## Summary
- cache successful public list responses for `/v0/servers` and
`/v0.1/servers` at ingress-nginx for 30 seconds
- give only those exact cached paths a 600 RPM per-controller budget
- preserve the existing 180 RPM limit for publish, auth, mutation,
detail, and other routes
- expose `X-Registry-Cache` to make cache MISS/HIT behavior directly
observable
## Why
Production ingress logs show that the current 180 RPM per-controller
limit rejects legitimate bulk pagination before it reaches the
application. The affected traffic is overwhelmingly registry-list reads,
not publishing.
A ten-minute production sample contained 17,836 successful list
responses but only 3,188 unique URLs: 82.1% were repeated requests,
representing roughly 1 GB of duplicate response bodies. Raising the list
limit without caching would increase pressure on the application and its
shared PostgreSQL pool. The short ingress cache absorbs repeated
cursor-page reads before raising their scoped client budget.
Publish latency is a separate concern. Reducing read pressure may help
indirectly, but slow external package validation is intentionally out of
scope for this PR.
Relates to #826.
## Safety
- caching is limited to exact public GET list paths and keyed by host
plus full request URI
- only 200 responses are cached
- cache lifetime is 30 seconds; newly published entries can therefore
take up to 30 seconds to appear on a cached page
- cache locking coalesces simultaneous misses
- stale cached responses may be served while refreshing or during
transient upstream 5xx/timeouts
- each ingress replica uses at most 1 GB of ephemeral on-disk cache
## Validation
- `go test ./...` in `deploy/`
- `go vet ./...` in `deploy/`
- `git diff --check`
- ingress-nginx chart 4.13.0 in a disposable kind cluster
- generated NGINX configuration passed `nginx -t`
- repeated list request verified `X-Registry-Cache: MISS` followed by
`HIT`
- non-list route verified uncached
- exact list locations verified with the higher rate zone while the
catch-all retained 180 RPM
Nothing was applied to production during investigation or validation.
Consolidates the five open dependabot PRs into a single change so they
can be reviewed and merged together. Each bump was reproduced against
current `main` (`go get` + `go mod tidy` for Go modules; the exact SHA
pins applied for the actions group), rather than merging the individual
branches, to avoid stale `go.sum` conflicts.
## Root module (`go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `google.golang.org/grpc` | 1.82.0 | 1.82.1 | #1479 |
| `github.com/prometheus/client_golang` | 1.23.2 | 1.24.1 | #1475 |
| `github.com/danielgtaylor/huma/v2` | 2.38.0 | 2.39.0 | #1474 |
## Deploy module (`deploy/go.mod`)
| Dependency | From | To | Supersedes |
|---|---|---|---|
| `github.com/pulumi/pulumi-kubernetes/sdk/v4` | 4.32.0 | 4.33.0 | #1449
|
## GitHub Actions (#1476)
- `actions/setup-go` SHA bumped across `ci.yml`, `release.yml`,
`deploy-production.yml`, `deploy-staging.yml`
- `actions/download-artifact` v4 → v8.0.1 in
`close-invalid-publish-prs.yml`
`go mod tidy` re-resolved transitive dependencies in both modules
accordingly.
## Verification
- `go build ./...` passes (root + deploy)
- `go vet ./...` passes
- `govulncheck ./...` reports no `golang.org/x/text` finding (the
GO-2026-5970 fix from #1481 is preserved; tidy pulled x/text to v0.40.0)
## Follow-up
Once this merges, the five superseded PRs (#1479, #1475, #1474, #1449,
#1476) can be closed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.81.1 to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.82.1</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from the connection when flooded by HTTP/2
frames. The default value for this limit is 100 frames, excluding DATA
and HEADERS, and may be changed by setting environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
</ul>
<h2>Release 1.82.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>server: Remove support for
<code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code>
environment varibale. Strict incoming RPC path validation (which has
been the default since <code>v1.79.3</code>) can no longer be disabled.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li>
<li>transport: Add environment variable to change the default max header
list size from <code>16MB</code> to <code>8KB</code>. This may be
enabled by setting
<code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>.
This will be enabled by default in a subsequent release. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li>
<li>balancer: Load Balancing policy registry is now case-sensitive. Set
<code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code>
(and file an issue) to revert to case-insensitive behavior. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Expose a new API,
<code>NewContextWithLabelCallback</code>, to register a callback that is
invoked when telemetry labels are added. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/seth-epps"><code>@seth-epps</code></a></li>
</ul>
</li>
<li>client: Return a portion of the response body in the error message,
when the client receives an unexpected non-gRPC HTTP response, to make
debugging easier. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/chengxilo"><code>@chengxilo</code></a></li>
</ul>
</li>
<li>server: Add environment variable
<code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting
<code>runtime/pprof.Labels</code> on goroutines spawned by the server.
Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add
the <code>grpc.method</code> label on goroutines spawned to handle
incoming requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/dfinkel"><code>@dfinkel</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds/server: Fix a memory leak of HTTP filter instances occurring
when route configurations are updated in-place during a Route Discovery
Service (RDS) update. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li>
<li>grpc: In the deprecated <code>gzip</code> Compressor (used via the
deprecated <code>WithCompressor</code> dial option), enforce the
<code>MaxRecvMsgSize</code> limit on the decompressed message buffer,
preventing excessive memory allocation from highly compressed payloads.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/evilgensec"><code>@evilgensec</code></a></li>
</ul>
</li>
<li>stats/opentelemetry: Record retry attempts,
<code>grpc.previous-rpc-attempts</code>, at the call level and not the
attempt level. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li>
<li>encoding: Ensure <code>Close()</code> is always called on readers
returned from <code>Compressor.Decompress</code> if possible. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li>
<li>channelz: Fix the <code>LastMessageSentTimestamp</code> and
<code>LastMessageReceivedTimestamp</code> fields in
<code>SocketMetrics</code> to ensure they contain correct timestamp
values. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="ebd8f06a09"><code>ebd8f06</code></a>
Change version to 1.82.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li>
<li><a
href="4ea465d4ab"><code>4ea465d</code></a>
Cherry-pick commits (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li>
<li><a
href="9494a2cf32"><code>9494a2c</code></a>
Change version to 1.82.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li>
<li><a
href="bd239854f0"><code>bd23985</code></a>
Change version to 1.82.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li>
<li><a
href="0f3086db7a"><code>0f3086d</code></a>
Fix minor issues not covered by PR <a
href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li>
<li><a
href="fef07fbb2b"><code>fef07fb</code></a>
internal: Split v3procservicepb import into pb and grpc for extproc (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li>
<li><a
href="91dd64f4b8"><code>91dd64f</code></a>
transport: surface subsequent data when receiving non-gRPC header (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li>
<li><a
href="adc97de952"><code>adc97de</code></a>
test/kokoro: add config for regional-td test (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li>
<li><a
href="57c9ff14e0"><code>57c9ff1</code></a>
xds: ensure full-string matching for RBAC Filter rules (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li>
<li><a
href="b58f32d9ff"><code>b58f32d</code></a>
server: Set a pprof label on new stream goroutines (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.251.0 to 3.253.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.253.0</h2>
<h2>3.253.0 (2026-07-14)</h2>
<h3>Features</h3>
<ul>
<li>[auto/go] Support --import-pending-creates for refresh command in Go
Automation API for preview refresh and refresh operations <a
href="https://redirect.github.com/pulumi/pulumi/pull/23833">#23833</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdk] Precompose filenames to NFC on macOS when matching ignore
patterns during archive creation, mirroring git's core.precomposeunicode
so composed patterns match decomposed filenames <a
href="https://redirect.github.com/pulumi/pulumi/pull/23566">#23566</a></li>
<li>[cli] Respect the -v log level again so that without -v only
warnings and errors are written to stderr <a
href="https://redirect.github.com/pulumi/pulumi/pull/23910">#23910</a></li>
<li>[codegen] Correctly generate provider resources declared inside PCL
components for Node.js, Python and Go <a
href="https://redirect.github.com/pulumi/pulumi/pull/23904">#23904</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli] Add a <code>--version</code> flag to the <code>pulumi</code>
command that prints the version, same as <code>pulumi version</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23898">#23898</a></li>
<li>[cli] Align <code>env</code> commands with the CLI naming
guidelines, making <code>list</code>, <code>remove</code> and
<code>move</code> the canonical names with <code>ls</code>,
<code>rm</code>, <code>delete</code> and <code>mv</code> kept as aliases
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23901">#23901</a></li>
</ul>
<h2>v3.252.0</h2>
<h2>3.252.0 (2026-07-13)</h2>
<h3>Features</h3>
<ul>
<li>[auto] Add <code>import</code> to the generated automation APIs for
NodeJS, Python and Go <a
href="https://redirect.github.com/pulumi/pulumi/pull/23876">#23876</a></li>
<li>[cli] Improve the error message when using Pulumi ESC with a DIY
backend to suggest logging into Pulumi Cloud <a
href="https://redirect.github.com/pulumi/pulumi/pull/23811">#23811</a></li>
<li>[cli] Show command name for cli commands when running any command
that lists logs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23889">#23889</a></li>
<li>[cli/display] Render strings containing non-UTF8 bytes as
b"<!-- raw HTML omitted -->" in diffs and JSON output <a
href="https://redirect.github.com/pulumi/pulumi/pull/23870">#23870</a></li>
<li>[cli/env] Add a <code>--reason</code> flag to <code>pulumi env
open-request</code> to explain the request to approvers <a
href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li>
<li>[cli/state] Improve the error message when a resource URN is not
found in the state for <code>pulumi state</code> commands, suggesting
close-matching URNs and how to list the URNs in the stack <a
href="https://redirect.github.com/pulumi/pulumi/pull/23812">#23812</a></li>
<li>[pcl] Allow binding hooks to a resource's <code>onError</code>
option <a
href="https://redirect.github.com/pulumi/pulumi/pull/23838">#23838</a></li>
<li>[sdk/nodejs] Add a <code>production</code> runtime option for
Node.js projects. When set to <code>true</code> in
<code>Pulumi.yaml</code>, <code>pulumi install</code> skips
<code>devDependencies</code> (npm <code>--production</code>, pnpm
<code>--production</code>, yarn <code>--production</code>). <a
href="https://redirect.github.com/pulumi/pulumi/pull/23849">#23849</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[cli] Exit with a non-zero code when a command group such as
<code>pulumi env</code> is given an unknown subcommand or no subcommand
at all <a
href="https://redirect.github.com/pulumi/pulumi/pull/23814">#23814</a></li>
<li>[cli] Fix a panic when displaying a stack-level policy violation <a
href="https://redirect.github.com/pulumi/pulumi/pull/23692">#23692</a></li>
<li>[cli] Make reading non-secret stack outputs and running <code>pulumi
about</code> no longer require the passphrase for passphrase-encrypted
stacks <a
href="https://redirect.github.com/pulumi/pulumi/pull/23820">#23820</a></li>
<li>[cli] Avoid <code>pulumi logs <command></code> showing the log
for the currently running command <a
href="https://redirect.github.com/pulumi/pulumi/pull/23887">#23887</a></li>
<li>[cli/do] Fix calling delete on PF resources that need read called
first <a
href="https://redirect.github.com/pulumi/pulumi/pull/23837">#23837</a></li>
<li>[cli/env] Submit the change request created by <code>pulumi env
open-request</code> so it is pending approval instead of being left as
an unsubmitted draft <a
href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li>
<li>[cli/neo] Fix the initial prompt sometimes rendering above the
welcome banner in <code>pulumi neo</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23831">#23831</a></li>
<li>[engine] Fix importing a resource whose import identifier differs
from its canonical ID causes the resource to be deleted on a subsequent
update <a
href="https://redirect.github.com/pulumi/pulumi/pull/23834">#23834</a></li>
<li>[programgen] Deduplicate identical apply arguments to avoid
unnecessary Promise.all/pulumi.all/Output.All in generated code <a
href="https://redirect.github.com/pulumi/pulumi/pull/22293">#22293</a></li>
<li>[sdk] Failed resource registrations will return faulted outputs, not
unknown outputs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23844">#23844</a></li>
<li>[sdk/nodejs] Fix empty node_modules folders in serialized function
archives when using pnpm or symlinked workspace packages <a
href="https://redirect.github.com/pulumi/pulumi/pull/23866">#23866</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Report the TypeScript version in <code>pulumi
about</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23850">#23850</a></li>
<li>[sdk/nodejs] Update OpenTelemetry dependencies <a
href="https://redirect.github.com/pulumi/pulumi/pull/23855">#23855</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.253.0 (2026-07-14)</h2>
<h3>Features</h3>
<ul>
<li>[auto/go] Support --import-pending-creates for refresh command in Go
Automation API for preview refresh and refresh operations <a
href="https://redirect.github.com/pulumi/pulumi/pull/23833">#23833</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdk] Precompose filenames to NFC on macOS when matching ignore
patterns during archive creation, mirroring git's core.precomposeunicode
so composed patterns match decomposed filenames <a
href="https://redirect.github.com/pulumi/pulumi/pull/23566">#23566</a></li>
<li>[cli] Respect the -v log level again so that without -v only
warnings and errors are written to stderr <a
href="https://redirect.github.com/pulumi/pulumi/pull/23910">#23910</a></li>
<li>[codegen] Correctly generate provider resources declared inside PCL
components for Node.js, Python and Go <a
href="https://redirect.github.com/pulumi/pulumi/pull/23904">#23904</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli] Add a <code>--version</code> flag to the <code>pulumi</code>
command that prints the version, same as <code>pulumi version</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23898">#23898</a></li>
<li>[cli] Align <code>env</code> commands with the CLI naming
guidelines, making <code>list</code>, <code>remove</code> and
<code>move</code> the canonical names with <code>ls</code>,
<code>rm</code>, <code>delete</code> and <code>mv</code> kept as aliases
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23901">#23901</a></li>
</ul>
<h2>3.252.0 (2026-07-13)</h2>
<h3>Features</h3>
<ul>
<li>[auto] Add <code>import</code> to the generated automation APIs for
NodeJS, Python and Go <a
href="https://redirect.github.com/pulumi/pulumi/pull/23876">#23876</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[cli] Exit with a non-zero code when a command group such as
<code>pulumi env</code> is given an unknown subcommand or no subcommand
at all <a
href="https://redirect.github.com/pulumi/pulumi/pull/23814">#23814</a></li>
<li>[cli] Fix a panic when displaying a stack-level policy violation <a
href="https://redirect.github.com/pulumi/pulumi/pull/23692">#23692</a></li>
<li>[cli] Make reading non-secret stack outputs and running <code>pulumi
about</code> no longer require the passphrase for passphrase-encrypted
stacks <a
href="https://redirect.github.com/pulumi/pulumi/pull/23820">#23820</a></li>
<li>[cli] Avoid <code>pulumi logs <command></code> showing the log
for the currently running command <a
href="https://redirect.github.com/pulumi/pulumi/pull/23887">#23887</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli] Improve the error message when using Pulumi ESC with a DIY
backend to suggest logging into Pulumi Cloud <a
href="https://redirect.github.com/pulumi/pulumi/pull/23811">#23811</a></li>
<li>[cli] Show command name for cli commands when running any command
that lists logs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23889">#23889</a></li>
<li>[cli/display] Render strings containing non-UTF8 bytes as
b"<!-- raw HTML omitted -->" in diffs and JSON output <a
href="https://redirect.github.com/pulumi/pulumi/pull/23870">#23870</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[cli/do] Fix calling delete on PF resources that need read called
first <a
href="https://redirect.github.com/pulumi/pulumi/pull/23837">#23837</a></li>
<li>[cli/env] Submit the change request created by <code>pulumi env
open-request</code> so it is pending approval instead of being left as
an unsubmitted draft <a
href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli/env] Add a <code>--reason</code> flag to <code>pulumi env
open-request</code> to explain the request to approvers <a
href="https://redirect.github.com/pulumi/pulumi/pull/23802">#23802</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[cli/neo] Fix the initial prompt sometimes rendering above the
welcome banner in <code>pulumi neo</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23831">#23831</a></li>
</ul>
<h3>Improvements</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="94536e530d"><code>94536e5</code></a>
Update first-party Pulumi dependencies (major) (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23913">#23913</a>)</li>
<li><a
href="435c4f36ae"><code>435c4f3</code></a>
Align env commands with the CLI command guidelines (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23901">#23901</a>)</li>
<li><a
href="da11b64f0d"><code>da11b64</code></a>
Add a --version flag to the pulumi command (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23898">#23898</a>)</li>
<li><a
href="03bf3a8cbf"><code>03bf3a8</code></a>
Rename rawStringBytesDisplay to byteStringDisplay (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23909">#23909</a>)</li>
<li><a
href="3344335970"><code>3344335</code></a>
Bump HCL to 0.10.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23890">#23890</a>)</li>
<li><a
href="deb8acfde3"><code>deb8acf</code></a>
Support import pending creates parameter (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23833">#23833</a>)</li>
<li><a
href="54158aeba8"><code>54158ae</code></a>
Precompose filenames to NFC on macOS when matching archive ignore
patterns (#...</li>
<li><a
href="93f6e51d9b"><code>93f6e51</code></a>
logging: fix -v=<n> output (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23910">#23910</a>)</li>
<li><a
href="d8e98e7ccd"><code>d8e98e7</code></a>
Update first-party Pulumi dependencies (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23912">#23912</a>)</li>
<li><a
href="f669f791c5"><code>f669f79</code></a>
Add conformance test for using a provider in a component (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23904">#23904</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.251.0...v3.253.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Promotes production to the
[`v1.8.0`](https://github.com/modelcontextprotocol/registry/releases/tag/v1.8.0)
release.
- `deploy/Pulumi.gcpProd.yaml` → `imageTag: 1.8.0` (one line).
- The release build for `v1.8.0` completed successfully, so the image is
present in ghcr.
- **Merging this triggers `deploy-production.yml`** (it's path-filtered
to `deploy/Pulumi.gcpProd.yaml`); the PR itself doesn't deploy.
### Notable behavior changes in v1.8.0
- **Org-namespace publishing now requires org Owner** (via GitHub login
/ PAT). Member-level publishers lose org publish — intended tightening.
- Stricter validation may reject some previously-accepted package
metadata / names (#1310, #1331, #1411).
- New: cargo (crates.io) package registry support (#1207).
### After merge
- Confirm prod `/v0/version` reports `1.8.0` before treating the rollout
as done.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.248.0 to 3.251.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.251.0</h2>
<h2>3.251.0 (2026-07-08)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[cli] Show a <code>retain</code> marker for retain-on-delete
resources in <code>--diff</code> output <a
href="https://redirect.github.com/pulumi/pulumi/pull/23754">#23754</a></li>
<li>[cli] Don't miscopy out archives <a
href="https://redirect.github.com/pulumi/pulumi/pull/23798">#23798</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli] Add <code>pulumi neo --debug-update</code> and <code>pulumi
neo --debug-preview</code> flags to investigate a failed update or
preview, suggested in the failure output <a
href="https://redirect.github.com/pulumi/pulumi/pull/23499">#23499</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli/convert] Add an <code>ecosystem</code> field to converter
mapping requests so a converter can request mappings for the ecosystem
it consumes rather than its own name <a
href="https://redirect.github.com/pulumi/pulumi/pull/23804">#23804</a></li>
<li>[cli/deployment] <code>pulumi deployment settings</code> no longer
writes the local <code>Pulumi.<stack>.deploy.yaml</code> file: the
experimental <code>init</code>, <code>pull</code>,
<code>configure</code>, and <code>env</code> subcommands have been
removed, and the CLI no longer calls the deployment-settings encrypt
endpoint. <code>get</code>/<code>edit</code>/<code>destroy</code>
continue to manage settings directly in Pulumi Cloud <a
href="https://redirect.github.com/pulumi/pulumi/pull/23480">#23480</a></li>
<li>[cli/deployment] The deployment settings file
(<code>Pulumi.<stack>.deploy.yaml</code>) has been removed
entirely. The experimental <code>pulumi deployment settings push</code>
(<code>update</code>/<code>up</code>) command, the
<code>--config-file</code> flag, and the SDK helpers that read the file
have been removed. Manage deployment settings directly in Pulumi Cloud
with <code>pulumi deployment settings get</code>, <code>edit</code>, and
<code>destroy</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23480">#23480</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[cli/display] Prevent plugin debug logs from appearing as raw JSON
in the CLI's output when logging with <code>--logtostderr</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23633">#23633</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli/env] Report the new revision number when an environment
definition is updated (e.g. <code>pulumi env edit</code>, <code>pulumi
env provider</code>, <code>pulumi env version rollback</code>) <a
href="https://redirect.github.com/pulumi/pulumi/pull/23799">#23799</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli/env] Fold the Pulumi ESC engine and CLI into the pulumi/pulumi
monorepo, removing the sdk↔esc Go module cycle. Internal refactor with
no user-facing behavior change; <code>pulumi env</code>/<code>pulumi
esc</code> are unaffected. <a
href="https://redirect.github.com/pulumi/pulumi/pull/23746">#23746</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli/import] Support importing resources under parameterized
providers from a converter or import file <a
href="https://redirect.github.com/pulumi/pulumi/pull/23763">#23763</a></li>
<li>[cli/import] Support importing resources under
extension-parameterized providers <a
href="https://redirect.github.com/pulumi/pulumi/pull/23779">#23779</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[engine] Add <code>TargetSnippets</code> to deployment options to
target snippets by UUID. <a
href="https://redirect.github.com/pulumi/pulumi/pull/23745">#23745</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[engine] Add OpenTelemetry spans to the StackReference read path so
performance traces can pinpoint slow snapshot fetches, deserialization,
or secret decryption <a
href="https://redirect.github.com/pulumi/pulumi/pull/23787">#23787</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[programgen/pcl] Invoke functions declared with multi-argument
inputs using positional arguments in PCL <a
href="https://redirect.github.com/pulumi/pulumi/pull/23571">#23571</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdk/nodejs] Don't include the version in module paths when
serializing functions when using pnpm <a
href="https://redirect.github.com/pulumi/pulumi/pull/23767">#23767</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.251.0 (2026-07-08)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[cli] Show a <code>retain</code> marker for retain-on-delete
resources in <code>--diff</code> output <a
href="https://redirect.github.com/pulumi/pulumi/pull/23754">#23754</a></li>
<li>[cli] Don't miscopy out archives <a
href="https://redirect.github.com/pulumi/pulumi/pull/23798">#23798</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli] Add <code>pulumi neo --debug-update</code> and <code>pulumi
neo --debug-preview</code> flags to investigate a failed update or
preview, suggested in the failure output <a
href="https://redirect.github.com/pulumi/pulumi/pull/23499">#23499</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli/convert] Add an <code>ecosystem</code> field to converter
mapping requests so a converter can request mappings for the ecosystem
it consumes rather than its own name <a
href="https://redirect.github.com/pulumi/pulumi/pull/23804">#23804</a></li>
<li>[cli/deployment] <code>pulumi deployment settings</code> no longer
writes the local <code>Pulumi.<stack>.deploy.yaml</code> file: the
experimental <code>init</code>, <code>pull</code>,
<code>configure</code>, and <code>env</code> subcommands have been
removed, and the CLI no longer calls the deployment-settings encrypt
endpoint. <code>get</code>/<code>edit</code>/<code>destroy</code>
continue to manage settings directly in Pulumi Cloud <a
href="https://redirect.github.com/pulumi/pulumi/pull/23480">#23480</a></li>
<li>[cli/deployment] The deployment settings file
(<code>Pulumi.<stack>.deploy.yaml</code>) has been removed
entirely. The experimental <code>pulumi deployment settings push</code>
(<code>update</code>/<code>up</code>) command, the
<code>--config-file</code> flag, and the SDK helpers that read the file
have been removed. Manage deployment settings directly in Pulumi Cloud
with <code>pulumi deployment settings get</code>, <code>edit</code>, and
<code>destroy</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23480">#23480</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[cli/display] Prevent plugin debug logs from appearing as raw JSON
in the CLI's output when logging with <code>--logtostderr</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23633">#23633</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli/env] Report the new revision number when an environment
definition is updated (e.g. <code>pulumi env edit</code>, <code>pulumi
env provider</code>, <code>pulumi env version rollback</code>) <a
href="https://redirect.github.com/pulumi/pulumi/pull/23799">#23799</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[cli/env] Fold the Pulumi ESC engine and CLI into the pulumi/pulumi
monorepo, removing the sdk↔esc Go module cycle. Internal refactor with
no user-facing behavior change; <code>pulumi env</code>/<code>pulumi
esc</code> are unaffected. <a
href="https://redirect.github.com/pulumi/pulumi/pull/23746">#23746</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli/import] Support importing resources under parameterized
providers from a converter or import file <a
href="https://redirect.github.com/pulumi/pulumi/pull/23763">#23763</a></li>
<li>[cli/import] Support importing resources under
extension-parameterized providers <a
href="https://redirect.github.com/pulumi/pulumi/pull/23779">#23779</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[engine] Add <code>TargetSnippets</code> to deployment options to
target snippets by UUID. <a
href="https://redirect.github.com/pulumi/pulumi/pull/23745">#23745</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[engine] Add OpenTelemetry spans to the StackReference read path so
performance traces can pinpoint slow snapshot fetches, deserialization,
or secret decryption <a
href="https://redirect.github.com/pulumi/pulumi/pull/23787">#23787</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[programgen/pcl] Invoke functions declared with multi-argument
inputs using positional arguments in PCL <a
href="https://redirect.github.com/pulumi/pulumi/pull/23571">#23571</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdk/nodejs] Don't include the version in module paths when
serializing functions when using pnpm <a
href="https://redirect.github.com/pulumi/pulumi/pull/23767">#23767</a></li>
<li>[sdk/nodejs] Support pnpm 11 <a
href="https://redirect.github.com/pulumi/pulumi/pull/23815">#23815</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="aff0ffa2cc"><code>aff0ffa</code></a>
do: fix <code>--dry-run</code> for delete (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23809">#23809</a>)</li>
<li><a
href="c9a87908cd"><code>c9a8790</code></a>
Add pulumi neo debug command (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23499">#23499</a>)</li>
<li><a
href="4a79549ecd"><code>4a79549</code></a>
Invoke multi-argument-input functions positionally in PCL (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23571">#23571</a>)</li>
<li><a
href="3212152920"><code>3212152</code></a>
do: make default input YAML (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23808">#23808</a>)</li>
<li><a
href="93ab9680c5"><code>93ab968</code></a>
Add an ecosystem to converter mapping requests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23804">#23804</a>)</li>
<li><a
href="82c4164562"><code>82c4164</code></a>
do: align prompting with up/destroy (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23805">#23805</a>)</li>
<li><a
href="3ec25324d4"><code>3ec2532</code></a>
Update actions/download-artifact action to v8 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23793">#23793</a>)</li>
<li><a
href="5e1b1d0903"><code>5e1b1d0</code></a>
Add more tracing spans around stack references (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23787">#23787</a>)</li>
<li><a
href="45b7ec7e17"><code>45b7ec7</code></a>
do: improve usage section (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23782">#23782</a>)</li>
<li><a
href="54b4e80e49"><code>54b4e80</code></a>
Don't include the version in module paths when serializing functions
when usi...</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.248.0...v3.251.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.244.0 to 3.248.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.248.0</h2>
<h2>3.248.0 (2026-06-24)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[cli] Fix a panic in <code>pulumi package get-schema</code> when
binding a schema that references an uninstalled plugin <a
href="https://redirect.github.com/pulumi/pulumi/pull/23647">#23647</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli] Add options to <code>pulumi stack get</code> for parity with
bare <code>pulumi stack</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23623">#23623</a></li>
<li>[cli] Add <code>--output</code> flag to about and whoami commands <a
href="https://redirect.github.com/pulumi/pulumi/pull/23651">#23651</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[engine] Add support for 'snippets', blocks of PCL kept in state to
track ad-hoc resources <a
href="https://redirect.github.com/pulumi/pulumi/pull/23286">#23286</a></li>
<li>[engine] Send the address of a schema loader service to resource
providers as part of the provider handshake <a
href="https://redirect.github.com/pulumi/pulumi/pull/23645">#23645</a></li>
<li>[engine] Send the address of a package resolver service to resource
providers as part of the provider handshake <a
href="https://redirect.github.com/pulumi/pulumi/pull/23654">#23654</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[programgen] Guard references to conditionally-created (boolean
<code>range</code>) resources in generated Python and NodeJS programs so
they type-check <a
href="https://redirect.github.com/pulumi/pulumi/pull/23634">#23634</a></li>
<li>[programgen] Generate map <code>range</code> resource collections as
key-indexed maps in Python and NodeJS so they can be indexed by key <a
href="https://redirect.github.com/pulumi/pulumi/pull/23639">#23639</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[sdk/nodejs] Add <code>Output.recover</code> to catch and recover
from exceptions in outputs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23642">#23642</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdkgen] Fix extra trailing new lines in comments <a
href="https://redirect.github.com/pulumi/pulumi/pull/23619">#23619</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[sdkgen] Require callers to pass an explicit schema loader when
binding PCL programs and package schemas <a
href="https://redirect.github.com/pulumi/pulumi/pull/23672">#23672</a></li>
</ul>
<h2>v3.247.0</h2>
<h2>3.247.0 (2026-06-18)</h2>
<h3>Features</h3>
<ul>
<li>[cli/config] Add --raw flag to <code>pulumi config set</code> to
avoid stripping newlines when input is piped through stdin <a
href="https://redirect.github.com/pulumi/pulumi/pull/23593">#23593</a></li>
<li>[cli/do] Add <code>--provider</code> flag to pull provider config to
use from existing provider state <a
href="https://redirect.github.com/pulumi/pulumi/pull/23560">#23560</a></li>
<li>[cli/engine] Resource providers now receive the active login's API
address and access token through PULUMI_API and PULUMI_ACCESS_TOKEN <a
href="https://redirect.github.com/pulumi/pulumi/pull/23589">#23589</a></li>
<li>[cli/neo] Add a <code>--disable-integrations</code> flag to
<code>pulumi neo</code> that runs the task with no integration
credentials <a
href="https://redirect.github.com/pulumi/pulumi/pull/23531">#23531</a></li>
<li>[engine] Send the address of a mapper service to resource providers
as part of the provider handshake</li>
<li>[programgen/go] Support functions with multiArgumentInputs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23554">#23554</a></li>
<li>[programgen/python] Support functions with multiArgumentInputs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23574">#23574</a></li>
<li>[sdk/nodejs] Registered resources can now be retrieved from the mock
monitor for test assertions <a
href="https://redirect.github.com/pulumi/pulumi/pull/20539">#20539</a></li>
<li>[sdk/python] Add <code>Output.recover</code> to catch and recover
from exceptions in outputs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23591">#23591</a></li>
<li>[sdkgen] Adds support for language agnostic cross references in
schemas. Use the form <code>{{% ref <target> %}}</code> to
reference other schema components in markdown descriptions. Such as `{{%
ref <a
href="https://redirect.github.com/pulumi/pulumi/pull/21369">#21369</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.248.0 (2026-06-24)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[cli] Fix a panic in <code>pulumi package get-schema</code> when
binding a schema that references an uninstalled plugin <a
href="https://redirect.github.com/pulumi/pulumi/pull/23647">#23647</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli] Add options to <code>pulumi stack get</code> for parity with
bare <code>pulumi stack</code> <a
href="https://redirect.github.com/pulumi/pulumi/pull/23623">#23623</a></li>
<li>[cli] Add <code>--output</code> flag to about and whoami commands <a
href="https://redirect.github.com/pulumi/pulumi/pull/23651">#23651</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[engine] Add support for 'snippets', blocks of PCL kept in state to
track ad-hoc resources <a
href="https://redirect.github.com/pulumi/pulumi/pull/23286">#23286</a></li>
<li>[engine] Send the address of a schema loader service to resource
providers as part of the provider handshake <a
href="https://redirect.github.com/pulumi/pulumi/pull/23645">#23645</a></li>
<li>[engine] Send the address of a package resolver service to resource
providers as part of the provider handshake <a
href="https://redirect.github.com/pulumi/pulumi/pull/23654">#23654</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[programgen] Guard references to conditionally-created (boolean
<code>range</code>) resources in generated Python and NodeJS programs so
they type-check <a
href="https://redirect.github.com/pulumi/pulumi/pull/23634">#23634</a></li>
<li>[programgen] Generate map <code>range</code> resource collections as
key-indexed maps in Python and NodeJS so they can be indexed by key <a
href="https://redirect.github.com/pulumi/pulumi/pull/23639">#23639</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[sdk/nodejs] Add <code>Output.recover</code> to catch and recover
from exceptions in outputs <a
href="https://redirect.github.com/pulumi/pulumi/pull/23642">#23642</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdkgen] Fix extra trailing new lines in comments <a
href="https://redirect.github.com/pulumi/pulumi/pull/23619">#23619</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[sdkgen] Require callers to pass an explicit schema loader when
binding PCL programs and package schemas <a
href="https://redirect.github.com/pulumi/pulumi/pull/23672">#23672</a></li>
</ul>
<h2>3.247.0 (2026-06-18)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[cli] Ensure <code>pulumi logout</code> clears the current tokenless
backend in coding agent environments <a
href="https://redirect.github.com/pulumi/pulumi/pull/23540">#23540</a></li>
<li>[cli] Read Git metadata correctly in repositories that enable the
worktreeConfig extension, such as those hosted on Azure DevOps <a
href="https://redirect.github.com/pulumi/pulumi/pull/23535">#23535</a></li>
</ul>
<h3>Improvements</h3>
<ul>
<li>[cli] Respect PULUMI_SKIP_CONFIRMATIONS whenever we ask for
confirmation <a
href="https://redirect.github.com/pulumi/pulumi/pull/23607">#23607</a></li>
<li>[cli] Use list and remove as the canonical names for list/remove
commands, with ls and rm as aliases <a
href="https://redirect.github.com/pulumi/pulumi/pull/23608">#23608</a></li>
</ul>
<h3>Features</h3>
<ul>
<li>[cli/config] Add --raw flag to <code>pulumi config set</code> to
avoid stripping newlines when input is piped through stdin <a
href="https://redirect.github.com/pulumi/pulumi/pull/23593">#23593</a></li>
</ul>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="a88168d865"><code>a88168d</code></a>
[programgen] Generate map ranges as key-indexed collections (Python
& NodeJS)...</li>
<li><a
href="3263e4ae48"><code>3263e4a</code></a>
Bump language versions (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23685">#23685</a>)</li>
<li><a
href="a95f24c34b"><code>a95f24c</code></a>
Bump the Pulumi HCL version to 0.8.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23679">#23679</a>)</li>
<li><a
href="91f59ddad4"><code>91f59dd</code></a>
Require an explicit schema loader when binding programs and specs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23672">#23672</a>)</li>
<li><a
href="35eb97386d"><code>35eb973</code></a>
Actually set an input in TestRefreshBeforeUpdateDeletedResource (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23681">#23681</a>)</li>
<li><a
href="9fd06c1f63"><code>9fd06c1</code></a>
Send a resolver target to providers during handshake (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23654">#23654</a>)</li>
<li><a
href="10914919a6"><code>1091491</code></a>
Start changing PolicyRemediationEvent to property.Map (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23667">#23667</a>)</li>
<li><a
href="e2cca27c77"><code>e2cca27</code></a>
[programgen] Guard references to conditionally-created resources (Python
& No...</li>
<li><a
href="109f27fb39"><code>109f27f</code></a>
NodeJS recover method (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23642">#23642</a>)</li>
<li><a
href="facc18efca"><code>facc18e</code></a>
Send a loader target to providers during handshake (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23645">#23645</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.244.0...v3.248.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.238.0 to 3.242.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.242.0</h2>
<h2>3.242.0 (2026-05-19)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add a <code>pulumi</code> package for npx support</p>
</li>
<li>
<p>[cli] Add the <code>pulumi org member edit</code> command
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23235">#23235</a></p>
</li>
<li>
<p>[cli] Add the <code>pulumi org member remove</code> command
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23237">#23237</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi deployment get</code> to retrieve
details for a specific deployment
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23238">#23238</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi insights account scan get
<account> <scan-id></code> to show the full workflow run for
a single Insights scan
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23255">#23255</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi insights account scan list
<account></code> to discover recent scan IDs to feed into
<code>pulumi insights account scan log</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23255">#23255</a></p>
</li>
<li>
<p>[cli/deployment] Add dedicated flags for each deployment setting
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23236">#23236</a></p>
</li>
<li>
<p>[cli/do] Add the start of <code>pulumi do</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23176">#23176</a></p>
</li>
<li>
<p>[cli/neo] Add <code>--print</code>/<code>-p</code> to <code>pulumi
neo</code> to run a single prompt non-interactively and print the
agent's final response to stdout
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23245">#23245</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/cloud] Fix <code>pulumi insights account scan log --all</code>
to follow the server's pagination cursor through the end of the log, and
render <code>--job/--step</code> mode as structured lines instead of an
empty raw-string blob
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23256">#23256</a></p>
</li>
<li>
<p>[sdk] Close gzip.Writer in archiveTarGZIP to produce valid tar.gz
output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23240">#23240</a></p>
</li>
<li>
<p>[sdkgen/python] Fix usage of ArgsDict types in typed dictionaries
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23253">#23253</a></p>
</li>
</ul>
<h2>v3.241.0</h2>
<h2>3.241.0 (2026-05-18)</h2>
<h3>Features</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.242.0 (2026-05-19)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add a <code>pulumi</code> package for npx support</p>
</li>
<li>
<p>[cli] Add the <code>pulumi org member edit</code> command
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23235">#23235</a></p>
</li>
<li>
<p>[cli] Add the <code>pulumi org member remove</code> command
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23237">#23237</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi deployment get</code> to retrieve
details for a specific deployment
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23238">#23238</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi insights account scan get
<account> <scan-id></code> to show the full workflow run for
a single Insights scan
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23255">#23255</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi insights account scan list
<account></code> to discover recent scan IDs to feed into
<code>pulumi insights account scan log</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23255">#23255</a></p>
</li>
<li>
<p>[cli/deployment] Add dedicated flags for each deployment setting
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23236">#23236</a></p>
</li>
<li>
<p>[cli/do] Add the start of <code>pulumi do</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23176">#23176</a></p>
</li>
<li>
<p>[cli/neo] Add <code>--print</code>/<code>-p</code> to <code>pulumi
neo</code> to run a single prompt non-interactively and print the
agent's final response to stdout
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23245">#23245</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/cloud] Fix <code>pulumi insights account scan log --all</code>
to follow the server's pagination cursor through the end of the log, and
render <code>--job/--step</code> mode as structured lines instead of an
empty raw-string blob
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23256">#23256</a></p>
</li>
<li>
<p>[sdk] Close gzip.Writer in archiveTarGZIP to produce valid tar.gz
output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23240">#23240</a></p>
</li>
<li>
<p>[sdkgen/python] Fix usage of ArgsDict types in typed dictionaries
<a
href="https://redirect.github.com/pulumi/pulumi/pull/23253">#23253</a></p>
</li>
</ul>
<h2>3.241.0 (2026-05-18)</h2>
<h3>Features</h3>
<ul>
<li>[cli] Add <code>--output json</code> to <code>pulumi preview</code>
for a structured JSON summary of the operation result
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22927">#22927</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f4db8b5f55"><code>f4db8b5</code></a>
Upgrade Pulumi HCL to v0.3.2 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23261">#23261</a>)</li>
<li><a
href="cd682b849c"><code>cd682b8</code></a>
cli: add a <code>pulumi</code> package for npx support (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23145">#23145</a>)</li>
<li><a
href="e8364996b7"><code>e836499</code></a>
cli/neo: set AI_AGENT=neo for shell-tool child processes (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23251">#23251</a>)</li>
<li><a
href="2560b9015f"><code>2560b90</code></a>
unhide <code>org usage</code> command tree (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23259">#23259</a>)</li>
<li><a
href="4588160dba"><code>4588160</code></a>
unhide <code>org member</code> commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23257">#23257</a>)</li>
<li><a
href="f821c0dfc7"><code>f821c0d</code></a>
unhide <code>org role</code> commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23258">#23258</a>)</li>
<li><a
href="9356340a67"><code>9356340</code></a>
docs(contributing): minor grammar fixes (<code>PR</code> ->
<code>PRs</code>, <code>Here's</code> -> `Here are...</li>
<li><a
href="3779d16c8b"><code>3779d16</code></a>
unhide <code>org member</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23241">#23241</a>)</li>
<li><a
href="c28bf15134"><code>c28bf15</code></a>
unhide a couple <code>stack</code> commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/23243">#23243</a>)</li>
<li><a
href="90caf84946"><code>90caf84</code></a>
cli/cloud: fix <code>pulumi insights account scan log</code> pagination
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/23256">#23256</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.238.0...v3.242.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.18.0 to 5.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/go-git/go-git/v5 to v5.18.0
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2010">go-git/go-git#2010</a></li>
<li>v5: Bump sha1cd and go-billy by <a
href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2060">go-git/go-git#2060</a></li>
<li>v5: Align object encoding with upstream by <a
href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2065">go-git/go-git#2065</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bc930f4cbe"><code>bc930f4</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2065">#2065</a>
from go-git/commit-v5</li>
<li><a
href="d315264343"><code>d315264</code></a>
plumbing: object, Reset object before decode</li>
<li><a
href="6e1d34890a"><code>6e1d348</code></a>
plumbing: object, Align Tree handling with upstream</li>
<li><a
href="e134ba34cf"><code>e134ba3</code></a>
tests: Skip double checks in Git v2.11</li>
<li><a
href="1971422f6b"><code>1971422</code></a>
tests: Add git conformance tests for signing verification</li>
<li><a
href="a387aa8857"><code>a387aa8</code></a>
plumbing: object, Add ErrMalformedTag</li>
<li><a
href="f415670d90"><code>f415670</code></a>
plumbing: object, Decode Tag headers via a state machine</li>
<li><a
href="5b0cd38a62"><code>5b0cd38</code></a>
plumbing: object, Reject multi-signature commits at Verify</li>
<li><a
href="fe8ed6223a"><code>fe8ed62</code></a>
plumbing: object, Align Tag.EncodeWithoutSignature with Commit</li>
<li><a
href="98e337d5bd"><code>98e337d</code></a>
plumbing: object, Add support for Tag.SignatureSHA256</li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.236.0 to 3.237.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.237.0</h2>
<h2>3.237.0 (2026-05-08)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Include the running command name and detected AI agent (when
present) in the User-Agent header on Pulumi Cloud API requests
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22908">#22908</a></p>
</li>
<li>
<p>[engine] Include <code>result</code> on the summary engine event
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22883">#22883</a></p>
</li>
<li>
<p>[sdkgen] Eagerly error on schemas with unconstructable types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22890">#22890</a></p>
</li>
<li>
<p>[cli/cloud] Auto-fill <code>lang</code> and <code>os</code> query
parameters on <code>pulumi cloud api</code> GET/HEAD requests when the
matched OpenAPI operation declares them and the caller hasn't supplied
them
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22726">#22726</a></p>
</li>
<li>
<p>[cli/package] Add <code>pulumi package new</code> to bootstrap a
Pulumi package from a template
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22837">#22837</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Add blank-line gaps between <code>pulumi neo</code> TUI
conversation blocks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22846">#22846</a></p>
</li>
<li>
<p>[cli/import] Preserve <code>__</code>-prefixed keys when generating
PCL for imported resource state, so provider-defined payloads round-trip
correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22856">#22856</a></p>
</li>
<li>
<p>[cli/neo] Render <code>ux__ask_user</code> clarifying questions as
questions instead of approval prompts
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22862">#22862</a></p>
</li>
<li>
<p>[cli/neo] Fix a panic when cancelling a <code>pulumi neo</code>
session
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22898">#22898</a></p>
</li>
<li>
<p>[cli/neo] Render every assistant message in the TUI scrollback so
multi-turn commentary no longer disappears between tool calls</p>
</li>
<li>
<p>[cli/neo] Return the bare stack name and canonical project name from
<code>pulumi_preview</code> and <code>pulumi_up</code> tool results
instead of echoing the raw input
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22891">#22891</a></p>
</li>
<li>
<p>[codegen/pcl] Stop reporting spurious circular references when an
<code>ignoreChanges</code>, <code>hideDiffs</code>,
<code>replaceOnChanges</code>, or <code>additionalSecretOutputs</code>
entry shares a name with a top-level node
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22916">#22916</a></p>
</li>
<li>
<p>[programgen/pcl] Fix PCL binder panic when a conditional mixes a
Promise-typed branch with a try() branch
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22907">#22907</a></p>
</li>
<li>
<p>[sdk/python] Support <code>NotRequired</code>, <code>Required</code>
and <code>total=False</code> in TypedDicts for component resource arg
types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22858">#22858</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.237.0 (2026-05-08)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Include the running command name and detected AI agent (when
present) in the User-Agent header on Pulumi Cloud API requests
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22908">#22908</a></p>
</li>
<li>
<p>[engine] Include <code>result</code> on the summary engine event
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22883">#22883</a></p>
</li>
<li>
<p>[sdkgen] Eagerly error on schemas with unconstructable types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22890">#22890</a></p>
</li>
<li>
<p>[cli/cloud] Auto-fill <code>lang</code> and <code>os</code> query
parameters on <code>pulumi cloud api</code> GET/HEAD requests when the
matched OpenAPI operation declares them and the caller hasn't supplied
them
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22726">#22726</a></p>
</li>
<li>
<p>[cli/package] Add <code>pulumi package new</code> to bootstrap a
Pulumi package from a template
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22837">#22837</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli] Add blank-line gaps between <code>pulumi neo</code> TUI
conversation blocks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22846">#22846</a></p>
</li>
<li>
<p>[cli/import] Preserve <code>__</code>-prefixed keys when generating
PCL for imported resource state, so provider-defined payloads round-trip
correctly
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22856">#22856</a></p>
</li>
<li>
<p>[cli/neo] Render <code>ux__ask_user</code> clarifying questions as
questions instead of approval prompts
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22862">#22862</a></p>
</li>
<li>
<p>[cli/neo] Fix a panic when cancelling a <code>pulumi neo</code>
session
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22898">#22898</a></p>
</li>
<li>
<p>[cli/neo] Render every assistant message in the TUI scrollback so
multi-turn commentary no longer disappears between tool calls</p>
</li>
<li>
<p>[cli/neo] Return the bare stack name and canonical project name from
<code>pulumi_preview</code> and <code>pulumi_up</code> tool results
instead of echoing the raw input
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22891">#22891</a></p>
</li>
<li>
<p>[codegen/pcl] Stop reporting spurious circular references when an
<code>ignoreChanges</code>, <code>hideDiffs</code>,
<code>replaceOnChanges</code>, or <code>additionalSecretOutputs</code>
entry shares a name with a top-level node
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22916">#22916</a></p>
</li>
<li>
<p>[programgen/pcl] Fix PCL binder panic when a conditional mixes a
Promise-typed branch with a try() branch
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22907">#22907</a></p>
</li>
<li>
<p>[sdk/python] Support <code>NotRequired</code>, <code>Required</code>
and <code>total=False</code> in TypedDicts for component resource arg
types
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22858">#22858</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dc35aff826"><code>dc35aff</code></a>
only don't run CI if changelog/config.yaml changes (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22937">#22937</a>)</li>
<li><a
href="a38b7dce73"><code>a38b7dc</code></a>
cli/neo: keep prior streaming text when the agent emits a new turn (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22897">#22897</a>)</li>
<li><a
href="6d84bb5ed7"><code>6d84bb5</code></a>
add continue-on-error to upload code coverage and upload codecov test
results...</li>
<li><a
href="8377d1277e"><code>8377d12</code></a>
Eagerly error on schemas with unconstructable types (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22890">#22890</a>)</li>
<li><a
href="9d209a07ad"><code>9d209a0</code></a>
bump java and yaml dependencies (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22932">#22932</a>)</li>
<li><a
href="dd82f69c24"><code>dd82f69</code></a>
LocalWorkspace.nested_config: use a new stack per test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22926">#22926</a>)</li>
<li><a
href="c5180568c9"><code>c518056</code></a>
Fix flaky TestFuzz: targeted update with refresh + deleted parent (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22925">#22925</a>)</li>
<li><a
href="46486da224"><code>46486da</code></a>
Thread workspace.Context to ProviderFromSource (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22880">#22880</a>)</li>
<li><a
href="ad42ef389e"><code>ad42ef3</code></a>
increase nodejs automation API timeout (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22920">#22920</a>)</li>
<li><a
href="0b8a78bd77"><code>0b8a78b</code></a>
Test on Node.js 26 and drop 20 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22872">#22872</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.236.0...v3.237.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Bump `mcp-registry:imageTag` from `1.7.7` → `1.7.8` in
`deploy/Pulumi.gcpProd.yaml`
- v1.7.8 ships the metrics fix that stops counting client-cancelled
requests as server errors (#1255). Under scraper-driven load, clients
with short timeouts close the socket while PG is still iterating; the
handler converts `context.Canceled` to a 500 and the metric middleware
was bumping `mcp_registry_http_errors_total` even though NGINX recorded
499 and never delivered a response. This is what's been firing the daily
~17:00 UTC `Availability dropped below 95%` alert.
- Also includes a CI-only `pulumi/actions` 6.6.1 → 7.0.0 bump (#1254).
No registry runtime impact.
- Staging is on `4e14707` (the v1.7.8 commit) and
`staging.registry.modelcontextprotocol.io/v0.1/version` reports it.
## Test plan
- [ ] Confirm release workflow's `ko-push` job has published
`ghcr.io/modelcontextprotocol/registry:1.7.8` before merging
- [ ] Watch deploy-production roll the registry pods to `1.7.8`
- [ ] Hit `https://registry.modelcontextprotocol.io/v0.1/version` and
confirm `git_commit` matches `4e147072f0`
- [ ] Through the next ~17:00 UTC scraper burst, watch in Prometheus:
- `mcp_registry_http_errors_total{status_code="500",
path="/v0.1/servers"}` should stay flat
- `mcp_registry_http_requests_total{status_code="499",
path="/v0.1/servers"}` should grow during the burst
- The `Availability dropped below 95%` alert should not fire on
cancellation-only bursts
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Bump `mcp-registry:imageTag` from `1.7.6` → `1.7.7` in
`deploy/Pulumi.gcpProd.yaml`
- v1.7.7 is a security patch covering three findings (validator
hardening, attribute-context UI escaping, IPv6 SSRF blocklist
extension); see the v1.7.7 release notes
- Staging is on `f5f40bd` (the v1.7.7 commit) and verified end-to-end:
- `/v0.1/version` reports the new commit
- `/v0.1/validate` rejects a poisoned `websiteUrl` with
`website-url-invalid-characters`
- `/` HTML serves the `escapeAttr` helper
## Test plan
- [ ] Confirm release workflow's `ko-push` job has finished publishing
`ghcr.io/modelcontextprotocol/registry:1.7.7` before merging
- [ ] Watch deploy-production workflow rolls the registry pods to
`1.7.7`
- [ ] Hit `https://registry.modelcontextprotocol.io/v0.1/version` and
confirm `git_commit` matches `f5f40bd...`
- [ ] Spot-check the catalogue UI loads cleanly
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.233.0 to 3.234.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.234.0</h2>
<h2>3.234.0 (2026-05-01)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api describe</code> for inspecting
the parameters, request
body, and response schema of any Pulumi Cloud API operation, with
text, markdown, and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22770">#22770</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api list</code> for browsing every
endpoint exposed by the Pulumi
Cloud OpenAPI spec, with table and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22769">#22769</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[engine] Revert changes to property path parsing that resulted in
errors for currently valid paths</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.234.0 (2026-05-01)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api describe</code> for inspecting
the parameters, request
body, and response schema of any Pulumi Cloud API operation, with
text, markdown, and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22770">#22770</a></p>
</li>
<li>
<p>[cli/cloud] Add <code>pulumi cloud api list</code> for browsing every
endpoint exposed by the Pulumi
Cloud OpenAPI spec, with table and JSON output</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22769">#22769</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[engine] Revert changes to property path parsing that resulted in
errors for currently valid paths</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e802ef2c5b"><code>e802ef2</code></a>
Revert "Tighten parsing on new property paths (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22695">#22695</a>)"
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22801">#22801</a>)</li>
<li><a
href="f5deaa1b20"><code>f5deaa1</code></a>
cli/cloud: add <code>pulumi cloud api describe</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22770">#22770</a>)</li>
<li><a
href="bccf53d1fb"><code>bccf53d</code></a>
cli/cloud: add <code>pulumi cloud api list</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22769">#22769</a>)</li>
<li><a
href="5575172e07"><code>5575172</code></a>
Changelog and go.mod updates for v3.233.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22795">#22795</a>)</li>
<li><a
href="caf13d6d14"><code>caf13d6</code></a>
Cancel in-flight fuzz iterations when the 20s cap fires (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22725">#22725</a>)</li>
<li><a
href="324811c0a7"><code>324811c</code></a>
Freeze v2.233.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22793">#22793</a>)</li>
<li>See full diff in <a
href="https://github.com/pulumi/pulumi/compare/v3.233.0...v3.234.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.232.0 to 3.233.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.233.0</h2>
<h2>3.233.0 (2026-04-30)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[auto/python] Expose the auto-generated Pulumi CLI interface as
<code>workspace.cli_api</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22638">#22638</a></p>
</li>
<li>
<p>[cli] Add encrypted logging to ~/.pulumi/logs; use the
PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22494">#22494</a></p>
</li>
<li>
<p>[cli] Implement the <code>filesystem__grep</code> and
<code>filesystem__content_replace</code> local tools
for <code>pulumi neo</code>. <code>grep</code> runs a regex search
across files in the project root
with an optional <code>include</code> glob filter and returns results in
<code>path:lineno: line</code>
form. <code>content_replace</code> performs a literal multi-file
search-and-replace with a
<code>file_pattern</code> glob and <code>dry_run</code> preview mode.
Both tools skip binary files,
hidden directories, and <code>node_modules</code>, and reject paths
outside the project
root. Their input schemas match the cloud-side tool definitions.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22655">#22655</a></p>
</li>
<li>
<p>[cli] Add <code>pulumi_preview</code> and <code>pulumi_up</code> as
local tools for the experimental <code>pulumi neo</code>
agent. The Neo TUI renders a persistent bordered block for each
operation that
streams changed resources and diagnostics as the engine runs and
finalizes with a
summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22697">#22697</a></p>
</li>
<li>
<p>[engine] Add <code>List</code> to the provider protocol and schema
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22693">#22693</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Return a clear error when two installed plugins claim the
same default provider package name (for example, a native
<code>scaleway</code> provider alongside a
<code>terraform-provider</code> bridge parameterized as
<code>scaleway</code>) instead of panicking with "Should not have
seen an older plugin if sorting is correct!"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22679">#22679</a></p>
</li>
<li>
<p>[programgen] Do not wrap a <code>call(...)</code> on a method whose
return type is marked plain in an Output. Previously
PCL bound every method call's return type as
<code>Output<T></code>, which caused downstream program-gen
to emit broken <code>.apply(...)</code>/<code>.ApplyT(...)</code>
traversals against plain struct returns (e.g.
methods with <code>liftSingleValueMethodReturns=true</code> or
<code>ReturnTypePlain=true</code>).</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22696">#22696</a></p>
</li>
<li>
<p>[backend/diy] When using a backend url containing creds (e.g.
PostgreSQL conn string), mask user:pass as in lock-related error
messages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22701">#22701</a></p>
</li>
<li>
<p>[codegen/go] Generate unqualified <code>Provider</code> references
for the package's own provider resource. Previously
the Go codegen always emitted <code><pkg>.Provider</code> even
when the reference appeared inside <code><pkg></code></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.233.0 (2026-04-30)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[auto/python] Expose the auto-generated Pulumi CLI interface as
<code>workspace.cli_api</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22638">#22638</a></p>
</li>
<li>
<p>[cli] Add encrypted logging to ~/.pulumi/logs; use the
PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22494">#22494</a></p>
</li>
<li>
<p>[cli] Implement the <code>filesystem__grep</code> and
<code>filesystem__content_replace</code> local tools
for <code>pulumi neo</code>. <code>grep</code> runs a regex search
across files in the project root
with an optional <code>include</code> glob filter and returns results in
<code>path:lineno: line</code>
form. <code>content_replace</code> performs a literal multi-file
search-and-replace with a
<code>file_pattern</code> glob and <code>dry_run</code> preview mode.
Both tools skip binary files,
hidden directories, and <code>node_modules</code>, and reject paths
outside the project
root. Their input schemas match the cloud-side tool definitions.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22655">#22655</a></p>
</li>
<li>
<p>[cli] Add <code>pulumi_preview</code> and <code>pulumi_up</code> as
local tools for the experimental <code>pulumi neo</code>
agent. The Neo TUI renders a persistent bordered block for each
operation that
streams changed resources and diagnostics as the engine runs and
finalizes with a
summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22697">#22697</a></p>
</li>
<li>
<p>[engine] Add <code>List</code> to the provider protocol and schema
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22693">#22693</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Return a clear error when two installed plugins claim the
same default provider package name (for example, a native
<code>scaleway</code> provider alongside a
<code>terraform-provider</code> bridge parameterized as
<code>scaleway</code>) instead of panicking with "Should not have
seen an older plugin if sorting is correct!"
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22679">#22679</a></p>
</li>
<li>
<p>[programgen] Do not wrap a <code>call(...)</code> on a method whose
return type is marked plain in an Output. Previously
PCL bound every method call's return type as
<code>Output<T></code>, which caused downstream program-gen
to emit broken <code>.apply(...)</code>/<code>.ApplyT(...)</code>
traversals against plain struct returns (e.g.
methods with <code>liftSingleValueMethodReturns=true</code> or
<code>ReturnTypePlain=true</code>).</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22696">#22696</a></p>
</li>
<li>
<p>[backend/diy] When using a backend url containing creds (e.g.
PostgreSQL conn string), mask user:pass as in lock-related error
messages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/22701">#22701</a></p>
</li>
<li>
<p>[codegen/go] Generate unqualified <code>Provider</code> references
for the package's own provider resource. Previously
the Go codegen always emitted <code><pkg>.Provider</code> even
when the reference appeared inside <code><pkg></code>
itself, producing identifiers that would not compile. Affects generated
code for method return</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fa313013d0"><code>fa31301</code></a>
don't stamp vcs information into binaries (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22788">#22788</a>)</li>
<li><a
href="17fd40453d"><code>17fd404</code></a>
double timeout in "does not hang" test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22789">#22789</a>)</li>
<li><a
href="eb6e31d841"><code>eb6e31d</code></a>
split tests module on macos further (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22790">#22790</a>)</li>
<li><a
href="94dbe6401b"><code>94dbe64</code></a>
Remove runInStack from run-policy-pack (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22783">#22783</a>)</li>
<li><a
href="a35ec7e9d5"><code>a35ec7e</code></a>
retry pip install a few times (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22785">#22785</a>)</li>
<li><a
href="7a4beeaa44"><code>7a4beea</code></a>
Reject schemas with duplicate tokens after applying
<code>moduleFormat</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22765">#22765</a>)</li>
<li><a
href="0b914cee46"><code>0b914ce</code></a>
unflake TestNodejsComponentProviderRun (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22782">#22782</a>)</li>
<li><a
href="5cd1646706"><code>5cd1646</code></a>
start logging encrypted logs for all pulumi commands (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22494">#22494</a>)</li>
<li><a
href="a81ef07c09"><code>a81ef07</code></a>
pin more plugin versions in integration tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22758">#22758</a>)</li>
<li><a
href="0d2b8bf114"><code>0d2b8bf</code></a>
Update list doc comment (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22777">#22777</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.232.0...v3.233.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## What this does
The publisher CLI now derives the OIDC audience to request from the
`--registry` URL instead of using a fixed constant, and the server
validates the token's `aud` claim against a new per-deployment env var
(`MCP_REGISTRY_GITHUB_OIDC_AUDIENCE`).
Production sets this env var to
`https://registry.modelcontextprotocol.io` (and per-environment URL
elsewhere), so the deployment only accepts tokens that were requested
for it.
## Compatibility
This is a breaking change for older `mcp-publisher` binaries that still
request the legacy hardcoded audience. After this rolls to a deployment,
users on old `mcp-publisher` will see a clear `invalid audience:
expected …, got […]` error and need to upgrade. Users following the
documented `releases/latest` install pattern get the new binary
automatically.
## Test plan
- [ ] CI green
- [ ] Run a synthetic publish from a real GitHub Actions workflow
against staging after deploy
- [ ] Confirm an older `mcp-publisher` against the same staging deploy
returns the expected `invalid audience` error
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.4](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.4)
(#1225) to production: registry pod memory request `256Mi → 512Mi`,
limit `512Mi → 1Gi`.
## Why
#1221 doubled pgxpool `MaxConns` 30→60 per pod without bumping the
registry pod memory limit. pgxpool keeps per-connection state in the Go
process (prepared statement cache, scratch buffers, row iteration state)
so peak per-pod memory shifted from ~330 MB to ~450 MB against the 512
MiB limit. Pod `tx49f` was OOMKilled at 17:01 UTC on 2026-04-29.
## Validation so far
- Staging deployed cleanly via `deploy-staging.yml` after #1225 merged
- Both staging pods running with `req=512Mi limit=1Gi` ✓
- Rolling update was clean — no failed health checks during the
transition
- Both pods spread across nodes (q716 + 7exo)
## Deployment
**Zero downtime** — Deployment template change only, rolling update with
`maxSurge: 1, maxUnavailable: 0`. No PG involvement (no
`max_connections` change, no shared_preload_libraries change).
## Test plan
- [x] v1.7.4 release built and pushed
(`ghcr.io/modelcontextprotocol/registry:1.7.4`)
- [x] Staging deployed cleanly with new limits
- [ ] Prod Pulumi run applies cleanly; rolling update completes
- [ ] Prod pods come up with `req=512Mi limit=1Gi`
- [ ] After 24h: no OOMKills on either pod, peak memory stays under ~600
MB
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Follow-up to #1221. That PR doubled pgxpool `MaxConns` from 30 to 60 per
pod without bumping the registry pod memory limit. pgxpool keeps
per-connection state in the Go process (prepared statement cache,
scratch buffers, row iteration state), so memory grew roughly
proportionally — peak per-pod usage shifted from ~330 MB to ~450 MB
against a 512 MiB limit.
## What surfaced it
Pod `tx49f` was OOMKilled at 17:01 UTC on 2026-04-29 (`exitCode 137`,
`reason: OOMKilled`). Memory history from Cloud Monitoring confirms the
regression:
| Pods | Peak 30-min memory |
|------|-------------------:|
| Pre-#1221 (`MaxConns=30`) | 178–333 MB |
| **Post-#1221** (`MaxConns=60`) | **437–449 MB** |
| Old limit | **512 MiB** ← right at the edge |
Other pod was at 394 MB at the time of inspection — could OOM again.
## Fix
`deploy/pkg/k8s/registry.go:217-225`:
| | Before | After |
|---|-------:|------:|
| `requests.memory` | 256 MiB | **512 MiB** |
| `limits.memory` | 512 MiB | **1 GiB** |
1 GiB is ~2× the current peak under load — gives room for traffic spikes
without immediate OOM risk. Either node has 4–5 GiB free allocatable
memory, so the new request fits comfortably.
## Test plan
- [x] `go build ./...` clean
- [x] `golangci-lint run` clean
- [ ] After release + prod promotion: pod memory stabilises around 450
MB peak with no OOMKills
- [ ] After release + prod promotion: tx49f restartCount stops climbing
(currently at 5)
## Deployment
Zero downtime — Deployment template change only, rolling update with
`maxSurge: 1, maxUnavailable: 0`. **No PG involvement** (no
`max_connections` change, no shared_preload_libraries change). Same
shape as a normal v1.7.x image promotion.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.3](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.3)
to production. Contents:
- **#1220** — `RemoteURL` filter SQL rewritten to use JSONB containment
(`@>`) instead of `EXISTS jsonb_array_elements`. The new form is
GIN-indexable; the old form forced a full table scan. Local benchmark:
40,398 → 294 buffer reads, 17 ms → 1.6 ms. Maps to prod's 10,005 ms
cold-cache observation.
- **#1221** — pgxpool `MaxConns 30→60`, `MinConns 5→10`. PG
`max_connections 100→200`. Explicit PG `resources:` block (was unset).
## What this addresses
- **#1220**: yesterday's 17:08 UTC `Publish Endpoint Latency` alert
(`dev.storage/mcp` publish took 14.8s with `remotes_ms=10980` —
pinpointed by the per-phase slog from #1215).
- **#1221**: yesterday's 17:35–17:40 UTC `Availability dropped below
95%` alert and 18:17 UTC `Publish Endpoint Latency` re-fire. Both were
scraper-driven concurrency on `/v0/servers` (~15 req/s sustained from
ServiceNow + others). With the bumped pool, the queue at the Go HTTP
layer should clear faster instead of blowing up to 20–35s nginx-level
latencies.
## Deployment caveat
The PG `max_connections` change is a postmaster-level setting → CNPG
triggers a PG restart on the next prod Pulumi run. With `instances: 1`
this is brief downtime — staging took **~30s** during the equivalent
restart, with **one registry pod bouncing once** on its 8-attempt
DB-retry budget before recovering on the next kubelet restart.
**Time the merge for a low-traffic UTC window.** Alert history suggests
very early UTC (02:00–04:00) is quietest.
## Resource impact
PG node memory is currently 39% (~2.4 GiB / 6 GiB allocatable).
Worst-case PG memory growth with `max_connections=200` lands around 3–4
GiB, putting the node at ~65% — fits with headroom. Empirically, prod PG
has peaked at **413 MiB** in the last 30h of incident data, so the
proposed 4 GiB limit is ~10× the historical max — guardrail not
constraint.
## Post-merge
CNPG handles `pg_stat_statements` extension creation automatically (no
manual `CREATE EXTENSION` step needed — it was already done in v1.7.2's
deploy).
Verify after deploy:
```bash
PATH=/opt/homebrew/share/google-cloud-sdk/bin:$PATH
# max_connections actually changed
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -tAc "SHOW max_connections" # expect: 200
# resources block applied
kubectl get pod registry-pg-1 \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-o jsonpath='{.spec.containers[?(@.name=="postgres")].resources}{"\n"}'
# pgxpool MaxConns reflected (registry app uses 60 per pod after restart)
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -tAc "SELECT count(*) FROM pg_stat_activity WHERE datname='app'"
```
## Test plan
- [x] v1.7.3 release built and pushed
(`ghcr.io/modelcontextprotocol/registry:1.7.3`)
- [x] Staging deployed cleanly; PG restarted and came back with
`max_connections=200`; one staging pod bounced as expected
- [ ] Prod Pulumi run applies cleanly; brief PG restart
- [ ] Confirm `SHOW max_connections` returns 200 on prod
- [ ] Confirm `publish complete` events show `remotes_ms` < 10ms
- [ ] Watch for any "too many connections" errors during the rollout
window (none expected — Pulumi orders CNPG cluster before Deployment, so
PG accepts the new conn limit before pgxpool tries to use it)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Follow-up to #1215 and #1220. Both of those addressed *individual* slow
queries; this PR addresses *concurrency* — under today's scraper load
the cursor query is fast on average (mean 42ms) but the connection pool
saturates and queue depth blows up at the Go HTTP layer.
## Diagnosis
`pg_stat_statements` (added in #1215) made this possible to see:
```
max_ms mean_ms calls template
10,755 41.8 94,009 plain cursor pagination, no filter
7,277 214.7 14,770 ILIKE substring filter
7,638 330.8 7,656 ILIKE substring + is_latest filter
```
Mean times are healthy. But `max_exec_time` of 7–10s on the cursor
query, combined with sustained ~15 req/s from scrapers (ServiceNow's
148.139.x.x range, anonymous `node` user-agent, etc) saturates
`MaxConns=30 × 2 pods = 60`. New requests queue at the Go HTTP layer;
nginx-side p99 hits 35s; eventually scrapers time out at 60s, retry, and
amplify the queue.
Today's two ongoing alerts are both this pattern:
- 17:35–17:40 UTC `Availability dropped below 95%` — 4,526 GET requests
in 5 min, hundreds of 504s
- 18:17 UTC `Publish Endpoint Latency` re-fire — same scraper
concurrency dragging the publish path
Critically, the symptoms today were also visible during yesterday's
incident, but yesterday's broken cursor (#1215) was the dominant cause.
After #1215 the cursor is fast individually; concurrency now becomes the
next bottleneck.
## Changes
### pgxpool (`internal/database/postgres.go`)
| Setting | Before | After |
|---------|-------:|------:|
| `MaxConns` | 30 | **60** per pod |
| `MinConns` | 5 | **10** per pod |
| `MaxConnIdleTime` | 30 min | (unchanged) |
| `MaxConnLifetime` | 2 h | (unchanged) |
2 pods × 60 = 120 total app connections. Cuts queue depth roughly in
half at current scraper load.
### PG cluster (`deploy/pkg/k8s/postgres.go`)
- `max_connections: 100 → 200` — required to support the larger pool.
120 (app) + ~10 (PG internals: autovacuum, replication, admin) + 70
headroom.
- Added explicit `resources:` block — previously the pod had no resource
limits, making node-level OOM behaviour unpredictable.
| | Request | Limit |
|---|--------:|------:|
| memory | 512Mi | **4Gi** |
| cpu | 200m | 1500m |
## Resource budget
| Node | Now | After |
|------|----:|------:|
| dy89 (PG node) | 39% mem (~2.4 GiB / 6 GiB) | ~65% mem worst-case
(~3.9 GiB) |
| 2yxm | 36% mem | unchanged |
Both nodes well within capacity. CPU usage <50% on both, plenty of
headroom.
PG worst-case memory math:
- 200 conns × ~15 MB per backend = 3 GiB
- + `shared_buffers` 128 MiB
- + `maintenance_work_mem`, OS overhead, etc.
- ≈ 3–4 GiB total
## Deployment caveat
`max_connections` is a postmaster-level setting → CNPG triggers a PG
restart on the change. Same in-pod restart shape as the
pg_stat_statements deploy yesterday — registry pods see ~30s of DB
unavailability, covered by v1.7.1's retry-with-backoff (8 attempts, 1→8s
capped). One registry pod may bounce once before recovering, like
yesterday.
**Time the merge for a low-traffic UTC window.**
Order of operations matters within the deploy itself:
1. Pulumi applies the new CNPG spec → PG restarts with
`max_connections=200`
2. Rolling deploy of registry pods picks up `MaxConns=60` config
3. New conns are accepted up to 200 limit
Pulumi's standard ordering does step 1 before step 2 in this scenario
(Pulumi resource graph: CNPG cluster precedes Deployment). If for any
reason it doesn't, the worst case is `too many connections` errors
during a small window — Self-correcting once the rollout completes.
## Test plan
- [x] `go build ./...` clean for app + deploy
- [x] `make lint` clean
- [x] `go test -race ./internal/database/...` green
- [ ] On merge: staging deploy applies the spec change cleanly; PG
restarts; pool reaches 60 max
- [ ] On prod deploy: same; verify no `too many connections` errors
during the rollout window
- [ ] After deploy: query `SHOW max_connections` returns 200; query
pg_stat_statements after a scraper burst, confirm `max_exec_time` for
cursor query no longer hits 10s
## Out of scope
- **ILIKE substring search** (`server_name ILIKE '%foo%'`) is
unindexable. Three pg_stat_statements variants run with means 141–333ms
and max 4–7s. Worth replacing with a `pg_trgm` GIN index or full-text
search in a separate PR.
- **Per-IP nginx rate limiting** — defends against scraper retry storms
regardless of pool size.
- **`Cache-Control` on `/v0/servers`** — let nginx absorb
scraper-repeated cursors.
- **Pre-existing `superfluous WriteHeader` warnings** — separate Huma
framework issue.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.2](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.2)
(PR #1215) to production:
- **Row-constructor cursor pagination** — fixes the 760ms list query
that was the root cause of today's pool-exhaustion alerts. Local
benchmark shows /v0/servers paginated requests dropping from ~30ms (cold
cache, 100K rows) to ~0.05ms.
- **Per-phase publish slog** — `publish complete` events now include
validate / lock / remotes / version_checks / unmark / db_create timings
so the next slow publish is self-diagnostic.
- **pg_stat_statements** — aggregate query visibility we didn't have
during today's incident.
## Deployment caveat
The CNPG cluster spec change for `pg_stat_statements` triggers an in-pod
postgres restart on the next prod Pulumi run. Staging took **~45–70s of
registry unavailability** during the equivalent restart. The DB
retry-with-backoff in v1.7.1 covers most of it, but registry pods may
bounce once before they reconnect (one staging pod hit `Failed to
connect after 8 attempts` then recovered on its next restart).
**Time the merge for a low-traffic UTC window** — the alert history
suggests very early UTC is quietest.
## Post-merge action
Once the prod Pulumi run completes, run once on the existing cluster:
```bash
PATH=/opt/homebrew/share/google-cloud-sdk/bin:$PATH
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -c "CREATE EXTENSION IF NOT EXISTS pg_stat_statements"
```
Verify:
```bash
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -d app -c "
SELECT round(mean_exec_time::numeric, 2) AS mean_ms, calls,
substring(query, 1, 80) AS q
FROM pg_stat_statements ORDER BY total_exec_time DESC LIMIT 10;"
```
## Test plan
- [x] v1.7.2 release built and pushed
(`ghcr.io/modelcontextprotocol/registry:1.7.2`)
- [x] Staging deployed cleanly; `pg_stat_statements` is collecting on
staging
- [ ] Prod Pulumi run applies cleanly; brief PG restart
- [ ] Run `CREATE EXTENSION` on prod
- [ ] Confirm `publish complete` events contain per-phase timings on the
next publish
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Three changes from the 2026-04-27 incident:
1. **Cursor SQL fix** — `addCursorCondition` rewritten to use a
row-constructor comparison `(server_name, version) > ($1, $2)` instead
of the OR-decomposed form. Postgres can index-seek on the row
constructor; it can't on the OR form, which scanned from the start of
the index and filtered rows before the cursor. Cost grew linearly with
cursor depth.
2. **Per-phase publish timings restored** — `createServerInTransaction`
was simplified during #1211 review to log only `validate_ms`. The
incident showed publishes spending 50+ s in `acquire_lock` /
`version_checks` / `db_create` while `validate_ms` reported a few
hundred ms — the diagnostic signal was hidden. Restored timings for
every phase, refactored into a small `runPhase` helper.
3. **`pg_stat_statements` enabled** in the CNPG cluster spec. We had no
aggregate query visibility during the incident — could only EXPLAIN
queries we happened to suspect.
## Cursor fix evidence
Local benchmark, 100K rows, cold cache:
| Form | Rows filtered | Buffer reads | Time |
|------|--------------:|-------------:|-----:|
| OLD | 80,001 | 7,679 | 31.6 ms |
| NEW | 2 | 1 | **0.05 ms** |
Maps to prod's measured 8,911 buffer hits → 760 ms. End-to-end API:
`/v0/servers?limit=100&cursor=…` returns in 4–7 ms regardless of depth.
Risk check: confirmed `(server_name, version)` index exists in that
column order (both `servers_pkey` and `idx_servers_name_version`), and
both columns are `NOT NULL` so row-constructor comparison can't silently
drop rows.
## Tests
- New
`TestPostgreSQL_PerformanceScenarios/compound_cursor_across_versions_of_same_server`
pins multi-version pagination semantics. The existing cursor tests only
exercised the fallback (single-component cursor) and degenerate (one
version per server) cases.
- `make lint` clean, `go test -race ./internal/... ./cmd/...` green.
## Deployment
The cursor + slog changes are zero-downtime. The CNPG spec change
triggers a brief PG restart (single-instance cluster). After the
restart, run once on prod:
```bash
kubectl exec -i registry-pg-1 -c postgres \
--context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \
-- psql -U postgres -c "CREATE EXTENSION IF NOT EXISTS pg_stat_statements"
```
Time the merge for a low-traffic UTC window. v1.7.1's DB
retry-with-backoff covers the brief PG restart.
## Out of scope
`MaxConns` bump, per-IP rate limiting at nginx, response caching, the
pre-existing `superfluous WriteHeader` warnings — separate follow-ups.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Promotes
[v1.7.1](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.1)
to production. Contents: the hardening + diagnostics from #1211.
What's in v1.7.1 (vs v1.7.0):
- Pulumi-managed IAM bindings for the default compute SA so
fluentbit-gke and the GMP collector can ship logs/metrics (already
applied to live cluster manually)
- `PodDisruptionBudget` with `minAvailable: 1` +
`TopologySpreadConstraints` to keep pods spread across nodes
- `StartupProbe` (30 × 5s) covering the new DB-retry budget
- Bounded retry-with-backoff on initial DB connect in
`cmd/registry/main.go`
- Memory request 128→256Mi, limit 256→512Mi
- `slog` `validate_ms` timing on the publish path so the next slow
`/v0/publish` is self-diagnostic
## Test plan
- [x] v1.7.1 release workflow built and pushed image successfully
(`ghcr.io/modelcontextprotocol/registry:1.7.1`)
- [x] Pulumi.gcpProd.yaml diff is the single-line image bump
- [ ] On merge, `deploy-production.yml` rolls out v1.7.1 — watch for
clean rolling update (`maxSurge: 1`, `maxUnavailable: 0`) and confirm
both pods reach Ready
- [ ] After rollout, confirm `Starting MCP Registry Application v1.7.1`
shows up in Cloud Logging from the new pods
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Follow-up to #1211 to encode the GCP API and IAM dependencies its
node-SA bindings rely on. After #1211 merged, the staging deploy hit two
undocumented prereqs in sequence — Cloud Resource Manager API not
enabled (because `projects.NewIAMMember` calls SetIamPolicy through
CRM), then the Pulumi service account missing
`roles/resourcemanager.projectIamAdmin`. Both fixed manually to unblock;
this PR makes them explicit so they don't bite again.
## Changes
**`ensureRequiredAPIs` adopts five GCP APIs** as Pulumi-managed
`projects.Service` resources, all with `DisableOnDestroy: false` and
`DisableDependentServices: false` so a Pulumi destroy/refactor can never
disable a shared API:
| API | Why |
|-----|-----|
| `cloudresourcemanager` | `projects.NewIAMMember` → SetIamPolicy |
| `compute` | `compute.GetDefaultServiceAccount` invoke + GKE |
| `container` | GKE cluster |
| `logging` | fluentbit-gke ships container logs |
| `monitoring` | managed Prometheus collector ships metrics |
CRM is created explicitly (not in the loop) so callers get a direct
reference for `pulumi.DependsOn`. Storage is intentionally **not**
Pulumi-managed — Pulumi state itself lives in a GCS bucket,
chicken-and-egg.
**`grantNodeServiceAccountRoles`** now `DependsOn` the CRM
`projects.Service` for the four IAM bindings, and uses
`compute.GetDefaultServiceAccount` to derive the SA email (Compute API
was already required for GKE — avoids a CRM-dependent project-number
lookup).
**`deploy/README.md`** — adds `roles/resourcemanager.projectIamAdmin` to
the Pulumi SA's required roles and clarifies which APIs must be enabled
before the first `pulumi up` (storage, cloudresourcemanager, container)
vs. which `ensureRequiredAPIs` adopts.
## Notes
`projects.Service` is idempotent against already-enabled APIs — on
existing projects (staging/prod), Pulumi adopts the live enablement into
state without re-enabling. This was confirmed live: staging deploy went
green after the manual unblocks above, validating the runtime model.
## Test plan
- [x] `go build ./...` clean for `deploy/`
- [x] `golangci-lint run` clean for `deploy/pkg/providers/gcp/...` (one
pre-existing `nilnil` at line 61, unrelated)
- [x] Manual unblock + green staging deploy verified the runtime
behavior this PR encodes
- [ ] On merge: staging deploy adopts the existing API enablements
without churn, then proceeds normally
- [ ] Prod deploy via #1212 (image promotion) inherits the same setup
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Daily ~17:00 UTC `Publish Endpoint Latency` and `Availability < 95%`
alerts are caused by both registry pods exit-0'ing within seconds of
each other and racing with the still-recovering `registry-pg-rw`
endpoint on restart. Separately, the default compute SA had no project
IAM roles, so `fluentbit-gke` and the GMP collector were silently
dropping every log line and time series — which is why none of this was
visible in Cloud Logging.
All Kubernetes/IAM changes apply uniformly to staging and prod.
## Changes
- **GCP IAM** (`deploy/pkg/providers/gcp/provider.go`) — grant the
default compute SA `logging.logWriter`, `monitoring.metricWriter`,
`monitoring.viewer`, and `stackdriver.resourceMetadata.writer`. Already
applied live; this just encodes it in Pulumi.
- **Pod resilience** (`deploy/pkg/k8s/registry.go`) —
- `PodDisruptionBudget` (`minAvailable: 1`) prevents a synchronized
voluntary disruption.
- `TopologySpreadConstraints` (`ScheduleAnyway`, hostname) keeps the PDB
from deadlocking node drains when both pods co-locate.
- `StartupProbe` (30 × 5s = 150s) protects the DB-retry budget from the
liveness probe.
- Memory bump 128→256Mi request, 256→512Mi limit.
- **Startup retry** (`cmd/registry/main.go`) — replace silent `return`
on initial DB-ping failure with bounded retry-with-backoff (8 attempts,
1→8s capped, 10s per-attempt). A brief endpoint flap no longer cascades
into a restart loop.
- **Diagnostic log** (`internal/service/registry_service.go`) — emit
`validate_ms` on each publish (success and failure). Validate fans out
to npm/PyPI/OCI with 10s per-host timeouts and is the most likely
contributor to publish latency. Total request duration is already
covered by the existing `http.request.duration` histogram.
## Calibration
The IAM, PDB, topology-spread, startup-probe, and DB-retry pieces are
mitigations — they reduce blast radius regardless of root cause. The
`validate_ms` log is the diagnostic for identifying the trigger when the
alert fires next. Single-PG SPOF (`deploy/pkg/k8s/postgres.go:57`)
remains a follow-up; today's evidence shows PG was a victim, not the
cause.
## Test plan
- [x] `go build ./...` and `go vet ./...` clean for both modules
- [x] `make lint` clean (12 pre-existing issues under `deploy/` are not
in `make lint`)
- [x] `go test -race -count=1 ./internal/... ./cmd/...` green
- [x] IAM applied live; `fluentbit-gke` and GMP no longer hitting
`IAM_PERMISSION_DENIED`
- [ ] After deploy, verify the next 17:00 UTC firing surfaces
`validate_ms` in Cloud Logging
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Bumps production image tag from `1.6.0` to `1.7.0` in
`deploy/Pulumi.gcpProd.yaml`
- Corresponds to the [v1.7.0
release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.0)
- Notable change: includes #1201 — fixes#1081 (`isLatest` no longer
stranded after soft-delete) and ships migration `014_heal_is_latest`
that auto-heals affected servers (e.g.
`io.github.containers/kubernetes-mcp-server`) on deploy
## Test plan
- [ ] Verify Pulumi preview shows only the image tag change
- [ ] After deploy, confirm migration 014 ran and
`io.github.containers/kubernetes-mcp-server`'s `/versions/latest`
returns `0.0.61` (or whichever is highest non-deleted)
- [ ] Sample a few unaffected servers and confirm `isLatest` is
unchanged
- [ ] Confirm overall service health
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.231.0 to 3.232.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.232.0</h2>
<h2>3.232.0 (2026-04-22)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add an experimental <code>pulumi neo</code> command that
creates a Pulumi Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell
tool calls
issued by the agent run on the user's machine in their working
directory; the
interactive chat continues to happen in the Pulumi Console at the URL
the command
prints. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22473">#22473</a></p>
</li>
<li>
<p>[cli] Add support for handling user approval requests in the
<code>pulumi neo</code> terminal UI.
When the agent requests confirmation for a sensitive action, the TUI
prompts the
user and forwards their response back to the Pulumi Console. Hidden
behind
PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22589">#22589</a></p>
</li>
<li>
<p>[cli] Add an interactive terminal UI for <code>pulumi neo</code>
built with bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal
alongside the
Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22570">#22570</a></p>
</li>
<li>
<p>[cli] Switch logging library from glog to slog.</p>
</li>
</ul>
<p>BREAKING: any <code>if logging.V(x) {</code> need to be changed to
<code>if logging.V(x).Enabled()</code></p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22548">#22548</a></p>
<ul>
<li>
<p>[cli] Add a plan-mode toggle to the <code>pulumi neo</code> TUI,
bound to Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
running <code>pulumi up</code>, or opening PRs, and surfaces an approved
plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
plan mode automatically.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22634">#22634</a></p>
</li>
<li>
<p>[cli] The <code>pulumi neo</code> TUI now drives its
"thinking" spinner off a single declarative
rule (the spinner stays on until a final event — final assistant
message, approval
request, cancellation, or error — lands), so the indicator no longer
flickers off
when the agent hands off tool calls to the CLI or when streaming text
arrives
between tools. Press <code>Esc</code> during a turn to ask the agent to
cancel; the label
switches to "Cancelling..." until the backend
acknowledges.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22637">#22637</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.232.0 (2026-04-22)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add an experimental <code>pulumi neo</code> command that
creates a Pulumi Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell
tool calls
issued by the agent run on the user's machine in their working
directory; the
interactive chat continues to happen in the Pulumi Console at the URL
the command
prints. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22473">#22473</a></p>
</li>
<li>
<p>[cli] Add support for handling user approval requests in the
<code>pulumi neo</code> terminal UI.
When the agent requests confirmation for a sensitive action, the TUI
prompts the
user and forwards their response back to the Pulumi Console. Hidden
behind
PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22589">#22589</a></p>
</li>
<li>
<p>[cli] Add an interactive terminal UI for <code>pulumi neo</code>
built with bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal
alongside the
Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22570">#22570</a></p>
</li>
<li>
<p>[cli] Switch logging library from glog to slog.</p>
</li>
</ul>
<p>BREAKING: any <code>if logging.V(x) {</code> need to be changed to
<code>if logging.V(x).Enabled()</code></p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22548">#22548</a></p>
<ul>
<li>
<p>[cli] Add a plan-mode toggle to the <code>pulumi neo</code> TUI,
bound to Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
running <code>pulumi up</code>, or opening PRs, and surfaces an approved
plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
plan mode automatically.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22634">#22634</a></p>
</li>
<li>
<p>[cli] The <code>pulumi neo</code> TUI now drives its
"thinking" spinner off a single declarative
rule (the spinner stays on until a final event — final assistant
message, approval
request, cancellation, or error — lands), so the indicator no longer
flickers off
when the agent hands off tool calls to the CLI or when streaming text
arrives
between tools. Press <code>Esc</code> during a turn to ask the agent to
cancel; the label
switches to "Cancelling..." until the backend
acknowledges.</p>
<p><a
href="https://redirect.github.com/pulumi/pulumi/pull/22637">#22637</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="59d156aaea"><code>59d156a</code></a>
Add <code>l2-plain-component</code> & remove test dependencies on
AWS (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22470">#22470</a>)</li>
<li><a
href="3efae3eafd"><code>3efae3e</code></a>
Cancel providers before closing them (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22692">#22692</a>)</li>
<li><a
href="448770ec12"><code>448770e</code></a>
Add l2-id-type test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22681">#22681</a>)</li>
<li><a
href="cc8a16f376"><code>cc8a16f</code></a>
go/auto: use random stack names in TestNestedConfig (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22689">#22689</a>)</li>
<li><a
href="6b5ce009ee"><code>6b5ce00</code></a>
skip signal cancellation tests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22684">#22684</a>)</li>
<li><a
href="923073c621"><code>923073c</code></a>
fix[codegen/go]: Use Context.GetOrRegisterPackageRef in generated code
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/22170">#22170</a>)</li>
<li><a
href="2608e2c071"><code>2608e2c</code></a>
Gitignore <code>.claude/scheduled_tasks.lock</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22686">#22686</a>)</li>
<li><a
href="3e387c7355"><code>3e387c7</code></a>
chore: typo <code>succesful</code> -> <code>successful</code> in
nodejs run/index.ts (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22685">#22685</a>)</li>
<li><a
href="a850bcbfef"><code>a850bcb</code></a>
Update dependency pulumi/pulumi-java to v1.25.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22673">#22673</a>)</li>
<li><a
href="416fd51b5f"><code>416fd51</code></a>
replace underlying logging library with slog (<a
href="https://redirect.github.com/pulumi/pulumi/issues/22548">#22548</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.231.0...v3.232.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
- Bumps production image tag from `1.5.0` to `1.6.0` in
`deploy/Pulumi.gcpProd.yaml`
- Corresponds to the [v1.6.0
release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.6.0)
## Test plan
- [ ] Verify Pulumi preview shows only the image tag change
- [ ] Deploy and confirm the service is healthy
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We keep bumping `go 1.26.x` across the repo every time a new Go patch
drops
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only —
"this module needs Go 1.26")
- **All CI workflows**: `go-version-file: 'go.mod'` → `go-version:
'stable'` — CI always uses the latest stable Go, no more
bump PRs
- **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` →
`go-version-input: 'stable'`
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Radoslav Dimitrov
dependabot[bot]