Highlights

We have updated our runc dependency to address the following runc CVEs:

• GHSA-m8cg-xc2p-r3fc
• GHSA-vpvm-3wq2-2wvm
• GHSA-g2j6-57v7-gm8c

Using custom values defined in porter.yaml in your custom Dockerfile has been modified so that only used variables are passed. See https://getporter.org/bundle/custom-dockerfile/#custom-build-arguments for details.

What's Changed

• Document why we use require in long tests by @carolynvs in #2643
• Improve passing custom values as build arguments by @carolynvs in #2641
• Refactor CNAB package in preparation for dependencies v2 by @carolynvs in #2658
• Accessibility fix list by @Arhell in #2642
• Bump google.golang.org/grpc from 1.53.0 to 1.54.0 by @dependabot in #2655
• Bump github.com/hashicorp/go-hclog from 1.4.0 to 1.5.0 by @dependabot in #2654
• Bump go.mongodb.org/mongo-driver from 1.11.2 to 1.11.3 by @dependabot in #2652
• Remove name field from CNAB dependency representation in bundle.json by @carolynvs in #2660
• Bump github.com/opencontainers/runc from 1.1.3 to 1.1.5 by @dependabot in #2664
• Updates to bundle schema v1.0.1 by @carolynvs in #2665

Full Changelog: v1.0.10...v1.0.11

What's Changed

• Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 by @dependabot in #2603
• Bump github.com/spf13/afero from 1.9.3 to 1.9.4 by @dependabot in #2602
• Bump github.com/docker/buildx from 0.10.2 to 0.10.3 by @dependabot in #2600
• remove overflow in blog article by @Arhell in #2605
• Bump get.porter.sh/magefiles from 0.4.0 to 0.5.0 by @dependabot in #2601
• update website hugo by @Arhell in #2599
• update hugo launch option by @Arhell in #2613
• Remove assign to project github workflow by @carolynvs in #2612
• Bump github.com/mmcdole/gofeed from 1.2.0 to 1.2.1 by @dependabot in #2619
• Bump github.com/containerd/containerd from 1.6.18 to 1.6.19 by @dependabot in #2618
• Support downloading any release artifact through Netlify by @carolynvs in #2610
• Include arm64 binaries when we publish a mixin by @carolynvs in #2611
• Bump github.com/moby/buildkit from 0.11.3 to 0.11.4 by @dependabot in #2620
• Bump github.com/docker/buildx from 0.10.3 to 0.10.4 by @dependabot in #2623
• Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.13.0 to 1.14.0 by @dependabot in #2624
• Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.39.0 to 0.40.0 by @dependabot in #2617
• Accessibility update home page "Get Started" btn by @Arhell in #2622
• Bump google.golang.org/protobuf from 1.28.1 to 1.30.0 by @dependabot in #2634
• Build with Go 1.19.7 by @carolynvs in #2639
• Bump github.com/grpc-ecosystem/go-grpc-middleware from 1.3.0 to 1.4.0 by @dependabot in #2637
• Bump github.com/spf13/afero from 1.9.4 to 1.9.5 by @dependabot in #2635
• fix cncf img on mobile by @Arhell in #2632
• Update Microsoft usage in adopters.md by @carolynvs in #2631

Full Changelog: v1.0.9...v1.0.10

What's Changed

• adding an alternative site launch option by @Arhell in #2562
• Fix associated Porter version for 1.0.1 manifest schema by @carolynvs in #2580
• Bump github.com/containerd/containerd from 1.6.17 to 1.6.18 by @dependabot in #2582
• fix not loading fonts by @Arhell in #2581
• Bump golang.org/x/net from 0.4.0 to 0.7.0 by @dependabot in #2586
• Bump go.mongodb.org/mongo-driver from 1.11.1 to 1.11.2 by @dependabot in #2590
• add hugo lock to gitignore by @Arhell in #2588
• Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.37.0 to 0.39.0 by @dependabot in #2589
• Bump github.com/moby/buildkit from 0.11.2 to 0.11.3 by @dependabot in #2592
• Bump google.golang.org/grpc from 1.52.3 to 1.53.0 by @dependabot in #2591
• Default bundles to schemaVersion 1.0.1 by @carolynvs in #2583
• Sync manifest 1.0.0 and 1.0.1 docs with supported schema by @carolynvs in #2593
• update current year by @Arhell in #2596
• Update cnab-go and cnab-to-oci by @carolynvs in #2597

Full Changelog: v1.0.8...v1.0.9

Highlights

We have a bunch of fixes and improvements in this patch release and I wanted to call out some that you may be interested in:

• Add --autobuild-disabled flag by @carolynvs in #2573. When running porter from inside a bundle directory, porter will automatically rebuild the bundle when it detects that it is out of date before running some commands (such as publish). You can disable this behavior with the --autobuild-disabled flag, PORTER_AUTOBUILD_DISABLED environment variable or the autobuild-disabled setting in your configuration file.
• Consistently set and use SchemaType when exporting/importing by @carolynvs in #2428. Porter will now validate the schemaType field when present when importing resources with the apply command.
• Refactor param resolution by @carolynvs in #2476. When executing a bundle, porter considers many sources of parameter data, such as flags, parameter sets, previously used parameters, and bundle defaults. Porter now will reuse previously specified parameter values from the last run of a bundle when a parameter isn't specified. This simplifies upgrading to the latest version of a bundle, with just porter upgrade --version v1.2.3 and you don't need to re-specify all the parameters. See https://getporter.org/parameters/ for a walkthrough of how Porter resolves parameter values.

What's Changed

• Update codeowners with active reviewers by @carolynvs in #2544
• Announce 2023 roadmap by @carolynvs in #2545
• Refactor param resolution by @carolynvs in #2476
• Address go-restful CVE-2022-1996 by @carolynvs in #2547
• fix typo in quickstart documents by @cw-Guo in #2551
• Validate reserved names by @Simpcyclassy in #2434
• Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.11.2 to 1.12.0 by @dependabot in #2553
• Bump github.com/mmcdole/gofeed from 1.1.3 to 1.2.0 by @dependabot in #2554
• Fix support for numeric types by @carolynvs in #2557
• fix navigation on mobile by @Arhell in #2559
• Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.11.2 to 1.13.0 by @dependabot in #2568
• Improve trace data when reconciling an installation by @carolynvs in #2564
• Add --autobuild-disabled flag by @carolynvs in #2573
• Bump go.opentelemetry.io/otel/exporters libraries by @carolynvs in #2574
• add favicons for all devices by @Arhell in #2567
• Consistently set and use SchemaType when exporting/importing by @carolynvs in #2428
• Bump github.com/containerd/containerd from 1.6.16 to 1.6.17 by @dependabot in #2572
• Bump Docker to v23.0.1 by @carolynvs in #2577
• Use Go 1.19.6 by @carolynvs in #2578

New Contributors

• @cw-Guo made their first contribution in #2551
• @Arhell made their first contribution in #2559

Full Changelog: v1.0.7...v1.0.8

What's Changed

• Use SetupDCO magefile target in magefiles repository by @carolynvs in #2533
• Bump github.com/google/go-containerregistry from 0.12.1 to 0.13.0 by @dependabot in #2540
• Bump google.golang.org/grpc from 1.52.0 to 1.52.3 by @dependabot in #2538
• Ensure lint warnings are printed by @jmhbnz in #2534
• Update logger on context when finished loading configuration by @carolynvs in #2541
• Workaround apple silicon codesigning cache bug by @carolynvs in #2543

New Contributors

• @jmhbnz made their first contribution in #2534

Full Changelog: v1.0.6...v1.0.7

Breaking Change

This release contains a fix for the plugins file schema. If you have existing plugins file, please update it to match the newly release schema.
For more details, please read the new blog post

• check for plugins file schema version and type by @VinozzZ in #2532

Other Change

• Bump github.com/moby/buildkit from 0.11.0 to 0.11.1 by @dependabot in #2528

Full Changelog: v1.0.5...v1.0.6

Highlight

• Install multiple plugins by passing in a file argument to porter plugins install by @VinozzZ in #2504
• Replaced tar to improve consistency of archived bundles by @jarnfast in #2363

What's Changed

• Added Documentation for lint codes by @0xquark in #2493
• Sync az mixin documentation by @carolynvs in #2498
• Bump go.opentelemetry.io/otel/trace from 1.11.1 to 1.11.2 by @dependabot in #2494
• Bump get.porter.sh/magefiles from 0.3.2 to 0.3.3 by @dependabot in #2495
• Bump github.com/google/go-containerregistry from 0.12.0 to 0.12.1 by @dependabot in #2496
• Bump github.com/Masterminds/semver/v3 from 3.1.1 to 3.2.0 by @dependabot in #2497
• Bump github.com/containerd/containerd from 1.6.12 to 1.6.14 by @dependabot in #2500
• Bump go.mongodb.org/mongo-driver from 1.11.0 to 1.11.1 by @dependabot in #2501
• Bump go.uber.org/zap from 1.23.0 to 1.24.0 by @dependabot in #2502
• Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.11.1 to 1.11.2 by @dependabot in #2507
• Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.36.4 to 0.37.0 by @dependabot in #2508
• Bump github.com/hashicorp/go-hclog from 1.3.1 to 1.4.0 by @dependabot in #2499
• Bump github.com/moby/buildkit from 0.10.5 to 0.10.6 by @dependabot in #2509
• Bump github.com/mattn/go-isatty from 0.0.16 to 0.0.17 by @dependabot in #2510
• Fix minor typo in 'skipConfig' docstring by @omarkohl in #2506
• Bump github.com/containerd/containerd from 1.6.14 to 1.6.15 by @dependabot in #2512
• Add missing "Contributing Guide" link to "Contributor Ladder" by @omarkohl in #2513
• only call EnsureStaticCheck once by @VinozzZ in #2515
• Install multiple plugins by passing in a file argument to porter plugins install by @VinozzZ in #2504
• Replaced tar to improve consistency of archived bundles by @jarnfast in #2363
• Bump github.com/dustin/go-humanize from 1.0.0 to 1.0.1 by @dependabot in #2519
• Bump get.porter.sh/magefiles from 0.3.3 to 0.3.4 by @dependabot in #2521
• Bump google.golang.org/grpc from 1.51.0 to 1.52.0 by @dependabot in #2522
• Bump github.com/moby/buildkit from 0.10.6 to 0.11.0 by @dependabot in #2520
• Fix help test for plugins install --file flag by @VinozzZ in #2527

New Contributors

• @0xquark made their first contribution in #2493
• @omarkohl made their first contribution in #2506

Full Changelog: v1.0.4...v1.0.5

What's Changed

• Bump github.com/pelletier/go-toml from 1.9.4 to 1.9.5 by @dependabot in #2484
• Bump github.com/spf13/cobra from 1.6.0 to 1.6.1 by @dependabot in #2480
• Bump github.com/spf13/afero from 1.9.2 to 1.9.3 by @dependabot in #2481
• Bump github.com/containerd/containerd from 1.6.9 to 1.6.10 by @dependabot in #2482
• Trace sensitive attributes in custom dev builds by @carolynvs in #2478
• Update to Go 1.19.4 by @carolynvs in #2489
• Do not print unsupported mixin command errors by @carolynvs in #2488
• Bump github.com/containerd/containerd from 1.6.10 to 1.6.12 by @dependabot in #2490

Full Changelog: v1.0.3...v1.0.4

Highlights

• Ensure that the mixins used in a bundle are always called in the same order when the bundle is built which improves performance and layer caching/reuse. #2472
• The porter explain command includes if a parameter is sensitive now in the yaml/json output by @MadhuMPandurangi in #2440

What's Changed

• Split codeql from trivy by @carolynvs in #2449
• Bump github.com/olekukonko/tablewriter from 0.0.4 to 0.0.5 by @dependabot in #2445
• Bump github.com/stretchr/testify from 1.8.0 to 1.8.1 by @dependabot in #2441
• Bump github.com/moby/buildkit from 0.10.0 to 0.10.5 by @dependabot in #2443
• Bump go.uber.org/zap from 1.17.0 to 1.23.0 by @dependabot in #2456
• Bump github.com/containerd/containerd from 1.6.8 to 1.6.9 by @dependabot in #2455
• Support debugging smoke tests by @carolynvs in #2452
• Include stack traces when we recover a panic in EndSpan by @carolynvs in #2453
• Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.10.0 to 1.11.1 by @dependabot in #2442
• Bump otel libraries to 1.11.1 by @carolynvs in #2459
• Fix UpdateTestFiles target by @carolynvs in #2460
• Includes sensitive flag in yaml/json output of porter explain. by @MadhuMPandurangi in #2440
• Bump github.com/mattn/go-colorable from 0.1.12 to 0.1.13 by @dependabot in #2462
• Bump gopkg.in/AlecAivazis/survey.v1 from 1.8.7 to 1.8.8 by @dependabot in #2463
• Bump github.com/mitchellh/mapstructure from 1.4.2 to 1.5.0 by @dependabot in #2465
• Bump go.mongodb.org/mongo-driver from 1.7.1 to 1.11.0 by @dependabot in #2466
• Bump google.golang.org/grpc from 1.50.1 to 1.51.0 by @dependabot in #2464
• Explain v0 to v1 migration by @carolynvs in #2475
• Sort mixin output in order declared by @carolynvs in #2472
• Fix spelling of default so I stop doubting my ability to spell by @carolynvs in #2477
• Fix credentials tutorial bundle ref in quickstarts by @carolynvs in #2479

New Contributors

• @MadhuMPandurangi made their first contribution in #2440

Full Changelog: v1.0.2...v1.0.3

What's Changed

• Update install instructions to use v1.0.1 by @carolynvs in #2419
• Bump github.com/hashicorp/go-hclog from 0.14.1 to 1.3.1 by @dependabot in #2421
• Bump github.com/stretchr/testify from 1.7.1 to 1.8.0 by @dependabot in #2423
• Bump github.com/cnabio/cnab-go from 0.24.0 to 0.24.1 by @dependabot in #2424
• Update installation instructions for plugins/mixins by @carolynvs in #2427
• Bump github.com/mmcdole/gofeed from 1.0.0-beta2 to 1.1.3 by @dependabot in #2431
• Bump github.com/google/go-cmp from 0.5.8 to 0.5.9 by @dependabot in #2429
• Bump go.opentelemetry.io/otel/trace from 1.10.0 to 1.11.1 by @dependabot in #2432
• Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.10.0 to 1.11.1 by @dependabot in #2430
• Bump github.com/google/go-containerregistry from 0.5.1 to 0.12.0 by @dependabot in #2433
• Split Installation into a spec and status by @carolynvs in #2435
• Compile with Go 1.19.3, update go-restful by @carolynvs in #2448

Full Changelog: v1.0.1...v1.0.2