Pulumi is adding access token expiry by default

Pulumi has added a new access token expiry policy. Tokens now expire after a configurable window instead of living forever. Anyone using Pulumi for infrastructure-as-code is affected — if you've got a long-lived token sitting around, this changes the security surface.

Long-lived tokens are a known problem. When they get leaked, they keep working until someone notices. The new policy means expired tokens stop working automatically, which is a real security win for teams running Pulumi at scale.

Why this matters for us: every org that's been using Pulumi with a token sitting around forever just got a free security upgrade they didn't have to ask for.