.github.com/pulumi/pulumi-dotnet/pull/350) - \[sdk/auto] Update YamlDotNet to v16.1.2 [#&#8203;354](https://redirect.github.com/pulumi/pulumi-dotnet/pull/354) - \[sdk/auto] Add pulumi stack change-secrets-provider to automation api [#&#8203;383](https://redirect.github.com/pulumi/pulumi-dotnet/pull/383) - \[sdk/provider] OutputReference.Value will normalize to null for Computed values [#&#8203;381](https://redirect.github.com/pulumi/pulumi-dotnet/pull/381) ##### Bug Fixes - \[sdk/provider] Fix a bug deserialising unknown secrets [#&#8203;378](https://redirect.github.com/pulumi/pulumi-dotnet/pull/378) - \[runtime] Improve the detections of project files when attaching a debugger [#&#8203;255](https://redirect.github.com/pulumi/pulumi-dotnet/pull/255) - \[runtime] Fix RunPlugin with new versions of the pulumi cli [#&#8203;395](https://redirect.github.com/pulumi/pulumi-dotnet/pull/395) ### [`v3.68.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3680---2024-09-17) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.67.1...v3.68.0) ##### Improvements - \[sdk] Parameterized providers are now considered stable [#&#8203;347](https://redirect.github.com/pulumi/pulumi-dotnet/pull/347) - \[sdk/provider] Support authoring multi-language components in .NET [#&#8203;275](https://redirect.github.com/pulumi/pulumi-dotnet/pull/275) ### [`v3.67.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3671---2024-09-13) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.67.0...v3.67.1) ##### Bug Fixes - \[runtime] Fix debugger support [#&#8203;343](https://redirect.github.com/pulumi/pulumi-dotnet/pull/343) ### [`v3.67.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3670---2024-09-10) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.66.2...v3.67.0) ##### Improvements - \[sdk] Add support for attaching debuggers [#&#8203;332](https://redirect.github.com/pulumi/pulumi-dotnet/pull/332) ##### Bug Fixes - \[sdk/provider] Fix serialization of ComponentResources (no id required) [#&#8203;331](https://redirect.github.com/pulumi/pulumi-dotnet/pull/331) - \[sdk/provider] Fix output value serialization. [#&#8203;337](https://redirect.github.com/pulumi/pulumi-dotnet/pull/337) ### [`v3.66.2`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3662---2024-08-20) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.66.1...v3.66.2) ##### Bug Fixes - \[sdk] Update Pulumi.Protobuf to v3.27.3 (fork) [#&#8203;324](https://redirect.github.com/pulumi/pulumi-dotnet/pull/324) ### [`v3.66.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3661---2024-08-09) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.66.0...v3.66.1) ##### Bug Fixes - \[sdk] Fix binary compatibility with provider SDKs built using older version of the core SDK [#&#8203;318](https://redirect.github.com/pulumi/pulumi-dotnet/pull/318) ### [`v3.66.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3660---2024-08-09) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.65.0...v3.66.0) ##### Improvements - \[sdk] Support package parameterization for Read/RegisterResource/Call/Invoke [#&#8203;311](https://redirect.github.com/pulumi/pulumi-dotnet/pull/311) ##### Bug Fixes - \[sdk] Fix type annotations for inputListFromT0/1 [#&#8203;301](https://redirect.github.com/pulumi/pulumi-dotnet/pull/301) - \[sdk] Fix race condition in GrpcMonitor's GrpcChannel management [#&#8203;304](https://redirect.github.com/pulumi/pulumi-dotnet/pull/304) - \[sdk] Fix unknown inputs deserialization [#&#8203;306](https://redirect.github.com/pulumi/pulumi-dotnet/pull/306) - \[sdk] Fix program hanging when a resource transformation throws an exception [#&#8203;307](https://redirect.github.com/pulumi/pulumi-dotnet/pull/307) - \[sdk] Fix handling of input properties with backing fields [#&#8203;308](https://redirect.github.com/pulumi/pulumi-dotnet/pull/308) ##### Improvements - \[sdk/auto] Implement Stack.ImportAsync() for batch importing resources into a stack [#&#8203;296](https://redirect.github.com/pulumi/pulumi-dotnet/pull/296) ### [`v3.65.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3650---2024-07-18) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.64.0...v3.65.0) ##### Improvements - \[sdk] Update Grpc dependency. [#&#8203;256](https://redirect.github.com/pulumi/pulumi-dotnet/pull/256) - \[sdk] Strongly type URN values in Provider [#&#8203;293](https://redirect.github.com/pulumi/pulumi-dotnet/pull/293) ##### Bug Fixes - \[sdk] Enable .net analyzers and fix warnings. [#&#8203;278](https://redirect.github.com/pulumi/pulumi-dotnet/pull/278) - \[sdk] Bufix Parsing of CustomTimeouts [#&#8203;290](https://redirect.github.com/pulumi/pulumi-dotnet/pull/290) - \[sdk] Add support for deserializing output values and use them from transforms [#&#8203;298](https://redirect.github.com/pulumi/pulumi-dotnet/pull/298) ##### Improvements - \[runtime] Update pulumi/pulumi to 3.121 [#&#8203;288](https://redirect.github.com/pulumi/pulumi-dotnet/pull/288) ### [`v3.64.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3640---2024-06-10) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.63.1...v3.64.0) ##### Improvements - \[sdk] Make transforms a stable feature, not experimental [#&#8203;270](https://redirect.github.com/pulumi/pulumi-dotnet/pull/270) - \[sdk/provider] Refactor Provider tests in order to prepare integration testing [#&#8203;277](https://redirect.github.com/pulumi/pulumi-dotnet/pull/277) ##### Bug Fixes - \[runtime] Upgrade dependencies [#&#8203;279](https://redirect.github.com/pulumi/pulumi-dotnet/pull/279) ### [`v3.63.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3631---2024-04-25) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.63.0...v3.63.1) ##### Bug Fixes - \[sdk] Remove Google.Protobuf pinned dependency. [#&#8203;268](https://redirect.github.com/pulumi/pulumi-dotnet/pull/268) ### [`v3.63.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3630---2024-04-25) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.62.0...v3.63.0) ##### Improvements - \[sdk] Support the Result field for better support of up --continue-on-error [#&#8203;259](https://redirect.github.com/pulumi/pulumi-dotnet/pull/259) ##### Bug Fixes - \[sdk] Revert gRPC update that broke large messages. [#&#8203;266](https://redirect.github.com/pulumi/pulumi-dotnet/pull/266) ##### Improvements - \[sdk/auto] Add ContinueOnError option to the automation API [#&#8203;265](https://redirect.github.com/pulumi/pulumi-dotnet/pull/265) ### [`v3.62.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3620---2024-04-22) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.61.0...v3.62.0) ##### Improvements - \[sdk] Allow apply to have unknown values during updates [#&#8203;258](https://redirect.github.com/pulumi/pulumi-dotnet/pull/258) ##### Bug Fixes - \[sdk] Use InvariantCulture when parsing numbers from config [#&#8203;262](https://redirect.github.com/pulumi/pulumi-dotnet/pull/262) - \[sdk] Pin Google.Protobuf to 3.24. [#&#8203;263](https://redirect.github.com/pulumi/pulumi-dotnet/pull/263) ### [`v3.61.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3610---2024-04-16) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.60.0...v3.61.0) ##### Improvements - \[sdk] Add attribute to handle deserialization of constructor parameters with name overrides [#&#8203;231](https://redirect.github.com/pulumi/pulumi-dotnet/pull/231) - \[sdk] Add experimental support for the new transforms system [#&#8203;234](https://redirect.github.com/pulumi/pulumi-dotnet/pull/234) - \[sdk] Add FSharp Ops helpers [#&#8203;250](https://redirect.github.com/pulumi/pulumi-dotnet/pull/250) - \[sdk] Handle Outputs in derived Stacks [#&#8203;251](https://redirect.github.com/pulumi/pulumi-dotnet/pull/251) ### [`v3.60.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3600---2024-03-05) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.59.0...v3.60.0) ##### Improvements - \[sdk] Add environment add and remove commands to automation api [#&#8203;210](https://redirect.github.com/pulumi/pulumi-dotnet/pull/210) - \[sdk] Update Grpc dependency. [#&#8203;219](https://redirect.github.com/pulumi/pulumi-dotnet/pull/219) - \[sdk] Drop support for netcoreapp3.1 [#&#8203;235](https://redirect.github.com/pulumi/pulumi-dotnet/pull/235) - \[sdk/auto] Add new API to install the Pulumi CLI from the Automation API [#&#8203;226](https://redirect.github.com/pulumi/pulumi-dotnet/pull/226) - \[sdk/provider] Initial implementation of a reflection-based PropertyValue deserializer [#&#8203;201](https://redirect.github.com/pulumi/pulumi-dotnet/pull/201) ### [`v3.59.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3590---2023-11-15) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.58.0...v3.59.0) ##### Improvements - \[sdk] Implement reflection-based RegisterOutputs() for component resources [#&#8203;200](https://redirect.github.com/pulumi/pulumi-dotnet/pull/200) - \[sdk] Support .NET 8. [#&#8203;205](https://redirect.github.com/pulumi/pulumi-dotnet/pull/205) ##### Bug Fixes - \[sdk/auto] Fix issue with specifying a git username for remote workspaces. [#&#8203;186](https://redirect.github.com/pulumi/pulumi-dotnet/pull/186) ### [`v3.58.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v3580---2023-10-27) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.57.0...v3.58.0) ##### Bug Fixes - \[sdk] Register and await tasks created from `Apply` that don't return anything. [#&#8203;183](https://redirect.github.com/pulumi/pulumi-dotnet/pull/183) ##### Improvements - \[sdk/auto] Add support for the path option for config operations. [#&#8203;191](https://redirect.github.com/pulumi/pulumi-dotnet/pull/191) ### [`v3.57.0`](https://redirect.github.com/pulumi/pulumi-dotnet/releases/tag/v3.57.0) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.56.2...v3.57.0) ##### Improvements - Converter SDK: add `Args: string[]` to the `ConvertProgramRequest` fields which allows converter plugins to access args provided to `pulumi convert` ### [`v3.56.2`](https://redirect.github.com/pulumi/pulumi-dotnet/releases/tag/v3.56.2) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.56.1...v3.56.2) ##### Improvements - Plugin: clean up resources and exit cleanly on receiving SIGINT or CTRL_BREAK. ##### Bug Fixes ### [`v3.56.1`](https://redirect.github.com/pulumi/pulumi-dotnet/releases/tag/v3.56.1) [Compare Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.56.0...v3.56.1) ##### Bug Fixes - \[sdk/automation-api] Adds guards in a non-destructive way against invalid JSON engine event data. [#&#8203;167](https://redirect.github.com/pulumi/pulumi-dotnet/pull/167) ### [`v3.56.0`](https://redirect.github.com/pulumi/pulumi-dotnet/releases/tag/v3.56.0) [Compare Source](https: </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - "every weekday" (UTC). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xOS4wIiwidXBkYXRlZEluVmVyIjoiMzkuMTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiaW1wYWN0L25vLWNoYW5nZWxvZy1yZXF1aXJlZCJdfQ==--> --------- Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com> Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2025-07-18 23:53:59 +00:00
Bryce Lampe	4436ab5e76	Changes for upcoming go-provider v1.0 (#525) ... Fixes #535	2025-05-15 16:38:58 -07:00
Bryce Lampe	52d8cfcd96	Fix bad dependencies (#536) ... I had to relax branch protections in order to merge #527 and during that time Renovate was able to sneak some bad PRs in. This rolls those changes back.	2025-05-01 15:47:53 -07:00
Ramon Quitales	8c5a9ac033	Fix weekly pulumi/pulumi update (#501) ... Fixes: #497 This PR follows the `weekly-pulumi-update` CI workflow steps to update our `pulumi/pulumi` dependency, with manual intervention to resolve tooling update conflicts. Before generating the SDKs, it's necessary to update the language tools and otel packages to ensure compatibility with the latest changes. Additional command executed for the manual updates: ```sh TOOLS=( "github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3" "github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3" "github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3" "go.opentelemetry.io/otel/exporters/otlp/otlptrace" ) for TOOL in "${TOOLS[@]}"; do go get -u $TOOL go mod tidy done ``` --- Note: the Go directive is upgraded to v1.24 as `github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3` requires Go v1.24 ([ref](https://github.com/pulumi/pulumi/blob/5c96e4e6aa181bbc8385a12b38653d2dabd6eedf/sdk/go/pulumi-language-go/go.mod#L3)).	2025-04-21 11:26:37 -07:00
Ramon Quitales	f83b7a0a44	chore: update moby/buildkit to v0.20.1 (#519) ... **Description:** This PR updates the `moby/buildkit` dependency to `v0.20.1` in order to remain compatible with recent changes required by GitHub Actions (GHA) caching. During the upgrade, several upstream behavioral changes required forking and restoring legacy logic to maintain compatibility: - Introduced `containsGithubToken` to replicate logic that was previously in `buildflags.ParseCacheEntry`, which is now removed. This check ensures we return `nil` instead of a zero-value object. - Forked the previous implementation of `ParseExports`, as its upstream logic changed significantly. This ensures short-term compatibility for release before the GHA deprecation deadline. - A follow-up issue will be created to improve this forked logic and align more closely with upstream behavior. 🚨 **Fixes critical issue:** This change addresses a high-priority issue where GitHub Actions cache will stop working due to the upcoming deprecation of the legacy caching service (effective **April 15, 2025**). Recent build failures showed errors like: > *"This legacy service is shutting down, effective April 15, 2025. Migrate to the new service ASAP. For more information: https://gh.io/gha-cache-sunset"* Root cause was identified in #515, where using `buildx >= 0.21.0` is required. This repo was previously using `buildx 0.18.0`. Closes: #515	2025-04-11 13:42:47 -07:00
Eron Wright	780fe97f99	Use 'buildkit' as default scope (#516) ... This PR updates the schema to use the correct default value for `scope` in the GHA caching options. This should be effectively a no-op. From: https://docs.docker.com/build/cache/backends/gha/ <img width="892" alt="image" src="https://github.com/user-attachments/assets/690cde79-e30e-4085-81fd-1c9dc1c6d7e9" /> Closes #496	2025-04-09 14:01:21 -07:00
Ramon Quitales	2c4b4260dc	Fix weekly-pulumi-update (#491) ... Fixes: #485 This PR follows the `weekly-pulumi-update` CI workflow steps to update our `pulumi/pulumi` dependency, with manual intervention to resolve tooling update conflicts. Before generating the SDKs, it's necessary to update the language tools and otel packages to ensure compatibility with the latest changes. Additional command executed for the manual updates: ```sh TOOLS=( "github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3" "github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3" "github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3" "go.opentelemetry.io/otel/exporters/otlp/otlptrace" ) for TOOL in "${TOOLS[@]}"; do go get -u $TOOL go mod tidy	2025-03-18 10:15:07 -07:00
Pulumi Bot	8ff1017270	Automated upgrade: bump pulumi/pulumi to 3.153.1 (#472) ... Automated upgrade: bump pulumi/pulumi to 3.153.1	2025-03-03 16:49:18 +01:00
Ian Wahbe	dad72f7d65	Upgrade pulumi-go-provider to v0.24.1 (#413) ... Fixes #403	2025-01-15 09:29:23 -05:00
pulumi-renovate[bot]	15a31abdb5	Update dependency go to v1.23.4 (#378)	2024-12-23 09:32:35 -08:00
pulumi-renovate[bot]	d65bf93eb8	Update module github.com/pulumi/pulumi/sdk/v3 to v3.144.1 (#366) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/pulumi/pulumi/sdk/v3](https://redirect.github.com/pulumi/pulumi) | require | patch | `v3.144.0` -> `v3.144.1` | --- ### Release Notes <details> <summary>pulumi/pulumi (github.com/pulumi/pulumi/sdk/v3)</summary> ### [`v3.144.1`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.144.1) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.144.0...v3.144.1) ##### 3.144.1 (2024-12-20) ##### Bug Fixes - \[sdk/nodejs] Reverts [#&#8203;18041](https://redirect.github.com/pulumi/pulumi/issues/18041) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - "every weekday" (UTC). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xOS4wIiwidXBkYXRlZEluVmVyIjoiMzkuMTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiaW1wYWN0L25vLWNoYW5nZWxvZy1yZXF1aXJlZCJdfQ==--> Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>	2024-12-21 01:56:40 +00:00
pulumi-renovate[bot]	ba0b30e361	Update first-party Pulumi dependencies (#362) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi) | require | digest | `1dd3669` -> `d3d2892` | | [github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3](https://redirect.github.com/pulumi/pulumi) | require | patch | `v3.0.0-20241220164043-1dd366951f61` -> `v3.0.0-20241220180114-d3d28924c05a` | | [github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3](https://redirect.github.com/pulumi/pulumi) | require | patch | `v3.0.0-20241220164043-1dd366951f61` -> `v3.0.0-20241220180114-d3d28924c05a` | | [github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3](https://redirect.github.com/pulumi/pulumi) | require | patch | `v3.0.0-20241220164043-1dd366951f61` -> `v3.0.0-20241220180114-d3d28924c05a` | | [github.com/pulumi/pulumi/sdk/v3](https://redirect.github.com/pulumi/pulumi) | require | minor | `v3.143.1-0.20241220164043-1dd366951f61` -> `v3.144.0` | --- ### Release Notes <details> <summary>pulumi/pulumi (github.com/pulumi/pulumi/sdk/v3)</summary> ### [`v3.144.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.144.0) [Compare Source](https://redirect.github.com/pulumi/pulumi/compare/v3.143.0...v3.144.0) ##### 3.144.0 (2024-12-20) ##### Features - \[engine] Warn if `refresh` or `destroy` use older parameterized packages [#&#8203;18029](https://redirect.github.com/pulumi/pulumi/pull/18029) - \[sdk/dotnet] Update dotnet to 3.71.1 [#&#8203;18084](https://redirect.github.com/pulumi/pulumi/pull/18084) - \[auto/go] Add ConfigFile to GetConfig and SetConfig operations, add GetAllConfigWithOptions to extend GetAllConfig [#&#8203;17939](https://redirect.github.com/pulumi/pulumi/pull/17939) - \[cli/plugin] Log plugin unstructured output to debug instead of info [#&#8203;17943](https://redirect.github.com/pulumi/pulumi/pull/17943) - \[sdk/yaml] Update pulumi-yaml to 1.13.0 [#&#8203;18077](https://redirect.github.com/pulumi/pulumi/pull/18077) ##### Bug Fixes - \[backend/diy] Retry deletes of lock files if they fail [#&#8203;18059](https://redirect.github.com/pulumi/pulumi/pull/18059) - \[auto/go] Fix potential race condition when using automation API [#&#8203;18044](https://redirect.github.com/pulumi/pulumi/pull/18044) - \[auto/go] Fix "debug" flag in automation api [#&#8203;18071](https://redirect.github.com/pulumi/pulumi/pull/18071) - \[cli/install] Avoid unnecessary Node.js installations [#&#8203;18041](https://redirect.github.com/pulumi/pulumi/pull/18041) - \[engine] Use package load v2 in loader server so it can include paramaterization [#&#8203;18072](https://redirect.github.com/pulumi/pulumi/pull/18072) [#&#8203;18021](https://redirect.github.com/pulumi/pulumi/pull/18021) - \[programgen/dotnet] Emit local dependencies in restore sources deterministically [#&#8203;18026](https://redirect.github.com/pulumi/pulumi/pull/18026) - \[sdk/go] Ignore DependsOn for direct form invokes instead of raising an error [#&#8203;18089](https://redirect.github.com/pulumi/pulumi/pull/18089) - \[sdk/nodejs] Respect the noCheck option from tsconfig.json [#&#8203;18067](https://redirect.github.com/pulumi/pulumi/pull/18067) - \[sdk/nodejs] Gracefully handle errors that don't implement toString [#&#8203;18080](https://redirect.github.com/pulumi/pulumi/pull/18080) - \[sdk/python] Fix hang on error when using uv on Windows [#&#8203;18054](https://redirect.github.com/pulumi/pulumi/pull/18054) - \[sdkgen/dotnet] Compute restore sources from local dependencies and referenced packages [#&#8203;18042](https://redirect.github.com/pulumi/pulumi/pull/18042) ##### Miscellaneous - \[sdkgen/go] Skip TestPackageAddGoParameterized [#&#8203;18049](https://redirect.github.com/pulumi/pulumi/pull/18049) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - "every weekday" (UTC). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xOS4wIiwidXBkYXRlZEluVmVyIjoiMzkuMTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiaW1wYWN0L25vLWNoYW5nZWxvZy1yZXF1aXJlZCJdfQ==--> Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>	2024-12-20 19:56:48 +00:00
pulumi-renovate[bot]	9d00d64258	Update first-party Pulumi dependencies (#344)	2024-12-20 17:54:46 +00:00
Bryce Lampe	195fbfc784	Add support for multiple exporters (#235) ... Buildkit 0.13 introduced support for [multiple exporters](https://docs.docker.com/build/exporters/#multiple-exporters). We currently return an error in these situations. Instead, inspect the builder's version when loading the node and relax this error if we see it's running at least 0.13. Fixes https://github.com/pulumi/pulumi-docker-build/issues/21.	2024-12-10 09:05:36 -08:00
Bryce Lampe	0a045d12bf	regenerate sdk	2024-12-04 20:22:31 +00:00
pulumi-renovate[bot]	9f3d3db1dd	Pin dependencies	2024-12-04 20:22:31 +00:00
pulumi-renovate[bot]	2c2f8a68a3	fix(deps): update first-party pulumi dependencies	2024-11-25 17:21:25 -08:00
pulumi-renovate[bot]	0ce316d7de	fix(deps): update module github.com/docker/buildx to v0.18.0 (main) (#312)	2024-11-20 20:00:22 -08:00
Bryce Lampe	b66e4a56fd	regenerate sdk	2024-11-20 18:30:11 -08:00
pulumi-renovate[bot]	fb7912a889	fix(deps): update first-party pulumi dependencies	2024-11-20 18:30:11 -08:00
Renovate Bot	4c03012268	Update first-party Pulumi dependencies	2024-10-20 17:01:10 -07:00
Ramon Quitales	3d57abba75	upgrade: bump pulumi/pulumi to 3.136.1 (#284) ... This is the required commit to unblock CI: https://github.com/pulumi/pulumi-docker-build/pull/284/commits/bc7700a50c3e278a42258ec6710a2869ef3f01f1 Resolves: #272	2024-10-11 16:22:58 -07:00
Anton Tayanovskyy	9d3d0712f2	Fix: do not over-specify SDK dependencies (#271) ... Re: https://github.com/pulumi/ci-mgmt/issues/1091	2024-10-02 14:03:54 -04:00
Pulumi Bot	242d99d4d6	Automated upgrade: bump pulumi/pulumi to 3.134.1 (#266) ... Automated upgrade: bump pulumi/pulumi to 3.134.1	2024-09-26 10:45:31 -07:00
Pulumi Bot	8151f0369f	Automated upgrade: bump pulumi/pulumi to 3.131.0 (#244) ... Automated upgrade: bump pulumi/pulumi to 3.131.0 --------- Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-09-10 09:26:19 -07:00
Ramon Quitales	06cf6ec5f8	Fix weekly-pulumi-update (#232) ... Fixes: #212 This PR follows the `weekly-pulumi-update` CI workflow steps to update our `pulumi/pulumi` dependency, with manual intervention to resolve tooling update conflicts. Before generating the SDKs, it's necessary to update the language tools and otel packages to ensure compatibility with the latest changes. Additional command executed for the manual updates: ```sh TOOLS=( "github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3" "github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3" "github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3" "go.opentelemetry.io/otel/exporters/otlp/otlptrace" ) for TOOL in "${TOOLS[@]}"; do go get -u $TOOL go mod tidy done ```	2024-08-26 09:57:49 -07:00
Bryce Lampe	81a7aa4ec4	No-op during Read if credentials are invalid (#194) ... The `Image` resource already ignores errors during read but the `Index` resource was requiring the inspect call to always succeed. This will often fail due to https://github.com/pulumi/pulumi/issues/4981 (note however in this case credentials are stored with the resource instead of the provider). This changes our logic to instead emit a warning if the credentials are invalid. Fixes https://github.com/pulumi/pulumi-docker-build/issues/121.	2024-08-13 12:54:14 -07:00
dependabot[bot]	3d127da671	Bump the security group with 2 updates (#170) ... --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-08-08 23:46:33 +00:00
Pulumi Bot	5cc3415b34	Automated Pulumi/Pulumi upgrade (#175) ... Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-08-08 16:05:09 -07:00
dependabot[bot]	724836b5ef	Bump the other group across 1 directory with 13 updates (#152) ... --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-07-12 16:40:59 -07:00
Pulumi Bot	cc8725ef27	Automated Pulumi/Pulumi upgrade (#135) ... Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-07-11 09:17:55 -07:00
dependabot[bot]	b8ecfb287a	Bump the pulumi group across 1 directory with 6 updates (#111) ... This upgrades pulumi to v3.121.0 and bumps several other first-party dependencies. Note that vendored language plugins must be bumped manually because their go modules are currently untagged: * go get github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3@79e814fe0f2137ade87ee5af384e6cb71e4aa6ff * go get github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3@79e814fe0f2137ade87ee5af384e6cb71e4aa6ff * go get github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3@79e814fe0f2137ade87ee5af384e6cb71e4aa6ff * go get github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet@fa777213effdc3a80bb893194d63cd8b7ca7a868 * go get github.com/pulumi/pulumi-yaml@15eb402 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-06-25 14:17:24 -07:00
Bryce Lampe	4e8cf8f4ba	Fix a panic that could occur when context was omitted (#83) ... I could have sworn the context property was required, but evidently it isn't and we weren't handling the case when it was missing. This PR updates things to set a default location of the current directory if the context is absent. Some unit tests are also added. Fixes #78.	2024-05-31 14:41:22 +00:00
Pulumi Bot	effb497234	Automated Pulumi/Pulumi upgrade (#90)	2024-05-31 01:57:12 -07:00
Bryce Lampe	9a1706a203	Fix publisher capitalization (#89) ... Refs https://github.com/pulumi/pulumi-dbtcloud/pull/23.	2024-05-31 01:56:19 -07:00
Daniel Bradley	c305ea88c4	Embed sdk versions (#68) ... Part of https://github.com/pulumi/ci-mgmt/issues/915 Install pulumi in standard way Use the same method as other providers to install the pulumi CLI. - Lock the version of the CLI and therefore codegen for consistent build results. - Ensure the local language plugins are using by disabling ambient plugins. Enable respect schema version Remove setting version at SDK build time --------- Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-05-30 13:50:54 +01:00
Bryce Lampe	f0aaf7095d	Fix GitHub action URL (#80) ... Our docs and default value for the GitHub action cache URL were referring to the [wrong](https://github.com/tonistiigi/go-actions-cache/blob/master/api.md) environment variable. I was under the impression that the underlying library ends up checking for the correct variable later so this would be only cosmetic, but a user [confirmed](https://github.com/pulumi/pulumi-docker-build/issues/77#issuecomment-2135621983) this does appear to break things. I brought over an old test I had written while this was still in the pulumi-docker repo, but unfortunately it doesn't currently test GHA due to ci-mgmt limitations https://github.com/pulumi/pulumi-docker-build/issues/82. Fixes https://github.com/pulumi/pulumi-docker-build/issues/77.	2024-05-29 12:29:58 +00:00
Bryce Lampe	ff71c251e1	Upgrade go-provider (#53) ... This upgrades pulumi-go-provider to latest. Code was automatically migrated using a slightly modified patch described [here](https://github.com/pulumi/pulumi-go-provider/pull/227#issuecomment-2073962385). --------- Co-authored-by: Ian Wahbe <ian@wahbe.com>	2024-05-13 12:23:24 -07:00
Pulumi Bot	d3e22d5679	Automated Pulumi/Pulumi upgrade (#49) ... Co-authored-by: Bryce Lampe <bryce@pulumi.com>	2024-04-26 09:06:05 -07:00
Bryce Lampe	26c144c916	Initial provider implementation (#18) ... This brings over the initial buildx prototype from pulumi/pulumi-docker and fixes various build and release issues.	2024-04-25 11:03:59 -07:00
Bryce Lampe	2b348f84e4	Housekeeping (#8) ... * Rename the provider to dockerbuild. * Add Makefile targets required by CI. * Add per-language test targets compatible with CI. * Fix broken example yaml. * Add gitignore exclusions to fix SDK generation in CI. * Fix lint errors. * Vendor pulumi CLI via `tools.go` instead of `.pulumi`. * Consolidate `go.mod`s into one file, with a minimal `go.mod` for the Go SDK. * Add codecov.	2024-03-20 11:09:37 -07:00
Bryce Lampe	d8688f5e1a	Regenerate examples	2024-03-07 16:15:49 -08:00
Bryce Lampe	3427e6115f	More renames	2024-03-07 13:51:35 -08:00
Bryce Lampe	10f6ae35a6	Rename xyz -> docker-native	2024-03-07 12:53:12 -08:00
Bryce Lampe	0d9ce7c53c	Initial commit	2024-03-07 11:17:15 -08:00