[dependabot]

Bumps the minor-and-patch group with 1 update: @pulumi/pulumi.

Updates @pulumi/pulumi from 3.267.0 to 3.268.0

Release notes

Sourced from @​pulumi/pulumi's releases.

v3.268.0

3.268.0 (2026-10-07)

Features

• [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, and providers can process them, gated by a new accepts_outputs_in_invoke handshake capability #24953
• [auto] Add version to the generated automation APIs for NodeJS, Python and Go #24990
• [auto] Add whoami to the generated automation APIs for NodeJS, Python and Go #25024
• [auto] Add install to the generated automation APIs for NodeJS, Python and Go #25038

Bug Fixes

• [engine] Restore elided asset contents from prior state when a provider echoes assets back from refresh or update #24570
• [engine] Apply resource transforms declared on an ancestor component to resources parented under a resource read #24689
• [pcl] Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time #24805
• [sdkgen/nodejs] Link @pulumi/pulumi types in generated docs to their TypeDoc pages instead of missing anchors #24928
• [engine] Fix snapshot integrity error when untargeted steps change dependencies in the program #24801
• [sdk/nodejs] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
• [sdk/python] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
• [cli/package] Download plugins from Git repositories whose version tags have no v prefix #24986
• [engine] Fix a language host process leak when the schema loader boots a plugin that runs in a language host #25002
• [sdkgen] Reject schemas that define a resource named provider in the root module through moduleFormat, instead of panicking during SDK generation #25020
• [engine] Shut down plugins in parallel to avoid timeouts #25026
• [cli/plugin] Fix plugin checksum verification rejecting valid downloads over HTTP/1.1 and ignoring data at the end of the archive #25032
• [cli/new] Fix spurious provider "exited prematurely" error from the pulumi new credentials check, which no longer has a timeout #25030
• [auto] Fix project settings in projects that live in symlinked directories #25046

Improvements

• [backend/service] Send the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set #25009

Miscellaneous

• [java] Upgrade java to v1.37.4 #25027
• [yaml] Upgrade yaml to v1.38.9 #25027
• [hcl] Upgrade hcl to v0.18.4 #25027
• [sdk/dotnet] Upgrade dotnet to v3.114.2 #25034

Changelog

Sourced from @​pulumi/pulumi's changelog.

3.268.0 (2026-10-07)

Features

• [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, and providers can process them, gated by a new accepts_outputs_in_invoke handshake capability #24953
• [auto] Add version to the generated automation APIs for NodeJS, Python and Go #24990
• [auto] Add whoami to the generated automation APIs for NodeJS, Python and Go #25024
• [auto] Add install to the generated automation APIs for NodeJS, Python and Go #25038

Bug Fixes

• [engine] Restore elided asset contents from prior state when a provider echoes assets back from refresh or update #24570
• [engine] Apply resource transforms declared on an ancestor component to resources parented under a resource read #24689
• [pcl] Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time #24805
• [sdkgen/nodejs] Link @pulumi/pulumi types in generated docs to their TypeDoc pages instead of missing anchors #24928
• [engine] Fix snapshot integrity error when untargeted steps change dependencies in the program #24801
• [sdk/nodejs] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
• [sdk/python] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
• [cli/package] Download plugins from Git repositories whose version tags have no v prefix #24986
• [engine] Fix a language host process leak when the schema loader boots a plugin that runs in a language host #25002
• [sdkgen] Reject schemas that define a resource named provider in the root module through moduleFormat, instead of panicking during SDK generation #25020
• [engine] Shut down plugins in parallel to avoid timeouts #25026
• [cli/plugin] Fix plugin checksum verification rejecting valid downloads over HTTP/1.1 and ignoring data at the end of the archive #25032
• [cli/new] Fix spurious provider "exited prematurely" error from the pulumi new credentials check, which no longer has a timeout #25030
• [auto] Fix project settings in projects that live in symlinked directories #25046

Improvements

• [backend/service] Send the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set #25009

Miscellaneous

• [java] Upgrade java to v1.37.4 #25027
• [yaml] Upgrade yaml to v1.38.9 #25027
• [hcl] Upgrade hcl to v0.18.4 #25027
• [sdk/dotnet] Upgrade dotnet to v3.114.2 #25034

Commits

• 24b14e7 Add install to the generated automation APIs (#25038)
• 8ab3754 Add whoami to the generated automation APIs (#25024)
• f9f5b73 Update vulnerable dependencies [SECURITY] (#24281)
• dac138d Upgrade github.com/go-git/go-git/v6 to v6.0.0-beta.1 (#25028)
• 8489d0b Negotiate OutputValues on Invoke (#24953)
• fcd2513 lint pulumi-language-bun (#24988)
• 38868cc Run integration tests with stale paralleltest exemptions in parallel (#24993)
• 0cda18c Add version to the generated automation APIs (#24990)
• fb0efa3 sdk/{nodejs,python}: dynamic provider Read falls back to inputs (#24977)
• e27cf14 Changelog and go.mod updates for v3.267.0 (#24971)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Completed a maintenance update. No end-user-visible changes are included in this release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d5a19157-5253-4f67-a64a-4d3fb4515a88

📥 Commits

Reviewing files that changed from the base of the PR and between cf292ba and 4712257.

⛔ Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The package manifest updates the @pulumi/pulumi dependency range from ^3.267.0 to ^3.268.0.

Changes: Pulumi dependency update

Layer / File(s)	Summary
Update Pulumi dependency range package.json	The declared @pulumi/pulumi dependency range changes from ^3.267.0 to ^3.268.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: diazdesandi

Merge Risk: ⚪ Minimal · up to 47122

The Pulumi dependency update resolves to 3.268.0, and no specific compatibility failure is identified. No actionable merge-blocking risk is evident.

### Architecture Summary

Architecture risk: 🔵 Low · up to 47122

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in package.json: The @pulumi/pulumi dependency range was updated from ^3.267.0 to ^3.268.0.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and accurately identifies the dependency update from @pulumi/pulumi 3.267.0 to 3.268.0.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Looks like @pulumi/pulumi is updatable in another way, so this is no longer needed.