Pulumi v3.273.0: resourceExists, Automation API Upgrades, and Removal of pulumi watch

Introduction

Pulumi v3.273.0 was released on 2026-10-28. This is the first tracked release on terraformpilot.com for this project, so there is no prior-version diff — everything below comes directly from the v3.273.0 release notes. The release focuses on three things that matter for day-to-day IaC work: a new resourceExists builtin for safely checking resource existence without adopting it, expanded generated Automation APIs for NodeJS, Python and Go, and the removal of two long-deprecated CLI commands.

What Is New

resourceExists builtin (PCL / programgen / sdkgen)

A new PCL builtin, resourceExists, checks whether a resource with a given ID exists without adopting it into the stack state (#25321). This is useful for conditional logic — e.g., only creating a resource if it doesn't already exist elsewhere.

The engine change backing this passes only inputs, not state, to the provider's Read when performing the existence check, so the check is non-destructive and side-effect-free.

For Node.js, generated SDKs now expose a static exists method on resource classes (#25329), and programgen/nodejs supports resourceExists in generated TypeScript programs:

// Generated-style usage (conceptual)
const alreadyThere = await aws.s3.Bucket.exists("my-bucket-id");
if (!alreadyThere) {
  new aws.s3.Bucket("my-bucket", { ... });
}

Automation API: up and logs generated for NodeJS, Python, Go

The generated Automation APIs for NodeJS, Python and Go gained an up command (#25055) and a logs command (#25065). Teams driving Pulumi programmatically (CI pipelines, custom platforms) can now call these directly through the generated clients instead of shelling out to the CLI for these specific operations.

Deprecated CLI commands removed

Two previously deprecated commands are now gone:

• pulumi watch — removed entirely (#25323)
• the bare pulumi logs command — removed (#25322)

If any scripts or CI jobs still invoke pulumi watch or a bare pulumi logs, they will break on upgrade and need to be updated to use supported alternatives (e.g., pulumi stack output tooling, provider-native log streaming, or the new Automation API logs command above).

AI agent account auto-signup restricted

Pulumi Cloud no longer automatically creates accounts for AI agents unless the environment variable PULUMI_ENABLE_AUTOMATIC_AGENT_SIGNUP is explicitly set (#25402). Related fixes:

• pulumi whoami no longer creates an agent account when not logged in (#25394).
• pulumi login in agent mode now logs in through the browser even when shared agent credentials are valid, instead of silently reusing the ephemeral agent account (#25349).

# Opt back in if your automation relies on agent auto-signup
export PULUMI_ENABLE_AUTOMATIC_AGENT_SIGNUP=true

Other notable fixes

• pulumi login, pulumi whoami --verbose, and pulumi about now link to the Pulumi Cloud console root instead of a per-user page name, avoiding a "Not Found" link for users without a matching-named organization (#25305).
• pulumi package add no longer fails with "version must be provided when package supports packing" when a provider's schema omits its version (#25393).
• pulumi env open / pulumi env run now show formatted diagnostics when an environment fails to evaluate (#25397).
• Secret maps and arrays no longer leak into JSON preview and update output (#25400) — a relevant fix for anyone piping pulumi preview --json or pulumi up --json into tooling.
• pcl hideDiffs now resolves resource output properties instead of input properties (#25399).
• length of a conditional expression with null and a list branch is now allowed in PCL (#25327).
• Go programgen: ApplyT parameters over optional objects/enums are now typed as pointers (#25337), and a tuple-of-optional-strings generation bug is fixed (#25381).
• pulumi install now stops the provider plugin it starts for local SDK generation instead of leaving it running (#25392).

Dependency bumps

Across three batches of changes, the embedded language runtimes/libraries were upgraded: .NET SDK to v3.116.2, YAML to v1.38.15, HCL to v0.19.0, and Java to v1.38.0 (see #25178, #25363, #25426). No action is required beyond re-pulling language plugins if pinned.

Upgrade Steps

Upgrade the CLI:

# macOS/Linux via install script
curl -fsSL https://get.pulumi.com | sh -s -- --version 3.273.0
 
# or via package manager, e.g. Homebrew
brew upgrade pulumi

If you pin the Pulumi version in CI or in a package.json / requirements.txt for the SDK, bump it explicitly:

npm install @pulumi/pulumi@latest
# or
pip install --upgrade pulumi

Before upgrading, grep scripts and CI pipelines for the two removed commands:

grep -rn "pulumi watch\b" .
grep -rn "pulumi logs\b" . | grep -v "pulumi logs -"  # check for bare invocations

Replace any bare pulumi logs calls with the documented stack/log-streaming equivalents, and remove or replace pulumi watch usage.

If you run Pulumi from an automated/agent context and rely on implicit Pulumi Cloud account creation, set PULUMI_ENABLE_AUTOMATIC_AGENT_SIGNUP=true explicitly going forward.

Verify

Confirm the CLI version and that the removed commands are gone:

pulumi version
# expect: v3.273.0
 
pulumi watch
# expect: "unknown command" error
 
pulumi logs
# expect: usage/error requiring a stack flag or subcommand, not the old bare behavior

For projects using the new resourceExists builtin in PCL-derived programs, run a pulumi preview and confirm the resource is only adopted/created when the existence check returns false, with no provider state drift introduced by the check itself.

Conclusion

v3.273.0 is a maintenance-and-polish release: a genuinely new capability (resourceExists) for conditional resource handling, incremental Automation API parity across languages, a JSON-output secret-leak fix worth applying promptly if you parse --json output, and cleanup of two long-deprecated commands plus tighter controls on automatic Pulumi Cloud agent account creation. The main action item before upgrading is auditing CI/scripts for pulumi watch and bare pulumi logs usage.