What's New

More Control Over Builds

• Exposed additional BuildKit options giving you finer control over how bundles are built (#3371)
• Porter now auto-detects when builds are needed, saving you manual steps (#3502)
• Parent directories for state files are automatically created when missing (#3431)

Smarter Output Management

• Added --run option to installation outputs list/show commands, letting you view outputs from specific bundle runs (#3428)
• Better handling of file parameters with object types (#3487), including proper validation (#3498)

Security Improvements

• Sub-properties of sensitive object parameters are now properly masked in logs, preventing accidental credential leaks (#3501)

Bug Fixes

• Fixed parameter set creation timestamp not being set correctly on initial application (#3500)
• Eliminated race condition during mixin installation that could cause failures (#3503)

Breaking Changes

• Removed client Docker image - use the porter CLI binary directly instead (#3496)

Housekeeping

• Install scripts migrated to use /download/ CDN prefix (#3491, #3492)
• Added documentation guide for persisting data between bundle actions (#3493)
• Updated parameter set documentation (#3468)
• Integration tests no longer start test cluster unnecessarily (#3507)
• Dependency updates across the board for security and stability

Thanks to our contributors: @erikced, @lbergnehr, @kichristensen, @dgannon991, and dependabot!

Pull Requests

• Chore(deps): Bump github.com/prometheus/client_golang from 1.22.0 to 1.23.0 by @dependabot[bot] in #3425
• Chore(deps): Bump github.com/docker/cli from 28.3.2+incompatible to 28.3.3+incompatible by @dependabot[bot] in #3426
• feat: add run option to installation outputs list/show by @lbergnehr in #3428
• Chore(deps): Bump google.golang.org/protobuf from 1.36.6 to 1.36.7 by @dependabot[bot] in #3429
• Expose more buildkit build options by @erikced in #3371
• Chore(deps): Bump github.com/docker/buildx from 0.25.0 to 0.26.1 by @dependabot[bot] in #3421
• feat: create state file parent directory if it doesn't exist by @kichristensen in #3431
• Chore(deps): Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 in the go_modules group by @dependabot[bot] in #3434
• Chore(deps): Bump google.golang.org/protobuf from 1.36.7 to 1.36.8 by @dependabot[bot] in #3437
• Chore(deps): Bump google.golang.org/grpc from 1.74.2 to 1.75.0 by @dependabot[bot] in #3439
• Setup permission in workflows by @kichristensen in #3433
• Fix pipeline permissions by @kichristensen in #3440
• Add package write permission to canary Github Action by @kichristensen in #3441
• Chore(deps): Bump github.com/docker/buildx from 0.26.1 to 0.27.0 by @dependabot[bot] in #3438
• Add missing permission to Porter release integration test Github Action by @kichristensen in #3442
• Chore(deps): Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 by @dependabot[bot] in #3444
• Chore(deps): Bump go.opentelemetry.io/otel from 1.37.0 to 1.38.0 by @dependabot[bot] in #3443
• Chore(deps): Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.38.0 by @dependabot[bot] in #3445
• Chore(deps): Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #3446
• Chore(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.37.0 to 1.38.0 by @dependabot[bot] in #3447
• Chore(deps): Bump github.com/docker/cli from 28.3.3+incompatible to 28.4.0+incompatible by @dependabot[bot] in #3448
• Chore(deps): Bump github.com/moby/buildkit from 0.23.0-rc1.0.20250806140246-955c2b2f7d01 to 0.24.0 by @dependabot[bot] in #3449
• Chore(deps): Bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by @dependabot[bot] in #3453
• Chore(deps): Bump github.com/spf13/pflag from 1.0.9 to 1.0.10 by @dependabot[bot] in #3450
• Chore(deps): Bump github.com/olekukonko/tablewriter from 0.0.5 to 1.0.9 by @dependabot[bot] in #3435
• Chore(deps): Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.62.0 to 0.63.0 by @dependabot[bot] in #3451
• Chore(deps): Bump github.com/spf13/afero from 1.14.0 to 1.15.0 by @dependabot[bot] in #3452
• Chore(deps): Bump github.com/spf13/viper from 1.20.1 to 1.21.0 by @dependabot[bot] in #3458
• Chore(deps): Bump google.golang.org/grpc from 1.75.0 to 1.75.1 by @dependabot[bot] in #3456
• Chore(deps): Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.37.0 to 1.38.0 by @dependabot[bot] in #3455
• Chore(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.37.0 to 1.38.0 by @dependabot[bot] in #3457
• Chore(deps): Bump github.com/docker/docker from 28.3.3+incompatible to 28.4.0+incompatible by @dependabot[bot] in #3454
• Grouped minor and patch updates by @dgannon991 in #3460
• Update dependabot.yml to fix indentation error by @dgannon991 in #3461
• Chore(deps): Bump the go-dependencies group with 4 updates by @dependabot[bot] in #3467
• Chore(deps): Bump actions/cache from 3 to 4 by @dependabot[bot] in #3462
• Chore(deps): Bump actions/upload-artifact from 4.4.0 to 4.6.2 by @dependabot[bot] in #3464
• Chore(deps): Bump actions/download-artifact from 4.1.8 to 5.0.0 by @dependabot[bot] in #3466
• Chore(deps): Bump actions/setup-go from 4 to 6 by @dependabot[bot] in #3465
• Chore(deps): Bump actions/checkout from 3 to 5 by @dependabot[bot] in #3463
• Update ParameterSet documentation by @erikced in #3468
• Chore(deps): Bump the go-dependencies group with 5 updates by @dependabot[bot] in #3470
• Chore(deps): Bump docker/login-action from 3.0.0 to 3.6.0 by @dependabot[bot] in #3472
• Chore(deps): Bump github/codeql-action from 2 to 3 by @dependabot[bot] in #3471
• Fix image tag resolution from version by @erikced in #3473
• Chore(deps): Bump the go-dependencies group with 4 updates by @dependabot[bot] in #3475
• Chore(deps): Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #3476
• Chore(deps): Bump the go-dependencies group with 3 updates by @dependabot[bot] in #3477
• Chore(deps): Bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #3478
• Chore(deps): Bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #3479
• Chore(deps): Bump go.mongodb.org/mongo-driver from 1.17.4 to 1.17.6 in the go-dependencies group by @dependabot[bot] in #3480
• Chore(deps): Bump github.com/containerd/containerd/v2 from 2.1.4 to 2.2.0 by @dependabot[bot] in #3482
• Chore(deps): Bump github.com/containerd/containerd from 1.7.28 to 1.7.29 by @dependabot[bot] in #3483
• Chore(deps): Bump the go-dependencies group with 5 updates by @dependabot[bot] in #3484
• Chore(deps): Bump the go-dependencies group with 4 updates by @dependabot[bot] in #3485
• Chore(deps): Bump golang.org/x/crypto from 0.42.0 to 0.45.0 by @dependabot[bot] in #3490
• doc: update monogodb migration documentation by @erikced in #3489
• Object file parameter by @kichristensen in #3487
• Chore(deps): Bump actions/checkout from 5 to 6 by @dependabot[bot] in #3495
• Add /download/ prefix to cdn.porter.sh redirect rules by @kichristensen in #3491
• Fix parameter set creation timestamp not being set on first apply by @kichristensen in #3500
• Validate file parameter defaults are base64 encoded by @kichristensen in #3498
• Add guide for persisting data between actions by @kichristensen in #3493
• Update install scripts to use /download/ prefix for CDN by @kichristensen in #3492
• Mask sub-properties of sensitive object parameters in logs by @kichristensen in #3501
• Prevent race condition in mixin installation by @kichristensen in #3503
• Remove client Docker image by @kichristensen in #3496
• Auto build detection by @kichristensen in #3502
• Bumped to 1.24.10 by @dgannon991 in #3505
• Chore(deps): Bump the go-dependencies group with 6 updates by @dependabot[bot] in #3494
• fix: grant required permissions to release workflow by @kichristensen in #3510
• docs: remove Twitter account references by @kichristensen in #3511
• Do not start test cluster for integration tests by @kichristensen in #3507

Full Changelog: v1.3.0...v1.4.0