Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.236.0 to 3.237.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.237.0</h2>
<h2>3.237.0 (2026-05-08)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Include the running command name and detected AI agent (when
present) in the User-Agent header on Pulumi Cloud API requests
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22908">#22908</a></p>
</li>
<li>
<p>[engine] Include <code>result</code> on the summary engine event
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22883">#22883</a></p>
</li>
<li>
<p>[sdkgen] Eagerly error on schemas with unconstructable types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22890">#22890</a></p>
</li>
<li>
<p>[cli/cloud] Auto-fill <code>lang</code> and <code>os</code> query
parameters on <code>pulumi cloud api</code> GET/HEAD requests when the
matched OpenAPI operation declares them and the caller hasn't supplied
them
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22726">#22726</a></p>
</li>
<li>
<p>[cli/package] Add <code>pulumi package new</code> to bootstrap a
Pulumi package from a template
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22837">#22837</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Add blank-line gaps between <code>pulumi neo</code> TUI
conversation blocks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22846">#22846</a></p>
</li>
<li>
<p>[cli/import] Preserve <code>__</code>-prefixed keys when generating
PCL for imported resource state, so provider-defined payloads round-trip
correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22856">#22856</a></p>
</li>
<li>
<p>[cli/neo] Render <code>ux__ask_user</code> clarifying questions as
questions instead of approval prompts
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22862">#22862</a></p>
</li>
<li>
<p>[cli/neo] Fix a panic when cancelling a <code>pulumi neo</code>
session
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22898">#22898</a></p>
</li>
<li>
<p>[cli/neo] Render every assistant message in the TUI scrollback so
multi-turn commentary no longer disappears between tool calls</p>
</li>
<li>
<p>[cli/neo] Return the bare stack name and canonical project name from
<code>pulumi_preview</code> and <code>pulumi_up</code> tool results
instead of echoing the raw input
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22891">#22891</a></p>
</li>
<li>
<p>[codegen/pcl] Stop reporting spurious circular references when an
<code>ignoreChanges</code>, <code>hideDiffs</code>,
<code>replaceOnChanges</code>, or <code>additionalSecretOutputs</code>
entry shares a name with a top-level node
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22916">#22916</a></p>
</li>
<li>
<p>[programgen/pcl] Fix PCL binder panic when a conditional mixes a
Promise-typed branch with a try() branch
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22907">#22907</a></p>
</li>
<li>
<p>[sdk/python] Support <code>NotRequired</code>, <code>Required</code>
and <code>total=False</code> in TypedDicts for component resource arg
types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22858">#22858</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.237.0 (2026-05-08)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Include the running command name and detected AI agent (when
present) in the User-Agent header on Pulumi Cloud API requests
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22908">#22908</a></p>
</li>
<li>
<p>[engine] Include <code>result</code> on the summary engine event
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22883">#22883</a></p>
</li>
<li>
<p>[sdkgen] Eagerly error on schemas with unconstructable types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22890">#22890</a></p>
</li>
<li>
<p>[cli/cloud] Auto-fill <code>lang</code> and <code>os</code> query
parameters on <code>pulumi cloud api</code> GET/HEAD requests when the
matched OpenAPI operation declares them and the caller hasn't supplied
them
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22726">#22726</a></p>
</li>
<li>
<p>[cli/package] Add <code>pulumi package new</code> to bootstrap a
Pulumi package from a template
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22837">#22837</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Add blank-line gaps between <code>pulumi neo</code> TUI
conversation blocks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22846">#22846</a></p>
</li>
<li>
<p>[cli/import] Preserve <code>__</code>-prefixed keys when generating
PCL for imported resource state, so provider-defined payloads round-trip
correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22856">#22856</a></p>
</li>
<li>
<p>[cli/neo] Render <code>ux__ask_user</code> clarifying questions as
questions instead of approval prompts
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22862">#22862</a></p>
</li>
<li>
<p>[cli/neo] Fix a panic when cancelling a <code>pulumi neo</code>
session
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22898">#22898</a></p>
</li>
<li>
<p>[cli/neo] Render every assistant message in the TUI scrollback so
multi-turn commentary no longer disappears between tool calls</p>
</li>
<li>
<p>[cli/neo] Return the bare stack name and canonical project name from
<code>pulumi_preview</code> and <code>pulumi_up</code> tool results
instead of echoing the raw input
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22891">#22891</a></p>
</li>
<li>
<p>[codegen/pcl] Stop reporting spurious circular references when an
<code>ignoreChanges</code>, <code>hideDiffs</code>,
<code>replaceOnChanges</code>, or <code>additionalSecretOutputs</code>
entry shares a name with a top-level node
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22916">#22916</a></p>
</li>
<li>
<p>[programgen/pcl] Fix PCL binder panic when a conditional mixes a
Promise-typed branch with a try() branch
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22907">#22907</a></p>
</li>
<li>
<p>[sdk/python] Support <code>NotRequired</code>, <code>Required</code>
and <code>total=False</code> in TypedDicts for component resource arg
types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22858">#22858</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dc35aff826"><code>dc35aff</code></a>
only don't run CI if changelog/config.yaml changes (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22937">#22937</a>)</li>
<li><a
href="a38b7dce73"><code>a38b7dc</code></a>
cli/neo: keep prior streaming text when the agent emits a new turn (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22897">#22897</a>)</li>
<li><a
href="6d84bb5ed7"><code>6d84bb5</code></a>
add continue-on-error to upload code coverage and upload codecov test
results...</li>
<li><a
href="8377d1277e"><code>8377d12</code></a>
Eagerly error on schemas with unconstructable types (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22890">#22890</a>)</li>
<li><a
href="9d209a07ad"><code>9d209a0</code></a>
bump java and yaml dependencies (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22932">#22932</a>)</li>
<li><a
href="dd82f69c24"><code>dd82f69</code></a>
LocalWorkspace.nested_config: use a new stack per test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22926">#22926</a>)</li>
<li><a
href="c5180568c9"><code>c518056</code></a>
Fix flaky TestFuzz: targeted update with refresh + deleted parent (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22925">#22925</a>)</li>
<li><a
href="46486da224"><code>46486da</code></a>
Thread workspace.Context to ProviderFromSource (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22880">#22880</a>)</li>
<li><a
href="ad42ef389e"><code>ad42ef3</code></a>
increase nodejs automation API timeout (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22920">#22920</a>)</li>
<li><a
href="0b8a78bd77"><code>0b8a78b</code></a>
Test on Node.js 26 and drop 20 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22872">#22872</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.236.0...v3.237.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Bump `mcp-registry:imageTag` from `1.7.7` → `1.7.8` in
`deploy/Pulumi.gcpProd.yaml`
- v1.7.8 ships the metrics fix that stops counting client-cancelled
requests as server errors (#1255). Under scraper-driven load, clients
with short timeouts close the socket while PG is still iterating; the
handler converts `context.Canceled` to a 500 and the metric middleware
was bumping `mcp_registry_http_errors_total` even though NGINX recorded
499 and never delivered a response. This is what's been firing the daily
~17:00 UTC `Availability dropped below 95%` alert.
- Also includes a CI-only `pulumi/actions` 6.6.1 → 7.0.0 bump (#1254).
No registry runtime impact.
- Staging is on `4e14707` (the v1.7.8 commit) and
`staging.registry.modelcontextprotocol.io/v0.1/version` reports it.
## Test plan
- [ ] Confirm release workflow's `ko-push` job has published
`ghcr.io/modelcontextprotocol/registry:1.7.8` before merging
- [ ] Watch deploy-production roll the registry pods to `1.7.8`
- [ ] Hit `https://registry.modelcontextprotocol.io/v0.1/version` and
confirm `git_commit` matches `4e147072f0`
- [ ] Through the next ~17:00 UTC scraper burst, watch in Prometheus:
- `mcp_registry_http_errors_total{status_code="500",
path="/v0.1/servers"}` should stay flat
- `mcp_registry_http_requests_total{status_code="499",
path="/v0.1/servers"}` should grow during the burst
- The `Availability dropped below 95%` alert should not fire on
cancellation-only bursts
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Bump `mcp-registry:imageTag` from `1.7.6` → `1.7.7` in
`deploy/Pulumi.gcpProd.yaml`
- v1.7.7 is a security patch covering three findings (validator
hardening, attribute-context UI escaping, IPv6 SSRF blocklist
extension); see the v1.7.7 release notes
- Staging is on `f5f40bd` (the v1.7.7 commit) and verified end-to-end:
- `/v0.1/version` reports the new commit
- `/v0.1/validate` rejects a poisoned `websiteUrl` with
`website-url-invalid-characters`
- `/` HTML serves the `escapeAttr` helper
## Test plan
- [ ] Confirm release workflow's `ko-push` job has finished publishing
`ghcr.io/modelcontextprotocol/registry:1.7.7` before merging
- [ ] Watch deploy-production workflow rolls the registry pods to
`1.7.7`
- [ ] Hit `https://registry.modelcontextprotocol.io/v0.1/version` and
confirm `git_commit` matches `f5f40bd...`
- [ ] Spot-check the catalogue UI loads cleanly
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.233.0 to 3.234.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.234.0</h2>
<h2>3.234.0 (2026-05-01)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api describe</code> for inspecting
the parameters, request
body, and response schema of any Pulumi Cloud API operation, with
text, markdown, and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22770">#22770</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api list</code> for browsing every
endpoint exposed by the Pulumi
Cloud OpenAPI spec, with table and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22769">#22769</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[engine] Revert changes to property path parsing that resulted in
errors for currently valid paths</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.234.0 (2026-05-01)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api describe</code> for inspecting
the parameters, request
body, and response schema of any Pulumi Cloud API operation, with
text, markdown, and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22770">#22770</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api list</code> for browsing every
endpoint exposed by the Pulumi
Cloud OpenAPI spec, with table and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22769">#22769</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[engine] Revert changes to property path parsing that resulted in
errors for currently valid paths</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e802ef2c5b"><code>e802ef2</code></a>
Revert "Tighten parsing on new property paths (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22695">#22695</a>)"
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22801">#22801</a>)</li>
<li><a
href="f5deaa1b20"><code>f5deaa1</code></a>
cli/cloud: add <code>pulumi cloud api describe</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22770">#22770</a>)</li>
<li><a
href="bccf53d1fb"><code>bccf53d</code></a>
cli/cloud: add <code>pulumi cloud api list</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22769">#22769</a>)</li>
<li><a
href="5575172e07"><code>5575172</code></a>
Changelog and go.mod updates for v3.233.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22795">#22795</a>)</li>
<li><a
href="caf13d6d14"><code>caf13d6</code></a>
Cancel in-flight fuzz iterations when the 20s cap fires (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22725">#22725</a>)</li>
<li><a
href="324811c0a7"><code>324811c</code></a>
Freeze v2.233.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22793">#22793</a>)</li>
<li>See full diff in <a
href="https://github.com/pulumi/pulumi/compare/v3.233.0...v3.234.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.232.0 to 3.233.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.233.0</h2>
<h2>3.233.0 (2026-04-30)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[auto/python] Expose the auto-generated Pulumi CLI interface as
<code>workspace.cli_api</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22638">#22638</a></p>
</li>
<li>
<p>[cli] Add encrypted logging to ~/.pulumi/logs; use the
PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22494">#22494</a></p>
</li>
<li>
<p>[cli] Implement the <code>filesystem__grep</code> and
<code>filesystem__content_replace</code> local tools
for <code>pulumi neo</code>. <code>grep</code> runs a regex search
across files in the project root
with an optional <code>include</code> glob filter and returns results in
<code>path:lineno: line</code>
form. <code>content_replace</code> performs a literal multi-file
search-and-replace with a
<code>file_pattern</code> glob and <code>dry_run</code> preview mode.
Both tools skip binary files,
hidden directories, and <code>node_modules</code>, and reject paths
outside the project
root. Their input schemas match the cloud-side tool definitions.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22655">#22655</a></p>
</li>
<li>
<p>[cli] Add <code>pulumi_preview</code> and <code>pulumi_up</code> as
local tools for the experimental <code>pulumi neo</code>
agent. The Neo TUI renders a persistent bordered block for each
operation that
streams changed resources and diagnostics as the engine runs and
finalizes with a
summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22697">#22697</a></p>
</li>
<li>
<p>[engine] Add <code>List</code> to the provider protocol and schema
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22693">#22693</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Return a clear error when two installed plugins claim the
same default provider package name (for example, a native
<code>scaleway</code> provider alongside a
<code>terraform-provider</code> bridge parameterized as
<code>scaleway</code>) instead of panicking with "Should not have
seen an older plugin if sorting is correct!"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22679">#22679</a></p>
</li>
<li>
<p>[programgen] Do not wrap a <code>call(...)</code> on a method whose
return type is marked plain in an Output. Previously
PCL bound every method call's return type as
<code>Output<T></code>, which caused downstream program-gen
to emit broken <code>.apply(...)</code>/<code>.ApplyT(...)</code>
traversals against plain struct returns (e.g.
methods with <code>liftSingleValueMethodReturns=true</code> or
<code>ReturnTypePlain=true</code>).</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22696">#22696</a></p>
</li>
<li>
<p>[backend/diy] When using a backend url containing creds (e.g.
PostgreSQL conn string), mask user:pass as in lock-related error
messages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22701">#22701</a></p>
</li>
<li>
<p>[codegen/go] Generate unqualified <code>Provider</code> references
for the package's own provider resource. Previously
the Go codegen always emitted <code><pkg>.Provider</code> even
when the reference appeared inside <code><pkg></code></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.233.0 (2026-04-30)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[auto/python] Expose the auto-generated Pulumi CLI interface as
<code>workspace.cli_api</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22638">#22638</a></p>
</li>
<li>
<p>[cli] Add encrypted logging to ~/.pulumi/logs; use the
PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22494">#22494</a></p>
</li>
<li>
<p>[cli] Implement the <code>filesystem__grep</code> and
<code>filesystem__content_replace</code> local tools
for <code>pulumi neo</code>. <code>grep</code> runs a regex search
across files in the project root
with an optional <code>include</code> glob filter and returns results in
<code>path:lineno: line</code>
form. <code>content_replace</code> performs a literal multi-file
search-and-replace with a
<code>file_pattern</code> glob and <code>dry_run</code> preview mode.
Both tools skip binary files,
hidden directories, and <code>node_modules</code>, and reject paths
outside the project
root. Their input schemas match the cloud-side tool definitions.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22655">#22655</a></p>
</li>
<li>
<p>[cli] Add <code>pulumi_preview</code> and <code>pulumi_up</code> as
local tools for the experimental <code>pulumi neo</code>
agent. The Neo TUI renders a persistent bordered block for each
operation that
streams changed resources and diagnostics as the engine runs and
finalizes with a
summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22697">#22697</a></p>
</li>
<li>
<p>[engine] Add <code>List</code> to the provider protocol and schema
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22693">#22693</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Return a clear error when two installed plugins claim the
same default provider package name (for example, a native
<code>scaleway</code> provider alongside a
<code>terraform-provider</code> bridge parameterized as
<code>scaleway</code>) instead of panicking with "Should not have
seen an older plugin if sorting is correct!"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22679">#22679</a></p>
</li>
<li>
<p>[programgen] Do not wrap a <code>call(...)</code> on a method whose
return type is marked plain in an Output. Previously
PCL bound every method call's return type as
<code>Output<T></code>, which caused downstream program-gen
to emit broken <code>.apply(...)</code>/<code>.ApplyT(...)</code>
traversals against plain struct returns (e.g.
methods with <code>liftSingleValueMethodReturns=true</code> or
<code>ReturnTypePlain=true</code>).</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22696">#22696</a></p>
</li>
<li>
<p>[backend/diy] When using a backend url containing creds (e.g.
PostgreSQL conn string), mask user:pass as in lock-related error
messages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22701">#22701</a></p>
</li>
<li>
<p>[codegen/go] Generate unqualified <code>Provider</code> references
for the package's own provider resource. Previously
the Go codegen always emitted <code><pkg>.Provider</code> even
when the reference appeared inside <code><pkg></code>
itself, producing identifiers that would not compile. Affects generated
code for method return</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fa313013d0"><code>fa31301</code></a>
don't stamp vcs information into binaries (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22788">#22788</a>)</li>
<li><a
href="17fd40453d"><code>17fd404</code></a>
double timeout in "does not hang" test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22789">#22789</a>)</li>
<li><a
href="eb6e31d841"><code>eb6e31d</code></a>
split tests module on macos further (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22790">#22790</a>)</li>
<li><a
href="94dbe6401b"><code>94dbe64</code></a>
Remove runInStack from run-policy-pack (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22783">#22783</a>)</li>
<li><a
href="a35ec7e9d5"><code>a35ec7e</code></a>
retry pip install a few times (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22785">#22785</a>)</li>
<li><a
href="7a4beeaa44"><code>7a4beea</code></a>
Reject schemas with duplicate tokens after applying
<code>moduleFormat</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22765">#22765</a>)</li>
<li><a
href="0b914cee46"><code>0b914ce</code></a>
unflake TestNodejsComponentProviderRun (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22782">#22782</a>)</li>
<li><a
href="5cd1646706"><code>5cd1646</code></a>
start logging encrypted logs for all pulumi commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22494">#22494</a>)</li>
<li><a
href="a81ef07c09"><code>a81ef07</code></a>
pin more plugin versions in integration tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22758">#22758</a>)</li>
<li><a
href="0d2b8bf114"><code>0d2b8bf</code></a>
Update list doc comment (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22777">#22777</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.232.0...v3.233.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## What this does
The publisher CLI now derives the OIDC audience to request from the
`--registry` URL instead of using a fixed constant, and the server
validates the token's `aud` claim against a new per-deployment env var
(`MCP_REGISTRY_GITHUB_OIDC_AUDIENCE`).
Production sets this env var to
`https://registry.modelcontextprotocol.io` (and per-environment URL
elsewhere), so the deployment only accepts tokens that were requested
for it.
## Compatibility
This is a breaking change for older `mcp-publisher` binaries that still
request the legacy hardcoded audience. After this rolls to a deployment,
users on old `mcp-publisher` will see a clear `invalid audience:
expected …, got […]` error and need to upgrade. Users following the
documented `releases/latest` install pattern get the new binary
automatically.
## Test plan
- [ ] CI green
- [ ] Run a synthetic publish from a real GitHub Actions workflow
against staging after deploy
- [ ] Confirm an older `mcp-publisher` against the same staging deploy
returns the expected `invalid audience` error
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.4](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.4)
(#1225) to production: registry pod memory request `256Mi → 512Mi`,
limit `512Mi → 1Gi`.
## Why
#1221 doubled pgxpool `MaxConns` 30→60 per pod without bumping the
registry pod memory limit. pgxpool keeps per-connection state in the Go
process (prepared statement cache, scratch buffers, row iteration state)
so peak per-pod memory shifted from ~330 MB to ~450 MB against the 512
MiB limit. Pod `tx49f` was OOMKilled at 17:01 UTC on 2026-04-29.
## Validation so far
- Staging deployed cleanly via `deploy-staging.yml` after #1225 merged
- Both staging pods running with `req=512Mi limit=1Gi` ✓
- Rolling update was clean — no failed health checks during the
transition
- Both pods spread across nodes (q716 + 7exo)
## Deployment
**Zero downtime** — Deployment template change only, rolling update with
`maxSurge: 1, maxUnavailable: 0`. No PG involvement (no
`max_connections` change, no shared_preload_libraries change).
## Test plan
- [x] v1.7.4 release built and pushed
(`ghcr.io/modelcontextprotocol/registry:1.7.4`)
- [x] Staging deployed cleanly with new limits
- [ ] Prod Pulumi run applies cleanly; rolling update completes
- [ ] Prod pods come up with `req=512Mi limit=1Gi`
- [ ] After 24h: no OOMKills on either pod, peak memory stays under ~600
MB
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Follow-up to #1221. That PR doubled pgxpool `MaxConns` from 30 to 60 per
pod without bumping the registry pod memory limit. pgxpool keeps
per-connection state in the Go process (prepared statement cache,
scratch buffers, row iteration state), so memory grew roughly
proportionally — peak per-pod usage shifted from ~330 MB to ~450 MB
against a 512 MiB limit.
## What surfaced it
Pod `tx49f` was OOMKilled at 17:01 UTC on 2026-04-29 (`exitCode 137`,
`reason: OOMKilled`). Memory history from Cloud Monitoring confirms the
regression:
| Pods | Peak 30-min memory |
|------|-------------------:|
| Pre-#1221 (`MaxConns=30`) | 178–333 MB |
| **Post-#1221** (`MaxConns=60`) | **437–449 MB** |
| Old limit | **512 MiB** ← right at the edge |
Other pod was at 394 MB at the time of inspection — could OOM again.
## Fix
`deploy/pkg/k8s/registry.go:217-225`:
| | Before | After |
|---|-------:|------:|
| `requests.memory` | 256 MiB | **512 MiB** |
| `limits.memory` | 512 MiB | **1 GiB** |
1 GiB is ~2× the current peak under load — gives room for traffic spikes
without immediate OOM risk. Either node has 4–5 GiB free allocatable
memory, so the new request fits comfortably.
## Test plan
- [x] `go build ./...` clean
- [x] `golangci-lint run` clean
- [ ] After release + prod promotion: pod memory stabilises around 450
MB peak with no OOMKills
- [ ] After release + prod promotion: tx49f restartCount stops climbing
(currently at 5)
## Deployment
Zero downtime — Deployment template change only, rolling update with
`maxSurge: 1, maxUnavailable: 0`. **No PG involvement** (no
`max_connections` change, no shared_preload_libraries change). Same
shape as a normal v1.7.x image promotion.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.3](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.3)
to production. Contents:
- **#1220** — `RemoteURL` filter SQL rewritten to use JSONB containment
(`@>`) instead of `EXISTS jsonb_array_elements`. The new form is
GIN-indexable; the old form forced a full table scan. Local benchmark:
40,398 → 294 buffer reads, 17 ms → 1.6 ms. Maps to prod's 10,005 ms
cold-cache observation.
- **#1221** — pgxpool `MaxConns 30→60`, `MinConns 5→10`. PG
`max_connections 100→200`. Explicit PG `resources:` block (was unset).
## What this addresses
- **#1220**: yesterday's 17:08 UTC `Publish Endpoint Latency` alert
(`dev.storage/mcp` publish took 14.8s with `remotes_ms=10980` —
pinpointed by the per-phase slog from #1215).
- **#1221**: yesterday's 17:35–17:40 UTC `Availability dropped below
95%` alert and 18:17 UTC `Publish Endpoint Latency` re-fire. Both were
scraper-driven concurrency on `/v0/servers` (~15 req/s sustained from
ServiceNow + others). With the bumped pool, the queue at the Go HTTP
layer should clear faster instead of blowing up to 20–35s nginx-level
latencies.
## Deployment caveat
The PG `max_connections` change is a postmaster-level setting → CNPG
triggers a PG restart on the next prod Pulumi run. With `instances: 1`
this is brief downtime — staging took **~30s** during the equivalent
restart, with **one registry pod bouncing once** on its 8-attempt
DB-retry budget before recovering on the next kubelet restart.
**Time the merge for a low-traffic UTC window.** Alert history suggests
very early UTC (02:00–04:00) is quietest.
## Resource impact
PG node memory is currently 39% (~2.4 GiB / 6 GiB allocatable).
Worst-case PG memory growth with `max_connections=200` lands around 3–4
GiB, putting the node at ~65% — fits with headroom. Empirically, prod PG
has peaked at **413 MiB** in the last 30h of incident data, so the
proposed 4 GiB limit is ~10× the historical max — guardrail not
constraint.
## Post-merge
CNPG handles `pg_stat_statements` extension creation automatically (no
manual `CREATE EXTENSION` step needed — it was already done in v1.7.2's
deploy).
Verify after deploy:
```bash
PATH=/opt/homebrew/share/google-cloud-sdk/bin:$PATH
# max_connections actually changed
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -tAc "SHOW max_connections" # expect: 200
# resources block applied
kubectl get pod registry-pg-1 \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-o jsonpath='{.spec.containers[?(@.name=="postgres")].resources}{"\n"}'
# pgxpool MaxConns reflected (registry app uses 60 per pod after restart)
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -tAc "SELECT count(*) FROM pg_stat_activity WHERE datname='app'"
```
## Test plan
- [x] v1.7.3 release built and pushed
(`ghcr.io/modelcontextprotocol/registry:1.7.3`)
- [x] Staging deployed cleanly; PG restarted and came back with
`max_connections=200`; one staging pod bounced as expected
- [ ] Prod Pulumi run applies cleanly; brief PG restart
- [ ] Confirm `SHOW max_connections` returns 200 on prod
- [ ] Confirm `publish complete` events show `remotes_ms` < 10ms
- [ ] Watch for any "too many connections" errors during the rollout
window (none expected — Pulumi orders CNPG cluster before Deployment, so
PG accepts the new conn limit before pgxpool tries to use it)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Follow-up to #1215 and #1220. Both of those addressed *individual* slow
queries; this PR addresses *concurrency* — under today's scraper load
the cursor query is fast on average (mean 42ms) but the connection pool
saturates and queue depth blows up at the Go HTTP layer.
## Diagnosis
`pg_stat_statements` (added in #1215) made this possible to see:
```
max_ms mean_ms calls template
10,755 41.8 94,009 plain cursor pagination, no filter
7,277 214.7 14,770 ILIKE substring filter
7,638 330.8 7,656 ILIKE substring + is_latest filter
```
Mean times are healthy. But `max_exec_time` of 7–10s on the cursor
query, combined with sustained ~15 req/s from scrapers (ServiceNow's
148.139.x.x range, anonymous `node` user-agent, etc) saturates
`MaxConns=30 × 2 pods = 60`. New requests queue at the Go HTTP layer;
nginx-side p99 hits 35s; eventually scrapers time out at 60s, retry, and
amplify the queue.
Today's two ongoing alerts are both this pattern:
- 17:35–17:40 UTC `Availability dropped below 95%` — 4,526 GET requests
in 5 min, hundreds of 504s
- 18:17 UTC `Publish Endpoint Latency` re-fire — same scraper
concurrency dragging the publish path
Critically, the symptoms today were also visible during yesterday's
incident, but yesterday's broken cursor (#1215) was the dominant cause.
After #1215 the cursor is fast individually; concurrency now becomes the
next bottleneck.
## Changes
### pgxpool (`internal/database/postgres.go`)
| Setting | Before | After |
|---------|-------:|------:|
| `MaxConns` | 30 | **60** per pod |
| `MinConns` | 5 | **10** per pod |
| `MaxConnIdleTime` | 30 min | (unchanged) |
| `MaxConnLifetime` | 2 h | (unchanged) |
2 pods × 60 = 120 total app connections. Cuts queue depth roughly in
half at current scraper load.
### PG cluster (`deploy/pkg/k8s/postgres.go`)
- `max_connections: 100 → 200` — required to support the larger pool.
120 (app) + ~10 (PG internals: autovacuum, replication, admin) + 70
headroom.
- Added explicit `resources:` block — previously the pod had no resource
limits, making node-level OOM behaviour unpredictable.
| | Request | Limit |
|---|--------:|------:|
| memory | 512Mi | **4Gi** |
| cpu | 200m | 1500m |
## Resource budget
| Node | Now | After |
|------|----:|------:|
| dy89 (PG node) | 39% mem (~2.4 GiB / 6 GiB) | ~65% mem worst-case
(~3.9 GiB) |
| 2yxm | 36% mem | unchanged |
Both nodes well within capacity. CPU usage <50% on both, plenty of
headroom.
PG worst-case memory math:
- 200 conns × ~15 MB per backend = 3 GiB
- + `shared_buffers` 128 MiB
- + `maintenance_work_mem`, OS overhead, etc.
- ≈ 3–4 GiB total
## Deployment caveat
`max_connections` is a postmaster-level setting → CNPG triggers a PG
restart on the change. Same in-pod restart shape as the
pg_stat_statements deploy yesterday — registry pods see ~30s of DB
unavailability, covered by v1.7.1's retry-with-backoff (8 attempts, 1→8s
capped). One registry pod may bounce once before recovering, like
yesterday.
**Time the merge for a low-traffic UTC window.**
Order of operations matters within the deploy itself:
1. Pulumi applies the new CNPG spec → PG restarts with
`max_connections=200`
2. Rolling deploy of registry pods picks up `MaxConns=60` config
3. New conns are accepted up to 200 limit
Pulumi's standard ordering does step 1 before step 2 in this scenario
(Pulumi resource graph: CNPG cluster precedes Deployment). If for any
reason it doesn't, the worst case is `too many connections` errors
during a small window — Self-correcting once the rollout completes.
## Test plan
- [x] `go build ./...` clean for app + deploy
- [x] `make lint` clean
- [x] `go test -race ./internal/database/...` green
- [ ] On merge: staging deploy applies the spec change cleanly; PG
restarts; pool reaches 60 max
- [ ] On prod deploy: same; verify no `too many connections` errors
during the rollout window
- [ ] After deploy: query `SHOW max_connections` returns 200; query
pg_stat_statements after a scraper burst, confirm `max_exec_time` for
cursor query no longer hits 10s
## Out of scope
- **ILIKE substring search** (`server_name ILIKE '%foo%'`) is
unindexable. Three pg_stat_statements variants run with means 141–333ms
and max 4–7s. Worth replacing with a `pg_trgm` GIN index or full-text
search in a separate PR.
- **Per-IP nginx rate limiting** — defends against scraper retry storms
regardless of pool size.
- **`Cache-Control` on `/v0/servers`** — let nginx absorb
scraper-repeated cursors.
- **Pre-existing `superfluous WriteHeader` warnings** — separate Huma
framework issue.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.2](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.2)
(PR #1215) to production:
- **Row-constructor cursor pagination** — fixes the 760ms list query
that was the root cause of today's pool-exhaustion alerts. Local
benchmark shows /v0/servers paginated requests dropping from ~30ms (cold
cache, 100K rows) to ~0.05ms.
- **Per-phase publish slog** — `publish complete` events now include
validate / lock / remotes / version_checks / unmark / db_create timings
so the next slow publish is self-diagnostic.
- **pg_stat_statements** — aggregate query visibility we didn't have
during today's incident.
## Deployment caveat
The CNPG cluster spec change for `pg_stat_statements` triggers an in-pod
postgres restart on the next prod Pulumi run. Staging took **~45–70s of
registry unavailability** during the equivalent restart. The DB
retry-with-backoff in v1.7.1 covers most of it, but registry pods may
bounce once before they reconnect (one staging pod hit `Failed to
connect after 8 attempts` then recovered on its next restart).
**Time the merge for a low-traffic UTC window** — the alert history
suggests very early UTC is quietest.
## Post-merge action
Once the prod Pulumi run completes, run once on the existing cluster:
```bash
PATH=/opt/homebrew/share/google-cloud-sdk/bin:$PATH
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -c "CREATE EXTENSION IF NOT EXISTS pg_stat_statements"
```
Verify:
```bash
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -d app -c "
SELECT round(mean_exec_time::numeric, 2) AS mean_ms, calls,
substring(query, 1, 80) AS q
FROM pg_stat_statements ORDER BY total_exec_time DESC LIMIT 10;"
```
## Test plan
- [x] v1.7.2 release built and pushed
(`ghcr.io/modelcontextprotocol/registry:1.7.2`)
- [x] Staging deployed cleanly; `pg_stat_statements` is collecting on
staging
- [ ] Prod Pulumi run applies cleanly; brief PG restart
- [ ] Run `CREATE EXTENSION` on prod
- [ ] Confirm `publish complete` events contain per-phase timings on the
next publish
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Three changes from the 2026-04-27 incident:
1. **Cursor SQL fix** — `addCursorCondition` rewritten to use a
row-constructor comparison `(server_name, version) > ($1, $2)` instead
of the OR-decomposed form. Postgres can index-seek on the row
constructor; it can't on the OR form, which scanned from the start of
the index and filtered rows before the cursor. Cost grew linearly with
cursor depth.
2. **Per-phase publish timings restored** — `createServerInTransaction`
was simplified during #1211 review to log only `validate_ms`. The
incident showed publishes spending 50+ s in `acquire_lock` /
`version_checks` / `db_create` while `validate_ms` reported a few
hundred ms — the diagnostic signal was hidden. Restored timings for
every phase, refactored into a small `runPhase` helper.
3. **`pg_stat_statements` enabled** in the CNPG cluster spec. We had no
aggregate query visibility during the incident — could only EXPLAIN
queries we happened to suspect.
## Cursor fix evidence
Local benchmark, 100K rows, cold cache:
| Form | Rows filtered | Buffer reads | Time |
|------|--------------:|-------------:|-----:|
| OLD | 80,001 | 7,679 | 31.6 ms |
| NEW | 2 | 1 | **0.05 ms** |
Maps to prod's measured 8,911 buffer hits → 760 ms. End-to-end API:
`/v0/servers?limit=100&cursor=…` returns in 4–7 ms regardless of depth.
Risk check: confirmed `(server_name, version)` index exists in that
column order (both `servers_pkey` and `idx_servers_name_version`), and
both columns are `NOT NULL` so row-constructor comparison can't silently
drop rows.
## Tests
- New
`TestPostgreSQL_PerformanceScenarios/compound_cursor_across_versions_of_same_server`
pins multi-version pagination semantics. The existing cursor tests only
exercised the fallback (single-component cursor) and degenerate (one
version per server) cases.
- `make lint` clean, `go test -race ./internal/... ./cmd/...` green.
## Deployment
The cursor + slog changes are zero-downtime. The CNPG spec change
triggers a brief PG restart (single-instance cluster). After the
restart, run once on prod:
```bash
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -c "CREATE EXTENSION IF NOT EXISTS pg_stat_statements"
```
Time the merge for a low-traffic UTC window. v1.7.1's DB
retry-with-backoff covers the brief PG restart.
## Out of scope
`MaxConns` bump, per-IP rate limiting at nginx, response caching, the
pre-existing `superfluous WriteHeader` warnings — separate follow-ups.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.1](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.1)
to production. Contents: the hardening + diagnostics from #1211.
What's in v1.7.1 (vs v1.7.0):
- Pulumi-managed IAM bindings for the default compute SA so
fluentbit-gke and the GMP collector can ship logs/metrics (already
applied to live cluster manually)
- `PodDisruptionBudget` with `minAvailable: 1` +
`TopologySpreadConstraints` to keep pods spread across nodes
- `StartupProbe` (30 × 5s) covering the new DB-retry budget
- Bounded retry-with-backoff on initial DB connect in
`cmd/registry/main.go`
- Memory request 128→256Mi, limit 256→512Mi
- `slog` `validate_ms` timing on the publish path so the next slow
`/v0/publish` is self-diagnostic
## Test plan
- [x] v1.7.1 release workflow built and pushed image successfully
(`ghcr.io/modelcontextprotocol/registry:1.7.1`)
- [x] Pulumi.gcpProd.yaml diff is the single-line image bump
- [ ] On merge, `deploy-production.yml` rolls out v1.7.1 — watch for
clean rolling update (`maxSurge: 1`, `maxUnavailable: 0`) and confirm
both pods reach Ready
- [ ] After rollout, confirm `Starting MCP Registry Application v1.7.1`
shows up in Cloud Logging from the new pods
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Follow-up to #1211 to encode the GCP API and IAM dependencies its
node-SA bindings rely on. After #1211 merged, the staging deploy hit two
undocumented prereqs in sequence — Cloud Resource Manager API not
enabled (because `projects.NewIAMMember` calls SetIamPolicy through
CRM), then the Pulumi service account missing
`roles/resourcemanager.projectIamAdmin`. Both fixed manually to unblock;
this PR makes them explicit so they don't bite again.
## Changes
**`ensureRequiredAPIs` adopts five GCP APIs** as Pulumi-managed
`projects.Service` resources, all with `DisableOnDestroy: false` and
`DisableDependentServices: false` so a Pulumi destroy/refactor can never
disable a shared API:
| API | Why |
|-----|-----|
| `cloudresourcemanager` | `projects.NewIAMMember` → SetIamPolicy |
| `compute` | `compute.GetDefaultServiceAccount` invoke + GKE |
| `container` | GKE cluster |
| `logging` | fluentbit-gke ships container logs |
| `monitoring` | managed Prometheus collector ships metrics |
CRM is created explicitly (not in the loop) so callers get a direct
reference for `pulumi.DependsOn`. Storage is intentionally **not**
Pulumi-managed — Pulumi state itself lives in a GCS bucket,
chicken-and-egg.
**`grantNodeServiceAccountRoles`** now `DependsOn` the CRM
`projects.Service` for the four IAM bindings, and uses
`compute.GetDefaultServiceAccount` to derive the SA email (Compute API
was already required for GKE — avoids a CRM-dependent project-number
lookup).
**`deploy/README.md`** — adds `roles/resourcemanager.projectIamAdmin` to
the Pulumi SA's required roles and clarifies which APIs must be enabled
before the first `pulumi up` (storage, cloudresourcemanager, container)
vs. which `ensureRequiredAPIs` adopts.
## Notes
`projects.Service` is idempotent against already-enabled APIs — on
existing projects (staging/prod), Pulumi adopts the live enablement into
state without re-enabling. This was confirmed live: staging deploy went
green after the manual unblocks above, validating the runtime model.
## Test plan
- [x] `go build ./...` clean for `deploy/`
- [x] `golangci-lint run` clean for `deploy/pkg/providers/gcp/...` (one
pre-existing `nilnil` at line 61, unrelated)
- [x] Manual unblock + green staging deploy verified the runtime
behavior this PR encodes
- [ ] On merge: staging deploy adopts the existing API enablements
without churn, then proceeds normally
- [ ] Prod deploy via #1212 (image promotion) inherits the same setup
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Daily ~17:00 UTC `Publish Endpoint Latency` and `Availability < 95%`
alerts are caused by both registry pods exit-0'ing within seconds of
each other and racing with the still-recovering `registry-pg-rw`
endpoint on restart. Separately, the default compute SA had no project
IAM roles, so `fluentbit-gke` and the GMP collector were silently
dropping every log line and time series — which is why none of this was
visible in Cloud Logging.
All Kubernetes/IAM changes apply uniformly to staging and prod.
## Changes
- **GCP IAM** (`deploy/pkg/providers/gcp/provider.go`) — grant the
default compute SA `logging.logWriter`, `monitoring.metricWriter`,
`monitoring.viewer`, and `stackdriver.resourceMetadata.writer`. Already
applied live; this just encodes it in Pulumi.
- **Pod resilience** (`deploy/pkg/k8s/registry.go`) —
- `PodDisruptionBudget` (`minAvailable: 1`) prevents a synchronized
voluntary disruption.
- `TopologySpreadConstraints` (`ScheduleAnyway`, hostname) keeps the PDB
from deadlocking node drains when both pods co-locate.
- `StartupProbe` (30 × 5s = 150s) protects the DB-retry budget from the
liveness probe.
- Memory bump 128→256Mi request, 256→512Mi limit.
- **Startup retry** (`cmd/registry/main.go`) — replace silent `return`
on initial DB-ping failure with bounded retry-with-backoff (8 attempts,
1→8s capped, 10s per-attempt). A brief endpoint flap no longer cascades
into a restart loop.
- **Diagnostic log** (`internal/service/registry_service.go`) — emit
`validate_ms` on each publish (success and failure). Validate fans out
to npm/PyPI/OCI with 10s per-host timeouts and is the most likely
contributor to publish latency. Total request duration is already
covered by the existing `http.request.duration` histogram.
## Calibration
The IAM, PDB, topology-spread, startup-probe, and DB-retry pieces are
mitigations — they reduce blast radius regardless of root cause. The
`validate_ms` log is the diagnostic for identifying the trigger when the
alert fires next. Single-PG SPOF (`deploy/pkg/k8s/postgres.go:57`)
remains a follow-up; today's evidence shows PG was a victim, not the
cause.
## Test plan
- [x] `go build ./...` and `go vet ./...` clean for both modules
- [x] `make lint` clean (12 pre-existing issues under `deploy/` are not
in `make lint`)
- [x] `go test -race -count=1 ./internal/... ./cmd/...` green
- [x] IAM applied live; `fluentbit-gke` and GMP no longer hitting
`IAM_PERMISSION_DENIED`
- [ ] After deploy, verify the next 17:00 UTC firing surfaces
`validate_ms` in Cloud Logging
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Bumps production image tag from `1.6.0` to `1.7.0` in
`deploy/Pulumi.gcpProd.yaml`
- Corresponds to the [v1.7.0
release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.0)
- Notable change: includes #1201 — fixes#1081 (`isLatest` no longer
stranded after soft-delete) and ships migration `014_heal_is_latest`
that auto-heals affected servers (e.g.
`io.github.containers/kubernetes-mcp-server`) on deploy
## Test plan
- [ ] Verify Pulumi preview shows only the image tag change
- [ ] After deploy, confirm migration 014 ran and
`io.github.containers/kubernetes-mcp-server`'s `/versions/latest`
returns `0.0.61` (or whichever is highest non-deleted)
- [ ] Sample a few unaffected servers and confirm `isLatest` is
unchanged
- [ ] Confirm overall service health
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.231.0 to 3.232.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.232.0</h2>
<h2>3.232.0 (2026-04-22)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add an experimental <code>pulumi neo</code> command that
creates a Pulumi Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell
tool calls
issued by the agent run on the user's machine in their working
directory; the
interactive chat continues to happen in the Pulumi Console at the URL
the command
prints. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22473">#22473</a></p>
</li>
<li>
<p>[cli] Add support for handling user approval requests in the
<code>pulumi neo</code> terminal UI.
When the agent requests confirmation for a sensitive action, the TUI
prompts the
user and forwards their response back to the Pulumi Console. Hidden
behind
PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22589">#22589</a></p>
</li>
<li>
<p>[cli] Add an interactive terminal UI for <code>pulumi neo</code>
built with bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal
alongside the
Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22570">#22570</a></p>
</li>
<li>
<p>[cli] Switch logging library from glog to slog.</p>
</li>
</ul>
<p>BREAKING: any <code>if logging.V(x) {</code> need to be changed to
<code>if logging.V(x).Enabled()</code></p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22548">#22548</a></p>
<ul>
<li>
<p>[cli] Add a plan-mode toggle to the <code>pulumi neo</code> TUI,
bound to Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
running <code>pulumi up</code>, or opening PRs, and surfaces an approved
plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
plan mode automatically.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22634">#22634</a></p>
</li>
<li>
<p>[cli] The <code>pulumi neo</code> TUI now drives its
"thinking" spinner off a single declarative
rule (the spinner stays on until a final event — final assistant
message, approval
request, cancellation, or error — lands), so the indicator no longer
flickers off
when the agent hands off tool calls to the CLI or when streaming text
arrives
between tools. Press <code>Esc</code> during a turn to ask the agent to
cancel; the label
switches to "Cancelling..." until the backend
acknowledges.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22637">#22637</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.232.0 (2026-04-22)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add an experimental <code>pulumi neo</code> command that
creates a Pulumi Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell
tool calls
issued by the agent run on the user's machine in their working
directory; the
interactive chat continues to happen in the Pulumi Console at the URL
the command
prints. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22473">#22473</a></p>
</li>
<li>
<p>[cli] Add support for handling user approval requests in the
<code>pulumi neo</code> terminal UI.
When the agent requests confirmation for a sensitive action, the TUI
prompts the
user and forwards their response back to the Pulumi Console. Hidden
behind
PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22589">#22589</a></p>
</li>
<li>
<p>[cli] Add an interactive terminal UI for <code>pulumi neo</code>
built with bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal
alongside the
Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22570">#22570</a></p>
</li>
<li>
<p>[cli] Switch logging library from glog to slog.</p>
</li>
</ul>
<p>BREAKING: any <code>if logging.V(x) {</code> need to be changed to
<code>if logging.V(x).Enabled()</code></p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22548">#22548</a></p>
<ul>
<li>
<p>[cli] Add a plan-mode toggle to the <code>pulumi neo</code> TUI,
bound to Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
running <code>pulumi up</code>, or opening PRs, and surfaces an approved
plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
plan mode automatically.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22634">#22634</a></p>
</li>
<li>
<p>[cli] The <code>pulumi neo</code> TUI now drives its
"thinking" spinner off a single declarative
rule (the spinner stays on until a final event — final assistant
message, approval
request, cancellation, or error — lands), so the indicator no longer
flickers off
when the agent hands off tool calls to the CLI or when streaming text
arrives
between tools. Press <code>Esc</code> during a turn to ask the agent to
cancel; the label
switches to "Cancelling..." until the backend
acknowledges.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22637">#22637</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="59d156aaea"><code>59d156a</code></a>
Add <code>l2-plain-component</code> & remove test dependencies on
AWS (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22470">#22470</a>)</li>
<li><a
href="3efae3eafd"><code>3efae3e</code></a>
Cancel providers before closing them (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22692">#22692</a>)</li>
<li><a
href="448770ec12"><code>448770e</code></a>
Add l2-id-type test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22681">#22681</a>)</li>
<li><a
href="cc8a16f376"><code>cc8a16f</code></a>
go/auto: use random stack names in TestNestedConfig (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22689">#22689</a>)</li>
<li><a
href="6b5ce009ee"><code>6b5ce00</code></a>
skip signal cancellation tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22684">#22684</a>)</li>
<li><a
href="923073c621"><code>923073c</code></a>
fix[codegen/go]: Use Context.GetOrRegisterPackageRef in generated code
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22170">#22170</a>)</li>
<li><a
href="2608e2c071"><code>2608e2c</code></a>
Gitignore <code>.claude/scheduled_tasks.lock</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22686">#22686</a>)</li>
<li><a
href="3e387c7355"><code>3e387c7</code></a>
chore: typo <code>succesful</code> -> <code>successful</code> in
nodejs run/index.ts (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22685">#22685</a>)</li>
<li><a
href="a850bcbfef"><code>a850bcb</code></a>
Update dependency pulumi/pulumi-java to v1.25.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22673">#22673</a>)</li>
<li><a
href="416fd51b5f"><code>416fd51</code></a>
replace underlying logging library with slog (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22548">#22548</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.231.0...v3.232.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Bumps production image tag from `1.5.0` to `1.6.0` in
`deploy/Pulumi.gcpProd.yaml`
- Corresponds to the [v1.6.0
release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.6.0)
## Test plan
- [ ] Verify Pulumi preview shows only the image tag change
- [ ] Deploy and confirm the service is healthy
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We keep bumping `go 1.26.x` across the repo every time a new Go patch
drops
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only —
"this module needs Go 1.26")
- **All CI workflows**: `go-version-file: 'go.mod'` → `go-version:
'stable'` — CI always uses the latest stable Go, no more
bump PRs
- **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` →
`go-version-input: 'stable'`
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
- Updates the production image tag in `deploy/Pulumi.gcpProd.yaml` from
`1.4.1` to `1.5.0`
## Test plan
- [ ] Verify the Pulumi deployment picks up the new image tag
- [ ] Confirm the v1.5.0 container image exists in the registry
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bumps
[github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes)
from 4.25.0 to 4.27.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.27.0</h2>
<p>No release notes provided.</p>
<h2>v4.26.0</h2>
<h3>Fixed</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4122">#4122</a>
Implements a new provider config option, <code>alwaysRender</code>,
which sets <code>Diff_Some</code>to true when used in combination with
<code>renderYAMLtoDirectory</code>.
This allows for user-defined opt-in behavior for YAML manifests to be
idempotently generated on every <code>pulumi up</code>, and for Update()
to show these changes to a user.</p>
</li>
<li>
<p>Fixed a race condition in StatefulSet await logic where Pulumi could
incorrectly report a rollout as complete before the controller had
processed the update. This occurred when Pulumi checked status fields
before the controller updated <code>observedGeneration</code>, causing
stale "ready" values to be trusted.</p>
</li>
<li>
<p>Fixed a regression of <a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/2943">#2943</a>
which could cause Deployments to erroneously report diffs.</p>
</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgraded <code>helm.sh/helm</code> to v3.18.6. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3969">pulumi/pulumi-kubernetes#3969</a>)</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4156">#4156</a>
Upgrade Kubernetes schema and libraries to v1.35.1</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's
changelog</a>.</em></p>
<blockquote>
<h2>4.27.0 (March 2, 2026)</h2>
<h3>Fixed</h3>
<ul>
<li><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4181">#4181</a>
Fix PVC timeout when updating to a storage class with
WaitForFirstConsumer bind mode.</li>
</ul>
<h3>Added</h3>
<ul>
<li><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3661">#3661</a>
Support for OCI login inside the provider process. Providing a
username/password to <code>Chart v4</code> and <code>Release v3</code>
will now login to private OCI
registries as expected.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/2911">pulumi/pulumi-kubernetes#2911</a>
and <a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/1914">pulumi/pulumi-kubernetes#1914</a>)</li>
</ul>
<h2>4.26.0 (February 19, 2026)</h2>
<h3>Fixed</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4122">#4122</a>
Implements a new provider config option, <code>alwaysRender</code>,
which sets <code>Diff_Some</code>to true when used in combination with
<code>renderYAMLtoDirectory</code>.
This allows for user-defined opt-in behavior for YAML manifests to be
idempotently generated on every <code>pulumi up</code>, and for Update()
to show these changes to a user.</p>
</li>
<li>
<p>Fixed a race condition in StatefulSet await logic where Pulumi could
incorrectly report a rollout as complete before the controller had
processed
the update. This occurred when Pulumi checked status fields before the
controller updated <code>observedGeneration</code>, causing stale
"ready" values to be
trusted.</p>
</li>
<li>
<p>Fixed a regression of
<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/2943">#2943</a>
which could
cause Deployments to erroneously report diffs.</p>
</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>Upgraded <code>helm.sh/helm</code> to v3.18.6. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3969">pulumi/pulumi-kubernetes#3969</a>)</p>
</li>
<li>
<p><a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/4156">#4156</a>
Upgrade Kubernetes schema and libraries to v1.35.1</p>
</li>
</ul>
<h2>4.24.0 (November 5, 2025)</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="20f0c07152"><code>20f0c07</code></a>
Prepare for v4.27.0 release (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4194">#4194</a>)</li>
<li><a
href="c5e7ece7b1"><code>c5e7ece</code></a>
Update module github.com/pulumi/pulumi/pkg/v3 to v3.224.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4191">#4191</a>)</li>
<li><a
href="49c2646952"><code>49c2646</code></a>
helm: login to private registries (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3661">#3661</a>)</li>
<li><a
href="b48d7a39a8"><code>b48d7a3</code></a>
Fix PVC timeout on Update (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4181">#4181</a>)</li>
<li><a
href="e3427da684"><code>e3427da</code></a>
Automated upgrade: bump pulumi/pulumi to 3.223.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4188">#4188</a>)</li>
<li><a
href="7af1b7e73b"><code>7af1b7e</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.224.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4189">#4189</a>)</li>
<li><a
href="6860aae22d"><code>6860aae</code></a>
Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4187">#4187</a>)</li>
<li><a
href="5c58fea181"><code>5c58fea</code></a>
Update GitHub Actions workflows. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4186">#4186</a>)</li>
<li><a
href="1564fc1c46"><code>1564fc1</code></a>
Update module github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3
to v3...</li>
<li><a
href="9ebe2663c3"><code>9ebe266</code></a>
Update dependency <code>@pulumi/gcp</code> to v9.13.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/4184">#4184</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.25.0...v4.27.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.219.0 to 3.220.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.220.0</h2>
<h2>3.220.0 (2026-02-10)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Show environment variables that were set if a snapshot
integrity error happens
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21709">#21709</a></p>
</li>
<li>
<p>[cli/{install,package}] Use the Pulumi Cloud Registry by default to
resolve package names</p>
</li>
<li>
<p>[engine] Pass replacement trigger through to Construct
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21408">#21408</a></p>
</li>
<li>
<p>[engine] Add EnvVarMappings resource option for provider resources,
allowing environment variables to be remapped before being passed to the
provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21572">#21572</a></p>
</li>
<li>
<p>[pkg] BREAKING: Deprecate
github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of
github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This
package will be removed from pulumi/pulumi soon!
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21720">#21720</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Retry <code>yarn install</code> when it fails (e.g. during
<code>pulumi install</code>)
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21707">#21707</a></p>
</li>
<li>
<p>[engine] Deal with errors in elided journal entries correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21576">#21576</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix remote components with
PULUMI_NODEJS_SKIP_COMPONENT_INPUTS</p>
</li>
<li>
<p>[sdk/python] Fix <code>_LazyModule</code> to not trigger full module
load for introspection attributes
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21620">#21620</a></p>
</li>
<li>
<p>[sdkgen/python] Remove workaround for slow typechecking with MyPy and
PyCharm
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21722">#21722</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli] Write logfile location if verbosity is >= 1 to stderr
instead of stdout
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21663">#21663</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.220.0 (2026-02-10)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Show environment variables that were set if a snapshot
integrity error happens
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21709">#21709</a></p>
</li>
<li>
<p>[cli/{install,package}] Use the Pulumi Cloud Registry by default to
resolve package names</p>
</li>
<li>
<p>[engine] Pass replacement trigger through to Construct
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21408">#21408</a></p>
</li>
<li>
<p>[engine] Add EnvVarMappings resource option for provider resources,
allowing environment variables to be remapped before being passed to the
provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21572">#21572</a></p>
</li>
<li>
<p>[pkg] BREAKING: Deprecate
github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of
github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This
package will be removed from pulumi/pulumi soon!
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21720">#21720</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Retry <code>yarn install</code> when it fails (e.g. during
<code>pulumi install</code>)
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21707">#21707</a></p>
</li>
<li>
<p>[engine] Deal with errors in elided journal entries correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21576">#21576</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix remote components with
PULUMI_NODEJS_SKIP_COMPONENT_INPUTS</p>
</li>
<li>
<p>[sdk/python] Fix <code>_LazyModule</code> to not trigger full module
load for introspection attributes
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21620">#21620</a></p>
</li>
<li>
<p>[sdkgen/python] Remove workaround for slow typechecking with MyPy and
PyCharm
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21722">#21722</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli] Write logfile location if verbosity is >= 1 to stderr
instead of stdout
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21663">#21663</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e8ecd95a5e"><code>e8ecd95</code></a>
Fix remote components with PULUMI_NODEJS_SKIP_COMPONENT_INPUTS (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21727">#21727</a>)</li>
<li><a
href="4c2cc2a729"><code>4c2cc2a</code></a>
upgrade pulumi-dotnet and pulumi-yaml to latest (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21764">#21764</a>)</li>
<li><a
href="8dc466ce6e"><code>8dc466c</code></a>
Always install from registry when appropriate (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21649">#21649</a>)</li>
<li><a
href="2ce415c413"><code>2ce415c</code></a>
Relax the Copyright banner linter (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21732">#21732</a>)</li>
<li><a
href="5d49339b03"><code>5d49339</code></a>
Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21758">#21758</a>)</li>
<li><a
href="dbcad3b0ba"><code>dbcad3b</code></a>
Remap environment variables as a resource option on Provider (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21572">#21572</a>)</li>
<li><a
href="f5dc5a3fff"><code>f5dc5a3</code></a>
print and save environment variables on snapshot integrity errors (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21709">#21709</a>)</li>
<li><a
href="82d584e2d4"><code>82d584e</code></a>
Fix proto build: Update Node.js installation to use modern keyring (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21729">#21729</a>)</li>
<li><a
href="f8aaed4083"><code>f8aaed4</code></a>
Deprecate <code>github.com/pulumi/pulumi/pkg/v3/codegen/dotnet</code>
& remove tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/2">#2</a>...</li>
<li><a
href="3392d063db"><code>3392d06</code></a>
Remove workaround for slow typechecking with MyPy and PyCharm (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21722">#21722</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR bumps prod to v1.4.1
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.217.1 to 3.218.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.218.0</h2>
<h2>3.218.0 (2026-01-29)</h2>
<h3>Features</h3>
<ul>
<li>[sdk/nodejs] Add support for the <code>OnError</code> resource
hook</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Allow positional arguments to be passed to <code>convert</code>
again</p>
</li>
<li>
<p>[cli/install] Correctly include git forge organizations as schema
namespaces when generating SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21579">#21579</a></p>
</li>
<li>
<p>[cli/{install,package}] Correctly grab package names for Python &
NodeJS
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21577">#21577</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.218.0 (2026-01-29)</h2>
<h3>Features</h3>
<ul>
<li>[sdk/nodejs] Add support for the <code>OnError</code> resource
hook</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Allow positional arguments to be passed to <code>convert</code>
again</p>
</li>
<li>
<p>[cli/install] Correctly include git forge organizations as schema
namespaces when generating SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21579">#21579</a></p>
</li>
<li>
<p>[cli/{install,package}] Correctly grab package names for Python &
NodeJS
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21577">#21577</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="da9b84347b"><code>da9b843</code></a>
Unrestrict arguments to <code>convert</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21603">#21603</a>)</li>
<li><a
href="d94b6a69e2"><code>d94b6a6</code></a>
OnError support for NodeJS SDK (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21568">#21568</a>)</li>
<li><a
href="6ae181792f"><code>6ae1817</code></a>
expand exclusion rule for RefreshV2 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21591">#21591</a>)</li>
<li><a
href="e885bf3653"><code>e885bf3</code></a>
fuzzing: print full test case to stdout in CI (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21601">#21601</a>)</li>
<li><a
href="059066063e"><code>0590660</code></a>
Argument specifications for state commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21590">#21590</a>)</li>
<li><a
href="d186b46c6f"><code>d186b46</code></a>
Check the interaction between <code>replaceWith</code> and
<code>deletedWith</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21584">#21584</a>)</li>
<li><a
href="9074f6b351"><code>9074f6b</code></a>
Argument specifications for Pulumi CLI stack commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21589">#21589</a>)</li>
<li><a
href="16ad3edd5a"><code>16ad3ed</code></a>
Bump language runtimes for dotnet, java, and yaml (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21597">#21597</a>)</li>
<li><a
href="5b2e34bcd4"><code>5b2e34b</code></a>
Argument specifications for Pulumi Cloud commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21587">#21587</a>)</li>
<li><a
href="aed72b3e76"><code>aed72b3</code></a>
Argument specifications for Pulumi deployment commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21588">#21588</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.217.1...v3.218.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.214.0 to 3.215.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.215.0</h2>
<h2>3.215.0 (2026-01-07)</h2>
<h3>Features</h3>
<ul>
<li>[cli/plugin] Allow plugins to specify a supported version range for
the CLI
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21335">#21335</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Filter internal properties like __defaults from diff display
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21359">#21359</a></p>
</li>
<li>
<p>[cli/config] Make <code>config set --type bool</code> accept
different spellings of boolean values instead of only lowercase
"true"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21314">#21314</a></p>
</li>
<li>
<p>[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21373">#21373</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[cli] Update pulumi-dotnet to 3.96.1</p>
</li>
<li>
<p>[cli/package] Remove superfluous version string
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21351">#21351</a></p>
</li>
</ul>
<h2>v3.214.1</h2>
<h2>3.214.1 (2026-01-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/package] Preserve existing behavior when <code>pulumi package
add</code> is used with a local provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21350">#21350</a></p>
</li>
<li>
<p>[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21325">#21325</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.215.0 (2026-01-07)</h2>
<h3>Features</h3>
<ul>
<li>[cli/plugin] Allow plugins to specify a supported version range for
the CLI
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21335">#21335</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Filter internal properties like __defaults from diff display
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21359">#21359</a></p>
</li>
<li>
<p>[cli/config] Make <code>config set --type bool</code> accept
different spellings of boolean values instead of only lowercase
"true"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21314">#21314</a></p>
</li>
<li>
<p>[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21373">#21373</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[cli] Update pulumi-dotnet to 3.96.1</p>
</li>
<li>
<p>[cli/package] Remove superfluous version string
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21351">#21351</a></p>
</li>
</ul>
<h2>3.214.1 (2026-01-03)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/package] Preserve existing behavior when <code>pulumi package
add</code> is used with a local provider
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21350">#21350</a></p>
</li>
<li>
<p>[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21325">#21325</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2ff3425c8f"><code>2ff3425</code></a>
Update pulumi-dotnet to 3.96.1 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21382">#21382</a>)</li>
<li><a
href="628bf0b636"><code>628bf0b</code></a>
fuzzing: expand targeted dependency rule (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21380">#21380</a>)</li>
<li><a
href="2f90313e05"><code>2f90313</code></a>
fix: Insert <code>--stack</code> before <code>--</code> separator in
<code>_run_pulumi_cmd_sync</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21373">#21373</a>)</li>
<li><a
href="137b72ba9f"><code>137b72b</code></a>
Use unittest.IsolatedAsyncioTestCase (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21376">#21376</a>)</li>
<li><a
href="6d92edd52e"><code>6d92edd</code></a>
Allow plugins to set supported CLI versions (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21335">#21335</a>)</li>
<li><a
href="3d12eb1182"><code>3d12eb1</code></a>
Always use <code>packageresolution.Resolve</code> for resource plugin
downloads (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21317">#21317</a>)</li>
<li><a
href="54b8cd9884"><code>54b8cd9</code></a>
Filter internal properties from diff display (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21359">#21359</a>)</li>
<li><a
href="0d3bb719fe"><code>0d3bb71</code></a>
Fix python test coverage (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21365">#21365</a>)</li>
<li><a
href="64c53a5bc1"><code>64c53a5</code></a>
show DestroyV2 failures when parent of provider is updated (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20758">#20758</a>)</li>
<li><a
href="30cfc54973"><code>30cfc54</code></a>
Update dependency urllib3 to v2.6.2 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21360">#21360</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.214.0...v3.215.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.212.0 to 3.213.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.213.0</h2>
<h2>3.213.0 (2025-12-17)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[sdkgen/go] Generate three-level nested builtin output types for Go
SDK
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21248">#21248</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[pkg] Move plugin downloading from pkg into sdk
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21220">#21220</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b5f037ab6d"><code>b5f037a</code></a>
Bump SDK versions for 3.213.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21269">#21269</a>)</li>
<li><a
href="e317952bf1"><code>e317952</code></a>
add infrastructure to exclude known issues from fuzzing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21267">#21267</a>)</li>
<li><a
href="312929faea"><code>312929f</code></a>
Do not assert that the pulumi/templates repo contains aws-javascript (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21280">#21280</a>)</li>
<li><a
href="777230ba86"><code>777230b</code></a>
add fuzzing failures to gitignore (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21264">#21264</a>)</li>
<li><a
href="fe2c4cb31d"><code>fe2c4cb</code></a>
catch panics in the engine, and turn them into errors for fuzzing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20955">#20955</a>)</li>
<li><a
href="de5e586f87"><code>de5e586</code></a>
python auto api tests: fix flakes because of existing stacks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21265">#21265</a>)</li>
<li><a
href="6d4aa06fc3"><code>6d4aa06</code></a>
Add doc for sdk/go/pulumi-internal/ (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21263">#21263</a>)</li>
<li><a
href="a3350dac5f"><code>a3350da</code></a>
Add a backporting of type-alias of <code>workspace.PluginSpec</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21262">#21262</a>)</li>
<li><a
href="27f635e1dd"><code>27f635e</code></a>
Remove sdk/go/pulumi/internals/empty.s (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21261">#21261</a>)</li>
<li><a
href="29b4e67ea3"><code>29b4e67</code></a>
Expand <code>PackageSpec</code> allow representing a full
<code>PluginDescriptor</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21254">#21254</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.212.0...v3.213.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR ensures we don't have downtime when we are doing
rollouts during deployment/promotions.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
dependabot[bot]
Radoslav Dimitrov
Tadas Antanavicius