4.9.0 regenerates passwords

[mortaelth]

What happened?

We have following code

const token = new random.RandomPassword(
    core.prefix("access-token"),
    {
        length: 16,
        overrideSpecial: "_%@:",
        special: true,
    },
    {
        parent: rootResource,
        additionalSecretOutputs: ["result"],
        aliases: [{ parent: sharedKeyVault.urn }],
    }
);

after upgrade from 4.8.2 to 4.9.0, the output was regenerated

Expected Behavior

Upgrade of the library will not regenerate the output.

Steps to reproduce

as above

Output of pulumi about

CLI
Version 3.51.1
Go Version go1.19.4
Go Compiler gc

Plugins
NAME VERSION
azure 5.32.0
azure-native 1.93.0
azuread 4.3.0
grafana 0.0.5
kubernetes 3.23.1
nodejs unknown
random 4.9.0

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[t0yv0]

Thank you for this issue, this appears to be indeed a miss on our end.

I was able to repro an the issue is that Pulumi generates a Replace plan because of this diff:

DIFF: AttributeName("numeric"): value1: tftypes.Bool<null>, value2: tftypes.Bool<"true">

The upstream provider now implements state migrations that would have corrected "numeric" attribute to its default value:
https://github.com/https://github.com/terraform-providers/terraform-provider-random/blob/85a935b41296ee993960046f7ff3b1043d3051e3/internal/provider/resource_password.go#L164-#L164

But the state upgrade feature is not yet implemented in the bridge:
pulumi/pulumi-terraform-bridge#748

// import * as pulumi from "@pulumi/pulumi";
import * as random from "@pulumi/random";

const token = new random.RandomPassword(
    "access-token-",
    {
        length: 16,
        overrideSpecial: "_%@:",
        special: true,
    },
    {
        // parent: rootResource,
        additionalSecretOutputs: ["result"],
        // aliases: [{ parent: sharedKeyVault.urn }],
    }
);

export const x = token.result;

#!/usr/bin/env bash

set -euo pipefail

pulumi destroy --yes

npm i @pulumi/random@4.8.0
jq '.packages["node_modules/@pulumi/random"].version' package-lock.json
pulumi up --yes --skip-preview
pulumi stack output --show-secrets

npm i @pulumi/random@4.9.0
jq '.packages["node_modules/@pulumi/random"].version' package-lock.json
PULUMI_DEBUG_GRPC=$PWD/replace.json pulumi up --yes --skip-preview
pulumi stack output --show-secrets

I'm looking into getting state upgrades supported and then will circle back to release a new version of pulumi-random that fixes the problem.

[t0yv0]

We've pulled the release and reverted the changes in 4.10.0. Apologies for the disruption!