Skip to content

[ci] Bump the production-dependencies group across 1 directory with 9 updates - #7617

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/cluster/pulumi/production-dependencies-3dfec01061
Open

[ci] Bump the production-dependencies group across 1 directory with 9 updates#7617
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/cluster/pulumi/production-dependencies-3dfec01061

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 9 updates in the /cluster/pulumi directory:

Package From To
@google-cloud/sql 0.29.0 0.30.0
@pulumi/gcp 9.18.0 9.37.1
@pulumi/github 6.13.1 6.15.0
@pulumi/pulumi 3.247.0 3.268.0
@pulumi/random 4.19.2 4.21.2
js-yaml 4.3.1 4.3.2
zod 4.3.6 4.6.5
@pulumi/auth0 3.39.0 3.55.0
@pulumi/policy 1.20.0 1.21.0

Updates @google-cloud/sql from 0.29.0 to 0.30.0

Release notes

Sourced from @​google-cloud/sql's releases.

sql: v0.30.0

0.30.0 (2026-10-08)

Features

Changelog

Sourced from @​google-cloud/sql's changelog.

0.30.0 (2026-10-08)

Features

0.29.1 (2026-09-28)

Bug Fixes

  • Update package.json and .gitignore across packages (#9378) (9c54cec)
Commits

Updates @pulumi/gcp from 9.18.0 to 9.37.1

Release notes

Sourced from @​pulumi/gcp's releases.

v9.37.1

What's Changed

Full Changelog: pulumi/pulumi-gcp@v9.37.0...v9.37.1

v9.37.0

What's Changed

... (truncated)

Commits
  • b22f13c Remove master.yml now that the default branch is main (#4078)
  • 01a0e4c Add main.yml ahead of renaming the default branch to main (#4075)
  • dec2f68 Update module github.com/pulumi/pulumi/pkg/v3 to v3.267.0 (#4073)
  • d94c251 Update module github.com/pulumi/pulumi/pkg/v3 to v3.267.0 (#4072)
  • 20d6362 Update dependency @​pulumi/pulumi to v3.267.0 (#4071)
  • b226767 Update module github.com/pulumi/pulumi-gcp/sdk/v10 to v10.0.0-rc.1 (#4069)
  • 9469041 Update module github.com/pulumi/pulumi/pkg/v3 to v3.266.0 (#4068)
  • 41a29b3 Update module github.com/pulumi/pulumi/pkg/v3 to v3.266.0 (#4067)
  • 5311bf3 Update dependency @​pulumi/pulumi to v3.266.0 (#4066)
  • 268e7c3 Update module github.com/pulumi/pulumi-cloud-sdk/go to v1.20260928.1311 (#4063)
  • Additional commits viewable in compare view

Updates @pulumi/github from 6.13.1 to 6.15.0

Release notes

Sourced from @​pulumi/github's releases.

v6.15.0

What's Changed

New Contributors

Full Changelog: pulumi/pulumi-github@v6.14.1...v6.15.0

v6.14.1

What's Changed

... (truncated)

Commits

Updates @pulumi/pulumi from 3.247.0 to 3.268.0

Release notes

Sourced from @​pulumi/pulumi's releases.

v3.268.0

3.268.0 (2026-10-07)

Features

  • [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, and providers can process them, gated by a new accepts_outputs_in_invoke handshake capability #24953
  • [auto] Add version to the generated automation APIs for NodeJS, Python and Go #24990
  • [auto] Add whoami to the generated automation APIs for NodeJS, Python and Go #25024
  • [auto] Add install to the generated automation APIs for NodeJS, Python and Go #25038

Bug Fixes

  • [engine] Restore elided asset contents from prior state when a provider echoes assets back from refresh or update #24570
  • [engine] Apply resource transforms declared on an ancestor component to resources parented under a resource read #24689
  • [pcl] Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time #24805
  • [sdkgen/nodejs] Link @pulumi/pulumi types in generated docs to their TypeDoc pages instead of missing anchors #24928
  • [engine] Fix snapshot integrity error when untargeted steps change dependencies in the program #24801
  • [sdk/nodejs] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
  • [sdk/python] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
  • [cli/package] Download plugins from Git repositories whose version tags have no v prefix #24986
  • [engine] Fix a language host process leak when the schema loader boots a plugin that runs in a language host #25002
  • [sdkgen] Reject schemas that define a resource named provider in the root module through moduleFormat, instead of panicking during SDK generation #25020
  • [engine] Shut down plugins in parallel to avoid timeouts #25026
  • [cli/plugin] Fix plugin checksum verification rejecting valid downloads over HTTP/1.1 and ignoring data at the end of the archive #25032
  • [cli/new] Fix spurious provider "exited prematurely" error from the pulumi new credentials check, which no longer has a timeout #25030
  • [auto] Fix project settings in projects that live in symlinked directories #25046

Improvements

  • [backend/service] Send the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set #25009

Miscellaneous

  • [java] Upgrade java to v1.37.4 #25027
  • [yaml] Upgrade yaml to v1.38.9 #25027
  • [hcl] Upgrade hcl to v0.18.4 #25027
  • [sdk/dotnet] Upgrade dotnet to v3.114.2 #25034

v3.267.0

3.267.0 (2026-10-01)

Bug Fixes

  • [cli/new] Fix concurrent pulumi new runs failing to clone the templates repository #24939
  • [sdk/python] Fix pulumi install for Python plugins and policy packs that use the uv toolchain and a [build-system] table #24951

v3.266.0

3.266.0 (2026-09-30)

Bug Fixes

... (truncated)

Changelog

Sourced from @​pulumi/pulumi's changelog.

3.268.0 (2026-10-07)

Features

  • [engine] Negotiate OutputValues on Invoke so SDKs can pass dependency-carrying values in args and receive them in the response, and providers can process them, gated by a new accepts_outputs_in_invoke handshake capability #24953
  • [auto] Add version to the generated automation APIs for NodeJS, Python and Go #24990
  • [auto] Add whoami to the generated automation APIs for NodeJS, Python and Go #25024
  • [auto] Add install to the generated automation APIs for NodeJS, Python and Go #25038

Bug Fixes

  • [engine] Restore elided asset contents from prior state when a provider echoes assets back from refresh or update #24570
  • [engine] Apply resource transforms declared on an ancestor component to resources parented under a resource read #24689
  • [pcl] Unify two recursive object types, or a map with an object, to the same finite type on every run instead of overflowing the stack or picking a different type each time #24805
  • [sdkgen/nodejs] Link @pulumi/pulumi types in generated docs to their TypeDoc pages instead of missing anchors #24928
  • [engine] Fix snapshot integrity error when untargeted steps change dependencies in the program #24801
  • [sdk/nodejs] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
  • [sdk/python] Dynamic providers now fall back to the inputs field of a Read request when properties is empty, so Get continues to work after the engine stops duplicating inputs into state #24977
  • [cli/package] Download plugins from Git repositories whose version tags have no v prefix #24986
  • [engine] Fix a language host process leak when the schema loader boots a plugin that runs in a language host #25002
  • [sdkgen] Reject schemas that define a resource named provider in the root module through moduleFormat, instead of panicking during SDK generation #25020
  • [engine] Shut down plugins in parallel to avoid timeouts #25026
  • [cli/plugin] Fix plugin checksum verification rejecting valid downloads over HTTP/1.1 and ignoring data at the end of the archive #25032
  • [cli/new] Fix spurious provider "exited prematurely" error from the pulumi new credentials check, which no longer has a timeout #25030
  • [auto] Fix project settings in projects that live in symlinked directories #25046

Improvements

  • [backend/service] Send the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set #25009

Miscellaneous

  • [java] Upgrade java to v1.37.4 #25027
  • [yaml] Upgrade yaml to v1.38.9 #25027
  • [hcl] Upgrade hcl to v0.18.4 #25027
  • [sdk/dotnet] Upgrade dotnet to v3.114.2 #25034

3.267.0 (2026-10-01)

Bug Fixes

  • [cli/new] Fix concurrent pulumi new runs failing to clone the templates repository #24939
  • [sdk/python] Fix pulumi install for Python plugins and policy packs that use the uv toolchain and a [build-system] table #24951

3.266.0 (2026-09-30)

Bug Fixes

  • [sdk/go] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #24702
  • [sdk/python] Use an explicit provider for resources from an extension package, instead of falling back to a default provider #24702
  • [pcl] Order the members of a union type by a fixed structural order rather than by their printed form, so that a recursive object type prints all of its properties and diagnostics list union members consistently #24804
  • [cli/new] Avoid printing the provider docs link twice in the pulumi new credentials warning #24925

... (truncated)

Commits

Updates @pulumi/random from 4.19.2 to 4.21.2

Release notes

Sourced from @​pulumi/random's releases.

v4.21.2

What's Changed

Full Changelog: pulumi/pulumi-random@v4.21.1...v4.21.2

v4.21.1

What's Changed

... (truncated)

Commits

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.
Commits

Updates zod from 4.3.6 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

  • b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
  • dd9c36fa fix(v4): defer recursive object index inference (#6580)
  • 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
  • 2efa8b80 ci: give the npm wait a real budget and drop the back-publish...

    Description has been truncated

@dependabot dependabot Bot added the static Used to label PRs for which static tests suffice label Oct 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/cluster/pulumi/production-dependencies-3dfec01061 branch 7 times, most recently from 0996404 to 75e0058 Compare October 9, 2026 18:58
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/cluster/pulumi/production-dependencies-3dfec01061 branch 3 times, most recently from 599e9fd to 89997b0 Compare October 15, 2026 18:45
@dependabot
[ci] Bump the production-dependencies group across 1 directory with 9…
4c8ac30 
… updates

Bumps the production-dependencies group with 9 updates in the /cluster/pulumi directory:

| Package | From | To |
| --- | --- | --- |
| [@google-cloud/sql](https://github.com/googleapis/google-cloud-node/tree/HEAD/packages/google-cloud-sql) | `0.29.0` | `0.30.0` |
| [@pulumi/gcp](https://github.com/pulumi/pulumi-gcp) | `9.18.0` | `9.37.1` |
| [@pulumi/github](https://github.com/pulumi/pulumi-github) | `6.13.1` | `6.15.0` |
| [@pulumi/pulumi](https://github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs) | `3.247.0` | `3.268.0` |
| [@pulumi/random](https://github.com/pulumi/pulumi-random) | `4.19.2` | `4.21.2` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.6.5` |
| [@pulumi/auth0](https://github.com/pulumi/pulumi-auth0) | `3.39.0` | `3.55.0` |
| [@pulumi/policy](https://github.com/pulumi/pulumi-policy) | `1.20.0` | `1.21.0` |



Updates `@google-cloud/sql` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-sql/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/v0.30.0/packages/google-cloud-sql)

Updates `@pulumi/gcp` from 9.18.0 to 9.37.1
- [Release notes](https://github.com/pulumi/pulumi-gcp/releases)
- [Changelog](https://github.com/pulumi/pulumi-gcp/blob/main/CHANGELOG_OLD.md)
- [Commits](pulumi/pulumi-gcp@v9.18.0...v9.37.1)

Updates `@pulumi/github` from 6.13.1 to 6.15.0
- [Release notes](https://github.com/pulumi/pulumi-github/releases)
- [Changelog](https://github.com/pulumi/pulumi-github/blob/master/CHANGELOG_OLD.md)
- [Commits](pulumi/pulumi-github@v6.13.1...v6.15.0)

Updates `@pulumi/pulumi` from 3.247.0 to 3.268.0
- [Release notes](https://github.com/pulumi/pulumi/releases)
- [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/pulumi/pulumi/commits/v3.268.0/sdk/nodejs)

Updates `@pulumi/random` from 4.19.2 to 4.21.2
- [Release notes](https://github.com/pulumi/pulumi-random/releases)
- [Changelog](https://github.com/pulumi/pulumi-random/blob/master/CHANGELOG_OLD.md)
- [Commits](pulumi/pulumi-random@v4.19.2...v4.21.2)

Updates `js-yaml` from 4.3.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.1...4.3.2)

Updates `zod` from 4.3.6 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.6.5)

Updates `@pulumi/auth0` from 3.39.0 to 3.55.0
- [Release notes](https://github.com/pulumi/pulumi-auth0/releases)
- [Changelog](https://github.com/pulumi/pulumi-auth0/blob/master/CHANGELOG_OLD.md)
- [Commits](pulumi/pulumi-auth0@v3.39.0...v3.55.0)

Updates `@pulumi/policy` from 1.20.0 to 1.21.0
- [Changelog](https://github.com/pulumi/pulumi-policy/blob/main/CHANGELOG.md)
- [Commits](pulumi/pulumi-policy@v1.20.0...v1.21.0)

---
updated-dependencies:
- dependency-name: "@google-cloud/sql"
  dependency-version: 0.29.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@pulumi/auth0"
  dependency-version: 3.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@pulumi/gcp"
  dependency-version: 9.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@pulumi/github"
  dependency-version: 6.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@pulumi/policy"
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@pulumi/pulumi"
  dependency-version: 3.264.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@pulumi/random"
  dependency-version: 4.21.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/cluster/pulumi/production-dependencies-3dfec01061 branch from 89997b0 to 4c8ac30 Compare October 16, 2026 18:44

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@martinflorian-da martinflorian-da

@mblaze-da mblaze-da

@krzysztofczyz-da krzysztofczyz-da

Labels

static Used to label PRs for which static tests suffice

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@martinflorian-da @mblaze-da @krzysztofczyz-da