## Summary
- Bumps production image tag from `1.5.0` to `1.6.0` in
`deploy/Pulumi.gcpProd.yaml`
- Corresponds to the [v1.6.0
release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.6.0)
## Test plan
- [ ] Verify Pulumi preview shows only the image tag change
- [ ] Deploy and confirm the service is healthy
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We keep bumping `go 1.26.x` across the repo every time a new Go patch
drops
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only —
"this module needs Go 1.26")
- **All CI workflows**: `go-version-file: 'go.mod'` → `go-version:
'stable'` — CI always uses the latest stable Go, no more
bump PRs
- **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` →
`go-version-input: 'stable'`
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
- Updates the production image tag in `deploy/Pulumi.gcpProd.yaml` from
`1.4.1` to `1.5.0`
## Test plan
- [ ] Verify the Pulumi deployment picks up the new image tag
- [ ] Confirm the v1.5.0 container image exists in the registry
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bumps
[github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes)
from 4.25.0 to 4.27.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.27.0</h2>
<p>No release notes provided.</p>
<h2>v4.26.0</h2>
<h3>Fixed</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4122">#4122</a>
Implements a new provider config option, <code>alwaysRender</code>,
which sets <code>Diff_Some</code>to true when used in combination with
<code>renderYAMLtoDirectory</code>.
This allows for user-defined opt-in behavior for YAML manifests to be
idempotently generated on every <code>pulumi up</code>, and for Update()
to show these changes to a user.</p>
</li>
<li>
<p>Fixed a race condition in StatefulSet await logic where Pulumi could
incorrectly report a rollout as complete before the controller had
processed the update. This occurred when Pulumi checked status fields
before the controller updated <code>observedGeneration</code>, causing
stale "ready" values to be trusted.</p>
</li>
<li>
<p>Fixed a regression of <a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/2943">#2943</a>
which could cause Deployments to erroneously report diffs.</p>
</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgraded <code>helm.sh/helm</code> to v3.18.6. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3969">pulumi/pulumi-kubernetes#3969</a>)</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4156">#4156</a>
Upgrade Kubernetes schema and libraries to v1.35.1</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's
changelog</a>.</em></p>
<blockquote>
<h2>4.27.0 (March 2, 2026)</h2>
<h3>Fixed</h3>
<ul>
<li><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4181">#4181</a>
Fix PVC timeout when updating to a storage class with
WaitForFirstConsumer bind mode.</li>
</ul>
<h3>Added</h3>
<ul>
<li><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3661">#3661</a>
Support for OCI login inside the provider process. Providing a
username/password to <code>Chart v4</code> and <code>Release v3</code>
will now login to private OCI
registries as expected.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/2911">pulumi/pulumi-kubernetes#2911</a>
and <a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/1914">pulumi/pulumi-kubernetes#1914</a>)</li>
</ul>
<h2>4.26.0 (February 19, 2026)</h2>
<h3>Fixed</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4122">#4122</a>
Implements a new provider config option, <code>alwaysRender</code>,
which sets <code>Diff_Some</code>to true when used in combination with
<code>renderYAMLtoDirectory</code>.
This allows for user-defined opt-in behavior for YAML manifests to be
idempotently generated on every <code>pulumi up</code>, and for Update()
to show these changes to a user.</p>
</li>
<li>
<p>Fixed a race condition in StatefulSet await logic where Pulumi could
incorrectly report a rollout as complete before the controller had
processed
the update. This occurred when Pulumi checked status fields before the
controller updated <code>observedGeneration</code>, causing stale
"ready" values to be
trusted.</p>
</li>
<li>
<p>Fixed a regression of
<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/2943">#2943</a>
which could
cause Deployments to erroneously report diffs.</p>
</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgraded <code>helm.sh/helm</code> to v3.18.6. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3969">pulumi/pulumi-kubernetes#3969</a>)</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4156">#4156</a>
Upgrade Kubernetes schema and libraries to v1.35.1</p>
</li>
</ul>
<h2>4.24.0 (November 5, 2025)</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="20f0c07152"><code>20f0c07</code></a>
Prepare for v4.27.0 release (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4194">#4194</a>)</li>
<li><a
href="c5e7ece7b1"><code>c5e7ece</code></a>
Update module github.com/pulumi/pulumi/pkg/v3 to v3.224.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4191">#4191</a>)</li>
<li><a
href="49c2646952"><code>49c2646</code></a>
helm: login to private registries (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3661">#3661</a>)</li>
<li><a
href="b48d7a39a8"><code>b48d7a3</code></a>
Fix PVC timeout on Update (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4181">#4181</a>)</li>
<li><a
href="e3427da684"><code>e3427da</code></a>
Automated upgrade: bump pulumi/pulumi to 3.223.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4188">#4188</a>)</li>
<li><a
href="7af1b7e73b"><code>7af1b7e</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.224.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4189">#4189</a>)</li>
<li><a
href="6860aae22d"><code>6860aae</code></a>
Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4187">#4187</a>)</li>
<li><a
href="5c58fea181"><code>5c58fea</code></a>
Update GitHub Actions workflows. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4186">#4186</a>)</li>
<li><a
href="1564fc1c46"><code>1564fc1</code></a>
Update module github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3
to v3...</li>
<li><a
href="9ebe2663c3"><code>9ebe266</code></a>
Update dependency <code>@pulumi/gcp</code> to v9.13.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4184">#4184</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.25.0...v4.27.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.219.0 to 3.220.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.220.0</h2>
<h2>3.220.0 (2026-02-10)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Show environment variables that were set if a snapshot
integrity error happens
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21709">#21709</a></p>
</li>
<li>
<p>[cli/{install,package}] Use the Pulumi Cloud Registry by default to
resolve package names</p>
</li>
<li>
<p>[engine] Pass replacement trigger through to Construct
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21408">#21408</a></p>
</li>
<li>
<p>[engine] Add EnvVarMappings resource option for provider resources,
allowing environment variables to be remapped before being passed to the
provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21572">#21572</a></p>
</li>
<li>
<p>[pkg] BREAKING: Deprecate
github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of
github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This
package will be removed from pulumi/pulumi soon!
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21720">#21720</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Retry <code>yarn install</code> when it fails (e.g. during
<code>pulumi install</code>)
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21707">#21707</a></p>
</li>
<li>
<p>[engine] Deal with errors in elided journal entries correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21576">#21576</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix remote components with
PULUMI_NODEJS_SKIP_COMPONENT_INPUTS</p>
</li>
<li>
<p>[sdk/python] Fix <code>_LazyModule</code> to not trigger full module
load for introspection attributes
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21620">#21620</a></p>
</li>
<li>
<p>[sdkgen/python] Remove workaround for slow typechecking with MyPy and
PyCharm
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21722">#21722</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli] Write logfile location if verbosity is >= 1 to stderr
instead of stdout
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21663">#21663</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.220.0 (2026-02-10)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Show environment variables that were set if a snapshot
integrity error happens
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21709">#21709</a></p>
</li>
<li>
<p>[cli/{install,package}] Use the Pulumi Cloud Registry by default to
resolve package names</p>
</li>
<li>
<p>[engine] Pass replacement trigger through to Construct
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21408">#21408</a></p>
</li>
<li>
<p>[engine] Add EnvVarMappings resource option for provider resources,
allowing environment variables to be remapped before being passed to the
provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21572">#21572</a></p>
</li>
<li>
<p>[pkg] BREAKING: Deprecate
github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of
github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This
package will be removed from pulumi/pulumi soon!
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21720">#21720</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Retry <code>yarn install</code> when it fails (e.g. during
<code>pulumi install</code>)
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21707">#21707</a></p>
</li>
<li>
<p>[engine] Deal with errors in elided journal entries correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21576">#21576</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix remote components with
PULUMI_NODEJS_SKIP_COMPONENT_INPUTS</p>
</li>
<li>
<p>[sdk/python] Fix <code>_LazyModule</code> to not trigger full module
load for introspection attributes
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21620">#21620</a></p>
</li>
<li>
<p>[sdkgen/python] Remove workaround for slow typechecking with MyPy and
PyCharm
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21722">#21722</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli] Write logfile location if verbosity is >= 1 to stderr
instead of stdout
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21663">#21663</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e8ecd95a5e"><code>e8ecd95</code></a>
Fix remote components with PULUMI_NODEJS_SKIP_COMPONENT_INPUTS (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21727">#21727</a>)</li>
<li><a
href="4c2cc2a729"><code>4c2cc2a</code></a>
upgrade pulumi-dotnet and pulumi-yaml to latest (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21764">#21764</a>)</li>
<li><a
href="8dc466ce6e"><code>8dc466c</code></a>
Always install from registry when appropriate (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21649">#21649</a>)</li>
<li><a
href="2ce415c413"><code>2ce415c</code></a>
Relax the Copyright banner linter (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21732">#21732</a>)</li>
<li><a
href="5d49339b03"><code>5d49339</code></a>
Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21758">#21758</a>)</li>
<li><a
href="dbcad3b0ba"><code>dbcad3b</code></a>
Remap environment variables as a resource option on Provider (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21572">#21572</a>)</li>
<li><a
href="f5dc5a3fff"><code>f5dc5a3</code></a>
print and save environment variables on snapshot integrity errors (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21709">#21709</a>)</li>
<li><a
href="82d584e2d4"><code>82d584e</code></a>
Fix proto build: Update Node.js installation to use modern keyring (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21729">#21729</a>)</li>
<li><a
href="f8aaed4083"><code>f8aaed4</code></a>
Deprecate <code>github.com/pulumi/pulumi/pkg/v3/codegen/dotnet</code>
& remove tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/2">#2</a>...</li>
<li><a
href="3392d063db"><code>3392d06</code></a>
Remove workaround for slow typechecking with MyPy and PyCharm (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21722">#21722</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR bumps prod to v1.4.1
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.217.1 to 3.218.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.218.0</h2>
<h2>3.218.0 (2026-01-29)</h2>
<h3>Features</h3>
<ul>
<li>[sdk/nodejs] Add support for the <code>OnError</code> resource
hook</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Allow positional arguments to be passed to <code>convert</code>
again</p>
</li>
<li>
<p>[cli/install] Correctly include git forge organizations as schema
namespaces when generating SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21579">#21579</a></p>
</li>
<li>
<p>[cli/{install,package}] Correctly grab package names for Python &
NodeJS
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21577">#21577</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.218.0 (2026-01-29)</h2>
<h3>Features</h3>
<ul>
<li>[sdk/nodejs] Add support for the <code>OnError</code> resource
hook</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Allow positional arguments to be passed to <code>convert</code>
again</p>
</li>
<li>
<p>[cli/install] Correctly include git forge organizations as schema
namespaces when generating SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21579">#21579</a></p>
</li>
<li>
<p>[cli/{install,package}] Correctly grab package names for Python &
NodeJS
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21577">#21577</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="da9b84347b"><code>da9b843</code></a>
Unrestrict arguments to <code>convert</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21603">#21603</a>)</li>
<li><a
href="d94b6a69e2"><code>d94b6a6</code></a>
OnError support for NodeJS SDK (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21568">#21568</a>)</li>
<li><a
href="6ae181792f"><code>6ae1817</code></a>
expand exclusion rule for RefreshV2 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21591">#21591</a>)</li>
<li><a
href="e885bf3653"><code>e885bf3</code></a>
fuzzing: print full test case to stdout in CI (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21601">#21601</a>)</li>
<li><a
href="059066063e"><code>0590660</code></a>
Argument specifications for state commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21590">#21590</a>)</li>
<li><a
href="d186b46c6f"><code>d186b46</code></a>
Check the interaction between <code>replaceWith</code> and
<code>deletedWith</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21584">#21584</a>)</li>
<li><a
href="9074f6b351"><code>9074f6b</code></a>
Argument specifications for Pulumi CLI stack commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21589">#21589</a>)</li>
<li><a
href="16ad3edd5a"><code>16ad3ed</code></a>
Bump language runtimes for dotnet, java, and yaml (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21597">#21597</a>)</li>
<li><a
href="5b2e34bcd4"><code>5b2e34b</code></a>
Argument specifications for Pulumi Cloud commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21587">#21587</a>)</li>
<li><a
href="aed72b3e76"><code>aed72b3</code></a>
Argument specifications for Pulumi deployment commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21588">#21588</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.217.1...v3.218.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.214.0 to 3.215.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.215.0</h2>
<h2>3.215.0 (2026-01-07)</h2>
<h3>Features</h3>
<ul>
<li>[cli/plugin] Allow plugins to specify a supported version range for
the CLI
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21335">#21335</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Filter internal properties like __defaults from diff display
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21359">#21359</a></p>
</li>
<li>
<p>[cli/config] Make <code>config set --type bool</code> accept
different spellings of boolean values instead of only lowercase
"true"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21314">#21314</a></p>
</li>
<li>
<p>[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21373">#21373</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[cli] Update pulumi-dotnet to 3.96.1</p>
</li>
<li>
<p>[cli/package] Remove superfluous version string
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21351">#21351</a></p>
</li>
</ul>
<h2>v3.214.1</h2>
<h2>3.214.1 (2026-01-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/package] Preserve existing behavior when <code>pulumi package
add</code> is used with a local provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21350">#21350</a></p>
</li>
<li>
<p>[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21325">#21325</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.215.0 (2026-01-07)</h2>
<h3>Features</h3>
<ul>
<li>[cli/plugin] Allow plugins to specify a supported version range for
the CLI
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21335">#21335</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Filter internal properties like __defaults from diff display
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21359">#21359</a></p>
</li>
<li>
<p>[cli/config] Make <code>config set --type bool</code> accept
different spellings of boolean values instead of only lowercase
"true"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21314">#21314</a></p>
</li>
<li>
<p>[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21373">#21373</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[cli] Update pulumi-dotnet to 3.96.1</p>
</li>
<li>
<p>[cli/package] Remove superfluous version string
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21351">#21351</a></p>
</li>
</ul>
<h2>3.214.1 (2026-01-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/package] Preserve existing behavior when <code>pulumi package
add</code> is used with a local provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21350">#21350</a></p>
</li>
<li>
<p>[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21325">#21325</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2ff3425c8f"><code>2ff3425</code></a>
Update pulumi-dotnet to 3.96.1 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21382">#21382</a>)</li>
<li><a
href="628bf0b636"><code>628bf0b</code></a>
fuzzing: expand targeted dependency rule (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21380">#21380</a>)</li>
<li><a
href="2f90313e05"><code>2f90313</code></a>
fix: Insert <code>--stack</code> before <code>--</code> separator in
<code>_run_pulumi_cmd_sync</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21373">#21373</a>)</li>
<li><a
href="137b72ba9f"><code>137b72b</code></a>
Use unittest.IsolatedAsyncioTestCase (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21376">#21376</a>)</li>
<li><a
href="6d92edd52e"><code>6d92edd</code></a>
Allow plugins to set supported CLI versions (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21335">#21335</a>)</li>
<li><a
href="3d12eb1182"><code>3d12eb1</code></a>
Always use <code>packageresolution.Resolve</code> for resource plugin
downloads (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21317">#21317</a>)</li>
<li><a
href="54b8cd9884"><code>54b8cd9</code></a>
Filter internal properties from diff display (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21359">#21359</a>)</li>
<li><a
href="0d3bb719fe"><code>0d3bb71</code></a>
Fix python test coverage (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21365">#21365</a>)</li>
<li><a
href="64c53a5bc1"><code>64c53a5</code></a>
show DestroyV2 failures when parent of provider is updated (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20758">#20758</a>)</li>
<li><a
href="30cfc54973"><code>30cfc54</code></a>
Update dependency urllib3 to v2.6.2 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21360">#21360</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.214.0...v3.215.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.212.0 to 3.213.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.213.0</h2>
<h2>3.213.0 (2025-12-17)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[sdkgen/go] Generate three-level nested builtin output types for Go
SDK
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21248">#21248</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[pkg] Move plugin downloading from pkg into sdk
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21220">#21220</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b5f037ab6d"><code>b5f037a</code></a>
Bump SDK versions for 3.213.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21269">#21269</a>)</li>
<li><a
href="e317952bf1"><code>e317952</code></a>
add infrastructure to exclude known issues from fuzzing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21267">#21267</a>)</li>
<li><a
href="312929faea"><code>312929f</code></a>
Do not assert that the pulumi/templates repo contains aws-javascript (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21280">#21280</a>)</li>
<li><a
href="777230ba86"><code>777230b</code></a>
add fuzzing failures to gitignore (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21264">#21264</a>)</li>
<li><a
href="fe2c4cb31d"><code>fe2c4cb</code></a>
catch panics in the engine, and turn them into errors for fuzzing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20955">#20955</a>)</li>
<li><a
href="de5e586f87"><code>de5e586</code></a>
python auto api tests: fix flakes because of existing stacks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21265">#21265</a>)</li>
<li><a
href="6d4aa06fc3"><code>6d4aa06</code></a>
Add doc for sdk/go/pulumi-internal/ (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21263">#21263</a>)</li>
<li><a
href="a3350dac5f"><code>a3350da</code></a>
Add a backporting of type-alias of <code>workspace.PluginSpec</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21262">#21262</a>)</li>
<li><a
href="27f635e1dd"><code>27f635e</code></a>
Remove sdk/go/pulumi/internals/empty.s (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21261">#21261</a>)</li>
<li><a
href="29b4e67ea3"><code>29b4e67</code></a>
Expand <code>PackageSpec</code> allow representing a full
<code>PluginDescriptor</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21254">#21254</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.212.0...v3.213.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR ensures we don't have downtime when we are doing
rollouts during deployment/promotions.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR promotes the version of the registry in prod to 1.4.0
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Seems that per ingress annotations were not working, so had to put them
in the ingress configmap. Did tested this manually on staging so it's
confirmed it's working (I was getting 429s instead of 503s) and no
traffic was getting into the registry pod.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
A few changes related to configuring the rate limiting:
* Set `externalTrafficPolicy: Local` to preserve real client IPs
(otherwise we only see the cluster IPs)
* Disable `use-forwarded-headers` (L4 LB doesn't set `X-Forwarded-For`,
prevents spoofing)
* Scale NGINX to 2 replicas in prod (costs nothing, gives us
zero-downtime deploys to prod)
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following is an alternative solution to #833
Goal is to deploy and promote it to prod, then monitor the alerts for a
week to see its effect and reassess. In case it's actual traffic that
we've started blocking we can also up the replicas. I thought it doesn't
make sense to up them now since it would be nice to isolate the result
of this change first.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.208.0 to 3.210.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.210.0</h2>
<h2>3.210.0 (2025-12-03)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/about] Print python toolchain information in <code>pulumi
about</code></p>
</li>
<li>
<p>[sdk/java] Update java to v1.18</p>
</li>
<li>
<p>[components/nodejs] Local components will use the version from
package.json rather than 0.0.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21100">#21100</a></p>
</li>
<li>
<p>[cli/package] Add <code>pulumi package delete</code> command to
delete package versions from the Pulumi Registry
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21069">#21069</a></p>
</li>
<li>
<p>[cli/package] Always print the schema first in <code>package
get-schema</code>, then print any binding errors
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21080">#21080</a></p>
</li>
<li>
<p>[sdk/python] Require <code>grpcio>=1.75.1</code> on Python 3.14
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21113">#21113</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdk/nodejs] Fix ComponentResources transfering input arguments to
output properties automatically
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21094">#21094</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Remove <code>@types/uuid</code> type declarations dev
dependency
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21077">#21077</a></li>
</ul>
<h2>v3.209.0</h2>
<h2>3.209.0 (2025-11-26)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run <code>pulumi login --help</code> for more information.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20974">#20974</a></p>
</li>
<li>
<p>[sdk/python] Allow older grpcio and protobuf dependencies
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21007">#21007</a></p>
</li>
<li>
<p>[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21034">#21034</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>3.209.0 (2025-11-26)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run <code>pulumi login --help</code> for more information.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20974">#20974</a></p>
</li>
<li>
<p>[sdk/python] Allow older grpcio and protobuf dependencies
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21007">#21007</a></p>
</li>
<li>
<p>[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21034">#21034</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/install] Correctly install non-standard plugins. See <a
href="https://redirect.github.com/pulumi/pulumi/issues/20953">pulumi/pulumi#20953</a>
for more information
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20983">#20983</a></p>
</li>
<li>
<p>[cli/new] Create pyproject.toml for uv and poetry projects when using
--generate-only
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20979">#20979</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix serialization errors due to SxS copies of the SDK
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21029">#21029</a></p>
</li>
<li>
<p>[sdk/python] Add <code>PropertyValue</code> runtime validation checks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21058">#21058</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[engine] Don't send root directory and runtime options to language
plugins as command line arguments
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21054">#21054</a></p>
</li>
<li>
<p>[sdk/{dotnet,java,yaml}] Bump language runtimes for yaml, dotnet and
java</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="43bb5ff53c"><code>43bb5ff</code></a>
Print python toolchain information in <code>pulumi about</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21122">#21122</a>)</li>
<li><a
href="bbe721d42f"><code>bbe721d</code></a>
Update java to v1.18.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21121">#21121</a>)</li>
<li><a
href="f770d66d60"><code>f770d66</code></a>
journaler: unlock the lock if the journaler is already closed (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21117">#21117</a>)</li>
<li><a
href="9217663c03"><code>9217663</code></a>
Add pulumi package delete command (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21069">#21069</a>)</li>
<li><a
href="749c6722ba"><code>749c672</code></a>
fix: use independent <code>http.Client</code> in pair with
<code>http.Server</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20942">#20942</a>)</li>
<li><a
href="43bd0a8687"><code>43bd0a8</code></a>
enable journaling in testing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20990">#20990</a>)</li>
<li><a
href="c0c4dfe970"><code>c0c4dfe</code></a>
Replace deprecated is-finite dependency in test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21108">#21108</a>)</li>
<li><a
href="220cccd368"><code>220cccd</code></a>
Require <code>grpcio>=1.75.1</code> on Python 3.14 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21113">#21113</a>)</li>
<li><a
href="d6277b37b3"><code>d6277b3</code></a>
[journal] Add comments, support multiple Close() (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21112">#21112</a>)</li>
<li><a
href="df6ef98165"><code>df6ef98</code></a>
Remove construct_component_configure_provider binary (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21110">#21110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.208.0...v3.210.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Prepared by Claude Code, reviewd by me.
## Summary
- Upgrade Go from 1.24.9 to 1.24.11 in the main `go.mod` to fix
govulncheck CI failure
- Upgrade Go from 1.24.7 to 1.24.11 in `deploy/go.mod` for the same
vulnerability fix
## Details
This PR addresses the failing `govulncheck` check in CI caused by
vulnerability **GO-2025-4155**:
- **Vulnerability**: Excessive resource consumption when printing error
string for host certificate validation in `crypto/x509`
- **Found in**: `crypto/x509@go1.24.9` (and earlier versions like
go1.24.7)
- **Fixed in**: `crypto/x509@go1.24.11`
- **More info**: https://pkg.go.dev/vuln/GO-2025-4155
Both Go module files in the repository are updated to 1.24.11 to ensure
consistent vulnerability remediation.
## Test plan
- [x] CI passes govulncheck after the Go version upgrade
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Bumps the go_modules group with 1 update in the /deploy directory:
[golang.org/x/crypto](https://github.com/golang/crypto).
Updates `golang.org/x/crypto` from 0.41.0 to 0.45.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e0068c009"><code>4e0068c</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="e79546e28b"><code>e79546e</code></a>
ssh: curb GSSAPI DoS risk by limiting number of specified OIDs</li>
<li><a
href="f91f7a7c31"><code>f91f7a7</code></a>
ssh/agent: prevent panic on malformed constraint</li>
<li><a
href="2df4153a03"><code>2df4153</code></a>
acme/autocert: let automatic renewal work with short lifetime certs</li>
<li><a
href="bcf6a849ef"><code>bcf6a84</code></a>
acme: pass context to request</li>
<li><a
href="b4f2b62076"><code>b4f2b62</code></a>
ssh: fix error message on unsupported cipher</li>
<li><a
href="79ec3a51fc"><code>79ec3a5</code></a>
ssh: allow to bind to a hostname in remote forwarding</li>
<li><a
href="122a78f140"><code>122a78f</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="c0531f9c34"><code>c0531f9</code></a>
all: eliminate vet diagnostics</li>
<li><a
href="0997000b45"><code>0997000</code></a>
all: fix some comments</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.41.0...v0.45.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR promotes prod to 1.3.10
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.206.0 to 3.207.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.207.0</h2>
<h2>3.207.0 (2025-11-12)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20817">#20817</a></p>
</li>
<li>
<p>[engine] Add <code>ReplaceWith</code> resource option to allow one
resource's replace operations to trigger another's
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20693">#20693</a></p>
</li>
<li>
<p>[sdkgen/python] Allow all PEP440 version specifiers to be used</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/import] Return errors when an import fails
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20904">#20904</a></p>
</li>
<li>
<p>[engine] Fix parenting of resources in some cases in <code>refresh
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20894">#20894</a></p>
</li>
<li>
<p>[engine] Fix StackReference secrets performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20908">#20908</a></p>
</li>
<li>
<p>[programgen] Do not panic when re-writing type-invalid PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20770">#20770</a></p>
</li>
<li>
<p>[sdk/go] Fix import path in instructions when linking a package in Go
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20888">#20888</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20913">#20913</a></p>
</li>
<li>
<p>[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests</p>
</li>
<li>
<p>[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20917">#20917</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[engine] Stop sending ConfigPropertyMap as part of RunRequest
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20887">#20887</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.207.0 (2025-11-12)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20817">#20817</a></p>
</li>
<li>
<p>[engine] Add <code>ReplaceWith</code> resource option to allow one
resource's replace operations to trigger another's
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20693">#20693</a></p>
</li>
<li>
<p>[sdkgen/python] Allow all PEP440 version specifiers to be used</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/import] Return errors when an import fails
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20904">#20904</a></p>
</li>
<li>
<p>[engine] Fix parenting of resources in some cases in <code>refresh
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20894">#20894</a></p>
</li>
<li>
<p>[engine] Fix StackReference secrets performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20908">#20908</a></p>
</li>
<li>
<p>[programgen] Do not panic when re-writing type-invalid PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20770">#20770</a></p>
</li>
<li>
<p>[sdk/go] Fix import path in instructions when linking a package in Go
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20888">#20888</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20913">#20913</a></p>
</li>
<li>
<p>[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests</p>
</li>
<li>
<p>[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20917">#20917</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[engine] Stop sending ConfigPropertyMap as part of RunRequest
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20887">#20887</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5e3a50056a"><code>5e3a500</code></a>
upgrade language providers to latest versions (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20918">#20918</a>)</li>
<li><a
href="ff9df44da3"><code>ff9df44</code></a>
Avoid cancellations due to do slow processing of requests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20920">#20920</a>)</li>
<li><a
href="a332525939"><code>a332525</code></a>
schema: allow any pep440 constraint for specifying pulumi version in
python (...</li>
<li><a
href="ff1b5f6ddb"><code>ff1b5f6</code></a>
Disambiguate registry and non-registry templates in <code>pulumi
new</code> select (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20701">#20701</a>)</li>
<li><a
href="5137a3fc9f"><code>5137a3f</code></a>
import: actually return errors if we have them (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20904">#20904</a>)</li>
<li><a
href="b4002be0fe"><code>b4002be</code></a>
Avoid cancellations due to do slow processing of requests in the
callbacks se...</li>
<li><a
href="9c779ed24f"><code>9c779ed</code></a>
Fix StackReference secrets performance (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20908">#20908</a>)</li>
<li><a
href="4fedb1c1de"><code>4fedb1c</code></a>
Fix closure serialization on Node.js v25.2.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20913">#20913</a>)</li>
<li><a
href="32235a17d2"><code>32235a1</code></a>
Add <code>ReplaceWith</code> resource option (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20693">#20693</a>)</li>
<li><a
href="4201af6122"><code>4201af6</code></a>
Log deleteProvider calls (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20906">#20906</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.206.0...v3.207.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes)
from 4.23.0 to 4.24.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.24.0</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>
<p>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</p>
<p><code>pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' ||
@ == 'Succeeded' ]}"</code></p>
</li>
<li>
<p>To wait for for an object to have a "Failed" <em>or</em>
"Complete" condition with
a "True" value:</p>
<p><code>pulumi.com/waitFor:
"jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True</code></p>
</li>
</ul>
<p>(Tools like <a href="https://jsonpath.com">jsonpath.com</a> are very
helpful for
ensuring your JSONPath expression works as expected.)</p>
<p>Importantly, please note that <code>kubectl wait
--for=jsonpath=...</code> supports only
a <em>subset</em> of RFC9535. This means some complex
<code>waitFor</code> annotations will not
be reproducible with <code>kubectl</code>.</p>
<p>Existing expressions should continue to work normally with one
notable
exception: a selector like <code>.items[]</code> now requires an
explicit wildcard, i.e.
<code>.items[*]</code>.</p>
<p>As a reminder, the <code>pulumi.com/waitFor</code> annotation is
experimental and
subject to change. Similarly, RFC9535 is still only <em>proposed</em>
and may also
change in the future.</p>
</li>
<li>
<p><code>enableConfigMapMutable</code> and
<code>enableSecretMutable</code> are now stable.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3886">pulumi/pulumi-kubernetes#3886</a>)</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>
<p>Helm resources all now use the correct
<code>registry/config.json</code> file for
credentials. For backward-compatibility <code>registry.json</code> is
preferred if
it exists. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3606">pulumi/pulumi-kubernetes#3606</a>)</p>
</li>
<li>
<p>Fixed an issue where deletions could take longer than necessary. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3317">pulumi/pulumi-kubernetes#3317</a>)</p>
</li>
<li>
<p>Significantly reduced memory usage. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3713">pulumi/pulumi-kubernetes#3713</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's
changelog</a>.</em></p>
<blockquote>
<!-- raw HTML omitted -->
<h1>CHANGELOG</h1>
<h2>Unreleased</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>
<p>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</p>
<p><code>pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' ||
@ == 'Succeeded' ]}"</code></p>
</li>
<li>
<p>To wait for for an object to have a "Failed" <em>or</em>
"Complete" condition with
a "True" value:</p>
<p><code>pulumi.com/waitFor:
"jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True</code></p>
</li>
</ul>
<p>(Tools like <a href="https://jsonpath.com">jsonpath.com</a> are very
helpful for
ensuring your JSONPath expression works as expected.)</p>
<p>Importantly, please note that <code>kubectl wait
--for=jsonpath=...</code> supports only
a <em>subset</em> of RFC9535. This means some complex
<code>waitFor</code> annotations will not
be reproducible with <code>kubectl</code>.</p>
<p>Existing expressions should continue to work normally with one
notable
exception: a selector like <code>.items[]</code> now requires an
explicit wildcard, i.e.
<code>.items[*]</code>.</p>
<p>As a reminder, the <code>pulumi.com/waitFor</code> annotation is
experimental and
subject to change. Similarly, RFC9535 is still only <em>proposed</em>
and may also
change in the future.</p>
</li>
<li>
<p><code>enableConfigMapMutable</code> and
<code>enableSecretMutable</code> are now stable.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3886">pulumi/pulumi-kubernetes#3886</a>)</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Helm resources all now use the correct
<code>registry/config.json</code> file for
credentials. For backward-compatibility <code>registry.json</code> is
preferred if
it exists. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3606">pulumi/pulumi-kubernetes#3606</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d439b2074c"><code>d439b20</code></a>
Update TestHelmRelease's metrics image and update test assertion (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3930">#3930</a>)</li>
<li><a
href="ffd70d544c"><code>ffd70d5</code></a>
Mark SecretPatch inputs as secrets (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3893">#3893</a>)</li>
<li><a
href="65219f0e61"><code>65219f0</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.206.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3925">#3925</a>)</li>
<li><a
href="f1a455ad5f"><code>f1a455a</code></a>
Fix dotnet flakes (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3924">#3924</a>)</li>
<li><a
href="12a40978d9"><code>12a4097</code></a>
Update dependency <code>@pulumi/gcp</code> to v9.4.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3910">#3910</a>)</li>
<li><a
href="cafe468258"><code>cafe468</code></a>
Remove the 'BETA FEATURE' status in front of
<code>enableConfigMapMutable</code> and `en...</li>
<li><a
href="967bd478ab"><code>967bd47</code></a>
Update a redis image (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3917">#3917</a>)</li>
<li><a
href="f52a5b29fd"><code>f52a5b2</code></a>
Automated upgrade: bump pulumi/pulumi to 3.205.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3912">#3912</a>)</li>
<li><a
href="402da8a915"><code>402da8a</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.205.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3909">#3909</a>)</li>
<li><a
href="a2bb6d7a53"><code>a2bb6d7</code></a>
Fix test cluster p-k version (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3902">#3902</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.23.0...v4.24.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.205.0 to 3.206.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.206.0</h2>
<h2>3.206.0 (2025-11-05)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[protobuf] Pass a <code>preview</code> flag to invokes so they can
tell if they're being called during a preview
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20827">#20827</a></p>
</li>
<li>
<p>[cli/about] Include PULUMI_* environment variables in the
<code>pulumi about</code> output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20855">#20855</a></p>
</li>
<li>
<p>[auto/go] Get event log over gRPC instead of trying to read it from a
text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20822">#20822</a></p>
</li>
<li>
<p>[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20824">#20824</a></p>
</li>
<li>
<p>[auto/python] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20833">#20833</a></p>
</li>
<li>
<p>[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20797">#20797</a></p>
</li>
<li>
<p>[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20842">#20842</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix duplicate resource snapshot integrity issue, when
running <code>pulumi up --refresh --run-program</code> and when a
resource <code>PendingReplacement</code> exists in the snapshot
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20812">#20812</a></p>
</li>
<li>
<p>[engine] Support floating point NaN and Inf values in resource state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20843">#20843</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/go] Use Language.Link to link Go packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20811">#20811</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.206.0 (2025-11-05)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[protobuf] Pass a <code>preview</code> flag to invokes so they can
tell if they're being called during a preview
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20827">#20827</a></p>
</li>
<li>
<p>[cli/about] Include PULUMI_* environment variables in the
<code>pulumi about</code> output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20855">#20855</a></p>
</li>
<li>
<p>[auto/go] Get event log over gRPC instead of trying to read it from a
text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20822">#20822</a></p>
</li>
<li>
<p>[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20824">#20824</a></p>
</li>
<li>
<p>[auto/python] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20833">#20833</a></p>
</li>
<li>
<p>[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20797">#20797</a></p>
</li>
<li>
<p>[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20842">#20842</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix duplicate resource snapshot integrity issue, when
running <code>pulumi up --refresh --run-program</code> and when a
resource <code>PendingReplacement</code> exists in the snapshot
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20812">#20812</a></p>
</li>
<li>
<p>[engine] Support floating point NaN and Inf values in resource state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20843">#20843</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/go] Use Language.Link to link Go packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20811">#20811</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="72334612d3"><code>7233461</code></a>
revert "temporarily disable journal validation" (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20875">#20875</a>)</li>
<li><a
href="fad720c136"><code>fad720c</code></a>
Bump SDKs for v3.206.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20881">#20881</a>)</li>
<li><a
href="df81881bab"><code>df81881</code></a>
use event log in python (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20833">#20833</a>)</li>
<li><a
href="93d1e02d55"><code>93d1e02</code></a>
mark tests using dep_tracker as asyncio (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20876">#20876</a>)</li>
<li><a
href="8651da14aa"><code>8651da1</code></a>
refreshv2: only rebuild base state if we have a refresh (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20861">#20861</a>)</li>
<li><a
href="79a8a7d151"><code>79a8a7d</code></a>
fix operator precedence for persisted refreshes in journal (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20807">#20807</a>)</li>
<li><a
href="5ff9d4cc1b"><code>5ff9d4c</code></a>
skip another flaky tail test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20872">#20872</a>)</li>
<li><a
href="b71a38546d"><code>b71a385</code></a>
return a new state from a refresh step when resource is pending
replacement (...</li>
<li><a
href="e7dda0378e"><code>e7dda03</code></a>
feat: adding PULUMI_OPTION_REFRESH environment variable (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20797">#20797</a>)</li>
<li><a
href="4cba7a03a7"><code>4cba7a0</code></a>
Use Language.Link to link Go packages (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20811">#20811</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.205.0...v3.206.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This needs to be merged after we merge
https://github.com/modelcontextprotocol/registry/pull/726 and we cut a
release for v1.3.7
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.175.0 to 3.204.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.204.0</h2>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>v3.203.0</h2>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></p>
</li>
<li>
<p>[cli/package] Show functions in <code>package info</code></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="24654399ab"><code>2465439</code></a>
Bump dotnet language plugin to latest version (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20778">#20778</a>)</li>
<li><a
href="3882b627ba"><code>3882b62</code></a>
implement journaling API and send journal entries to the service
directly (<a
href="https://redirect.github.com/pulumi/pulumi/issues/2">#2</a>...</li>
<li><a
href="ef3c2a316b"><code>ef3c2a3</code></a>
[Node.js] Pass secret values as Output objects to resource hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20774">#20774</a>)</li>
<li><a
href="86503934b9"><code>8650393</code></a>
Support overriding policy severity on violations (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20767">#20767</a>)</li>
<li><a
href="be6db2b82a"><code>be6db2b</code></a>
Run analyzer lifecycle tests through gRPC (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20766">#20766</a>)</li>
<li><a
href="fd8c0a88b5"><code>fd8c0a8</code></a>
Pass secret values as Outputs to hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20769">#20769</a>)</li>
<li><a
href="d292447a49"><code>d292447</code></a>
Add some tests for Python type inspection utilities (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20736">#20736</a>)</li>
<li><a
href="ba809f361c"><code>ba809f3</code></a>
Add a <code>--version</code> flag to <code>pulumi-language-nodejs</code>
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/20768">#20768</a>)</li>
<li><a
href="89ea89b4da"><code>89ea89b</code></a>
update journaling docs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20763">#20763</a>)</li>
<li><a
href="22797a9b84"><code>22797a9</code></a>
Share CurrentProjectContradictsWorkspace between backends (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20759">#20759</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.175.0...v3.204.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
There was feedback that other projects wanting to use the registry
package have to upgrade to 1.25 (because of how Go works). In the
registry itself we are not relying on 1.25 features so this PR reverts
us back to 1.24 until 1.25 becomes better adopted and we can safely move
to it.
Also realised we were not keeping our dependencies for our deploy/infra
code up to date with Dependabot so this fixes that too.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Telemetry to cover failure modes which are not covered by container logs
and metrics for finding resource constraints.
## Motivation and Context
When there is any issue with registry container we should be notified.
## How Has This Been Tested?
- Local seup
## Breaking Changes
- No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- No additional exporter is used, taken advantage of opentelemetry
collector
- It covers metrics related to resource constraints, currently only
limited to default namespace.
- Takes cares of kubernetes events as logs which are the source of
figuring out any problem with service, covers all such scenarios where
pod is not able to start yet and get missed because there are no
container logs for such cases. Limited to default namespace.
- Taken care of daemonset deployment i.e. deploying otel collector as
agent by using correct filtering.
- Cardinality contributing factors are only pod ids (but have to observe
more), node ids will not increase cardinality as scale up will lead to
limited nodes.
- Shipping of metrics for resources happens every 60s and list of
metrics that will be emitted
[https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/kubeletstatsreceiver/metadata.yaml](url)
- Container errors
<img width="1440" height="816" alt="Screenshot 2025-10-10 at 1 21 14 AM"
src="https://github.com/user-attachments/assets/ba90a217-2a49-4522-aa44-a98c02adf95b"
/>
- Resource metrics
<img width="1440" height="816" alt="Screenshot 2025-10-10 at 1 23 51 AM"
src="https://github.com/user-attachments/assets/3467be96-db3c-4930-afa2-3cbf5f0ced8b"
/>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Promotes prod to 1.3.3, the main changes are making mcpb package version
optional and also fixing the enforced schema validation.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Radoslav Dimitrov
dependabot[bot]
Tadas Antanavicius
adam jones
Preeti Dewani