Hi team, I built docker image with today's pulumi release and I can see that CVE from

stdlib 1.25.6

is still active in

home/.pulumi/bin/pulumi-language-yaml

. I guess it's because golang isn't updated in

‎sdk/pcl/go.mod

file (could you confirm that's the issue?). I created PR to pulumi/pulumi but when I run

make tidy

I get

docs/utils/go.mod is not tidy

message but when running

make tidy_fix

, nothing is changed. Could you advise or just run acceptance criteria bump golang in previously skipped file to check if it's not my machine's issue (I had issues previously)? Thanks, Grzesiek

I don't think yaml got updated and released this week, so it's probably that.

Oh, I thought that entire code is built on each pulumi release. How can I track when yaml will be released?

https://github.com/pulumi/pulumi-yaml We generally only release it if somethings changed in that repo

Oh, and this is the source for yaml language path when I install pulumi with

curl --proto '=https' -L <https://get.pulumi.com> | sh -s -- --version "${PULUMI_VERSION}"

?

yup the built binaries from that repo get downloaded into the pulumi repo and bundled into the pulumi release. So it needs a yaml release, then a pull, then a pulumi release

that makes sense. Do I have to create any PR to main pulumi repo once PR in pulumi-yaml is merged or do you have any auto-bumper for such cases?

well its not automatic but we always check if it needs bumping before a release

I see, can I ask for review? update golang to 1.25.8

yes, I'll escalate to tools team

Hi, it seems newest runs pass, can I ask for rerun for https://github.com/pulumi/pulumi-yaml/actions/runs/23543818779/job/68540682595?pr=1004?

I think this is probably a change of permissions of internal vs external users, I need to ping the tools team about it