Dependencies

Top-level external dependencies of pulumi/pulumi.

Go modules

The repo is a multi-module workspace. Major modules:

Module	Path	go.mod size
github.com/pulumi/pulumi/pkg/v3	pkg/	~14 KB
github.com/pulumi/pulumi/sdk/v3	sdk/	~7 KB
(tests)	tests/	~16 KB
pulumi-language-go	sdk/go/pulumi-language-go/	small
pulumi-language-nodejs	sdk/nodejs/cmd/pulumi-language-nodejs/	small
pulumi-language-python	sdk/python/cmd/pulumi-language-python/	small
pulumi-pcl	sdk/pcl/	small

Cross-module updates are coordinated via make tidy and a go.work file generated by make work (gitignored).

Notable runtime Go dependencies

• github.com/spf13/cobra — the CLI command tree.
• google.golang.org/grpc — every inter-process call.
• google.golang.org/protobuf — proto serialization.
• gocloud.dev — abstracts S3/GCS/Azure Blob in the DIY backend (and KMS providers in pkg/secrets/cloud/).
• github.com/hashicorp/hcl/v2 — substrate for PCL.
• github.com/zclconf/go-cty — HCL2's value model, used by PCL.
• github.com/santhosh-tekuri/jsonschema — schema validation.
• github.com/segmentio/encoding — fast JSON for snapshot serialization.
• go.opentelemetry.io/otel — tracing.
• pgregory.net/rapid — property-based testing in pkg/engine/lifecycletest/.
• github.com/stretchr/testify — test assertions.
• github.com/iwahbe/helpmakego — small build helper for module discovery.
• go.abhg.dev/requiredfield — custom golangci-lint plugin.

Node.js dependencies (sdk/nodejs/)

Public API: @pulumi/pulumi. Notable runtime deps from package.json:

• @grpc/grpc-js + google-protobuf — gRPC and proto.
• semver — version resolution.
• fdir — fast directory traversal.
• upath — cross-platform path normalization.

Dev tooling: typescript, @biomejs/biome, eslint, mocha, chai, tsx.

The sdk/nodejs/yarn.lock (~195 KB) pins everything reproducibly.

Python dependencies (sdk/python/)

Public package: pulumi on PyPI. Runtime deps from pyproject.toml (managed via uv):

• grpcio + protobuf — gRPC and proto.
• semver — version resolution.
• dill — extended pickling for dynamic providers.
• pyyaml — YAML support.

Dev: ruff (lint), pytest, mypy. The sdk/python/uv.lock (~271 KB) pins everything reproducibly.

Documentation (docs/)

Sphinx-based; docs/pyproject.toml pulls in:

• sphinx + theme.
• myst-parser — markdown support.

Built locally with uv run python make.py build from docs/. Published via ReadTheDocs (.readthedocs.yaml).

CI tooling

GitHub Actions, configured under .github/workflows/. Notable third-party actions used:

• actions/checkout, actions/setup-go, actions/setup-node, actions/setup-python (standard).
• goreleaser/goreleaser-action — release.yml.
• crazy-max/ghaction-import-gpg — sign.yml.

Update policy

• Renovate (renovate.json5) auto-bumps dependencies. PRs land with pulumi-renovate[bot].
• Major version bumps require a maintainer's approval; renovate groups them separately.
• scripts/renovate-changelog.py generates changelog entries for renovate PRs.

See also

• Tooling
• Configuration