github.com/pulumi/esc

Improvements

• Add support for fn::toYAML built-in function that encodes a value as YAML.
  #642

• Report the new revision number when an environment definition is updated (e.g. esc env edit,
  esc env provider, esc env version rollback).
  #666

• Print a retirement notice on every esc command. The standalone ESC CLI has been retired;
  install the Pulumi CLI and use the pulumi env subcommand instead. See
  https://www.pulumi.com/docs/install.
  #669

Bug Fixes

Breaking changes

Improvements

• Add support for fn::toYAML built-in function that encodes a value as YAML. #642

• Report the new revision number when an environment definition is updated (e.g. esc env edit, esc env provider, esc env version rollback). #666

• Print a retirement notice on every esc command. The standalone ESC CLI has been retired; install the Pulumi CLI and use the pulumi env subcommand instead. See https://www.pulumi.com/docs/install. #669

Improvements

Bug Fixes

Breaking changes

Improvements

• Add support for Pulumi ephemeral agent credentials when the ESC CLI is embedded in agent environments #660

• Upgrade Pulumi dependencies to v3.243.0, which updates the required Go toolchain to 1.25.8 #660

Improvements

Bug Fixes

Breaking changes

Improvements

• Add esc env webhook to manage environment webhooks #647

• Add esc env schedule to manage environment scheduled actions #646

• Add new as an alias for esc env init #644

• Surface warnings when editing environments with the CLI #631

• Add esc env referrer list (alias ls) to list entities that reference an environment #645

• Migrate golangci-lint to v2 and enable staticcheck; minor reword of a handful of CLI error messages as a result #648

• Add --output {text,json} to the read-mostly esc env commands (env ls, env version history, env version tag ls, env tag ls/get, env schedule list/get/history, env referrer list, env webhook list/get, env webhook delivery list, env open-request, env settings get) for piping into jq / scripts; the default text rendering is unchanged #656

• Consolidate SilenceUsage / SilenceErrors on the esc root command, matching the pulumi/pulumi pattern; the CLI now prints errors itself rather than relying on cobra #654

• Add esc env provider {aws-login,azure-login,gcp-login} {static,oidc} commands to add login providers to an environment. static writes a static-credentials block; oidc writes a federated-identity block that references cloud-side OIDC resources you provision separately (e.g. with Pulumi). Each supports --create to create the target environment if it does not already exist #649

• Render esc env schedule list, esc env schedule history, esc env referrer list, and esc env version tag ls as tables for consistency with the other esc env ... list commands and with pulumi/pulumi #655

Improvements

• Add warning in CLI when using an ambiguous 2-part environment ref
  #622

• Add support for fn::final built-in function that marks values as final and unable to be overwritten.
  #621

Bug Fixes

Breaking changes

Improvements

• Add warning in CLI when using an ambiguous 2-part environment ref #622

• Add support for fn::final built-in function that marks values as final and unable to be overwritten. #621

Improvements

Bug Fixes

Breaking changes

Improvements

• Add warning when an environment has duplicate top-level keys #615
• Add support for fn::validate built-in function that validates an input against a json schema. #618

Improvements

• Added support for fn::split built-in function to split strings into arrays.
  #281
• Add native support for OIDC token exchange when logging into Pulumi Cloud. Run esc login --help for more
  information. #607

Bug Fixes

Breaking changes

Improvements

• Added support for fn::split built-in function to split strings into arrays. #281
• Add native support for OIDC token exchange when logging into Pulumi Cloud. Run esc login --help for more information. #607

Improvements

• Added deletion protection for environments:
  • Use esc env settings set [<org-name>/][<project-name>/]<environment-name> deletion-protected true to enable deletion protection
  • Use esc env settings get [<org-name>/][<project-name>/]<environment-name> [deletion-protected] to check the current status
  • When enabled, environments cannot be deleted until protection is disabled
  • Deletion protection is disabled by default for new environments

Bug Fixes

• Environment declarations are now returned even in the face of syntax errors.

Breaking changes

Improvements

• Added deletion protection for environments:
  • Use esc env settings set [<org-name>/][<project-name>/]<environment-name> deletion-protected true to enable deletion protection
  • Use esc env settings get [<org-name>/][<project-name>/]<environment-name> [deletion-protected] to check the current status
  • When enabled, environments cannot be deleted until protection is disabled
  • Deletion protection is disabled by default for new environments

Bug Fixes

• Environment declarations are now returned even in the face of syntax errors.

Improvements

• Added support for Open Approvals #592

Bug Fixes

Breaking changes

Improvements

• Added support for Open Approvals #592

Improvements

• Added support for fn::concat built-in function to concatenate arrays.
  #582

Bug Fixes

Breaking changes

Improvements

• Added support for fn::concat built-in function to concatenate arrays. #582

Improvements

• Move --draft out of preview for env edit, env set, env version rollback, env run and env open.
  #566
• Internal improvements
  #569

Bug Fixes

• Fix broken change request URL that links to web console when using --draft with env set, env edit and env version rollback.
  #571

Breaking changes

Improvements

• Move --draft out of preview for env edit, env set, env version rollback, env run and env open. #566
• Internal improvements #569

Bug Fixes

• Fix broken change request URL that links to web console when using --draft with env set, env edit and env version rollback. #571

Improvements

• Update a draft via --draft=<change-request-id> for env edit, env set, and env version rollback. Warning: this feature is in preview, limited to specific orgs, and subject to change. #565
• Open a draft via --draft=<change-request-id> for env run and env open. Warning: this feature is in preview, limited to specific orgs, and subject to change. #565

Improvements

• esc env set now supports --file parameter to read content from a file or stdin #556
• --draft flag for esc env set, esc env edit, esc env versions rollback to create a change request rather than updating directly. Warning: this feature is in preview, limited to specific orgs, and subject to change. #552

Bug Fixes

• Fix decryption error with keys with dashes #559

Improvements

• esc run expects environment to be passed before -- #545
• esc env set uses a more readable YAML format when setting a key in an empty map #548

Bug Fixes

• Fix esc version #541

Bug Fixes

• handle nil in MakeSecret #518

Improvements

• Updated to go 1.23

Bug Fixes

• cmd/esc/cli/env.go: Modified the writeYAMLEnvironmentDiagnostics function to instantiate hcl.NewDiagnosticTextWriter with a width of 0 initially, and then conditionally reinstantiate it with the specified width if it is greater than 0, addressing gosec G115. #494
• No longer error when decrypting invalid secrets outside of values top-level key #491
• Make CLI prefer environment variable PULUMI_BACKEND_URL over account backend URL #477
• Adding cascading secrets into NewSecret method #488

Improvements

• Add --string flag to env set to treat the given value as a string. #467
• Add proper return code to list environments when organization doesn't exist #484

Breaking changes

• It is now a syntax error to call a builtin function incorrectly. 449

Improvements

• Fix diagnostic messages when updating environment with invalid definition #422
• Introduce support for rotating static credentials via fn::rotate providers 432
• Add the rotate CLI command #433
• Add ability to pass specific paths to rotate with the rotate CLI command #440
• Introduce inline environment reference syntax #443
• Introduce rotateOnly inputs #444
• Release rotate environment CLI command #459