Skip to content

v1.5.2-release-notes.md

Latest commit

 

History

History
52 lines (41 loc) · 1.99 KB

v1.5.2-release-notes.md

File metadata and controls

52 lines (41 loc) · 1.99 KB
Raw

v1.5.2 Release Notes

This patch publishes all six @hulumi/* packages atomically at 1.5.2 through npm trusted publishing with SLSA Build L3 provenance.

What changed

  • BrokeredAuroraPostgresBoundary registers its raw structured policy contract as component outputs while retaining the aggregate public output. Pulumi can therefore preserve known nested fields when provider-generated leaves are unknown during a first-create preview.
  • The brokered PostgreSQL CrossGuard pack validates all four known IRSA trust policies before accessing provider-generated role ARNs.
  • Missing secret ARNs fail closed.
  • Each broker-boundary component must correlate to its own direct-child SecureSecret, including while the child ARN is provider-unknown.
  • Before provider-output deferral, the policy pack still rejects known malformed IRSA trust plus secret parent and KMS relationships. The remaining structural checks run once their required provider outputs resolve, and the post-apply preview must pass them.

Advisory that remains

The ServiceAccount role annotation is generated from provider output and can remain unknown during the first preview. Hulumi reports that one field as an advisory deferral; a post-apply preview must resolve and validate it. This is not live IAM, Kubernetes, network, PostgreSQL, or tenant-isolation evidence.

What does not ship

This release still does not implement the authorization broker, PostgreSQL bootstrap, migrator, rotation executable, conditional replay claim, or live effective-authorization proof. Consumers must supply and verify those pieces.

Release gates

Before tagging v1.5.2, run:

pnpm install --frozen-lockfile
pnpm run lint:exact-pin-guard
pnpm -r build
pnpm -r typecheck
pnpm -r test
pnpm -r lint
pnpm run lint:license-boundary
pnpm run format:check

The pull-request artifact dry run must also pass. After the trusted tag workflow publishes, verify all six package versions, six SBOMs, six attestations, and public release assets.