pulumi/pulumi · error

serializing checkpoint: %w

Error message

serializing checkpoint: %w

What it means

saveStack wraps an error from marshalVersionedCheckpoint with 'serializing checkpoint'. The deployment produced by the operation could not be serialized into a versioned checkpoint, so nothing was written to the backend. The underlying cause comes from the JSON marshaling step.

Source

Thrown at pkg/backend/diy/state.go:386

	return backupFile, file, nil
}

func (b *diyBackend) saveStack(
	ctx context.Context,
	ref *diyBackendReference,
	deployment apitype.TypedDeployment,
) (string, error) {
	contract.Requiref(ref != nil, "ref", "ref was nil")
	chk, err := stack.DeploymentV3ToCheckpointWithMarshaler(
		diyJSONMarshaler,
		ref.FullyQualifiedName(),
		deployment.Deployment,
		deployment.Version,
		deployment.Features,
	)
	if err != nil {
		return "", fmt.Errorf("serializing checkpoint: %w", err)
	}

	backup, file, err := b.saveCheckpoint(ctx, ref, chk)
	if err != nil {
		return "", err
	}

	if !backend.DisableIntegrityChecking {
		// Finally, *after* writing the checkpoint, check the integrity.  This is done afterwards so that we write
		// out the checkpoint file since it may contain resource state updates.  But we will warn the user that the
		// file is already written and might be bad.
		if verifyerr := snapshot.VerifyIntegrity(deployment.Deployment); verifyerr != nil {
			return "", fmt.Errorf(
				"%s: snapshot integrity failure; it was already written, but is invalid (backup available at %s): %w",
				file, backup, verifyerr)
		}
	}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Inspect the wrapped cause for the specific marshal failure.
2. If secrets-related, confirm the secrets provider is configured and reachable (passphrase set, KMS credentials valid).
3. Retry the operation; transient provider failures may resolve.
4. If reproducible, gather the error and report a bug since deployments should always serialize.

// Confirm secrets provider availability before creating/updating stacks
if (secretsProvider === 'passphrase' && !process.env.PULUMI_CONFIG_PASSPHRASE) {
  throw new Error('passphrase required for this stack\'s secrets provider');
}

try {
  await pulumi.stack.create(name);
} catch (err) {
  if (/serializing checkpoint/.test(err.message)) {
    // read wrapped cause; fix secrets provider or retry
  } else throw err;
}

When it happens

Trigger: saveStack (CreateStack path) after GetDeployment marshalVersionedCheckpoint fails — marshaler cannot encode the deployment/version/features into a VersionedCheckpoint.

Common situations: Secrets provider failures while re-encrypting secrets in the deployment, internal marshal errors on unexpected deployment contents, or corrupted in-memory deployment state.

Related errors

• marshalling checkpoint: %w
• An IO error occurred while marshalling the checkpoint: %w
• serializing deployment: %w
• malformed float value: missing or non-string 'value' field
• malformed float value: unable to parse 'value' field: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/907d484b7e557d44. Report an issue: GitHub.