chore(deps): Bump the go-dependencies group with 3 updates

[dependabot]

Bumps the go-dependencies group with 3 updates: get.porter.sh/porter, github.com/aws/aws-sdk-go-v2/config and github.com/aws/aws-sdk-go-v2/service/secretsmanager.

Updates get.porter.sh/porter from 1.5.0 to 1.6.0

Release notes

Sourced from get.porter.sh/porter's releases.

v1.6.0

New Features

• MCP server — porter mcp starts an MCP server over stdio so AI coding assistants (Claude Code, Cursor, VS Code Copilot, etc.) can explain bundles, list installations, and drive Porter with natural language (#3577)
• File sources (experimental) — declare files in porter.yaml to have Porter download HTTP/HTTPS files automatically during porter build, instead of pre-placing them in the bundle directory (#3614)
• Dependency version ranges — new dependencies.version-strategy setting (exact, max-patch, ...) controls how Porter picks a version when a dependency declares a semver range instead of a pinned tag (#3572)

Improvements

• Graceful shutdown — Ctrl+C during install/upgrade/uninstall now forwards SIGTERM to the running bundle step (30s grace period before SIGKILL), so outputs written during cleanup are still captured (#3603)
• porter explain shows injected params — parameters sourced from a prior run's output are now shown with an (injected) marker instead of being hidden (#3604)
• Param set precedence fixed — parameter sets now correctly override a persisted --param value on upgrade, instead of the old value silently winning (#3600)
• Errors printed once — error messages no longer repeat once per call-stack layer (#3592)
• Correct --no-lint hint — autobuild lint failures now point to the right command instead of a flag that doesn't exist on install/upgrade/invoke/uninstall/publish (#3620)
• Fix porter publish --archive for bundles built with Docker 29.x's containerd image store, whose invocation image layout can be an OCI image index rather than a plain manifest (#3618)
• Fix blank parameters in porter installation runs list output (#3622)
• Fix porter-state corruption — custom actions declared with modifies: false (e.g. dry-run) no longer silently overwrite the installation's state when they produce outputs (#3582)

Internal

• Updated Go to 1.26.4
• Added a .dockerignore documentation page for bundles
• Documented the existing CLEANUP_CONTAINERS env var
• Dependency updates across Go modules and GitHub Actions

---

All Changes

• Resolve dependency version ranges (#3572)
• Add MCP server (#3577)
• Skip porter-state for modifies: false custom actions (#3582)
• Print errors once, not per span level (#3592)
• Update Go to 1.25.10 (#3593)
• Add .dockerignore page for bundles (#3594)
• Param sets override persisted --param values on upgrade (#3600)
• Forward SIGTERM to bundle steps for graceful shutdown (#3603)
• Show params with sources in porter explain output (#3604)
• Add file-sources experimental feature for downloading files during porter build (#3614)
• Support OCI index invocation images (#3618)
• Correct --no-lint hint on autobuild lint errors (#3620)
• Document CLEANUP_CONTAINERS setting (#3621)
• Nil run parameters in list output (#3622)
• Dependency updates (#3583, #3584, #3585, #3586, #3587, #3588, #3589, #3591, #3597, #3606, #3608, #3610, #3611, #3613, #3616, #3617, #3619)

Full Changelog: getporter/porter@v1.5.0...v1.6.0

Commits

• c273540 Chore(deps): Bump the go-dependencies group across 1 directory with 17 update...
• 7dbb4a1 Nil run parameters in list output (#3622)
• 1c075d6 Correct --no-lint hint on autobuild lint errors (#3620)
• ca6994d Support OCI index invocation images (#3618)
• d40f89f Document CLEANUP_CONTAINERS setting (#3621)
• 42b69af Chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 (#3619)
• a76f6af Skip porter-state for modifies: false custom actions (#3582)
• ab3b891 Add file-sources experimental feature for downloading files during porter bui...
• ece392c fix(ci): bump default go version to 1.26.4
• ab34af8 Chore(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2....
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.27 to 1.32.29

Commits

• ed75d3d Release 2026-07-08.2
• d67404a Regenerated Clients
• 8a21e09 Update API model
• cb69824 Release 2026-07-08
• 0f18a1f Regenerated Clients
• 982e0d0 Update API model
• 2872bae Add missing options.RequestChecksumCalculation (#3470)
• ef1f0fe fix(feature/s3/transfermanager): allow multiple symlinks to share the same ta...
• 0df1b91 Release 2026-07-07
• b4ef730 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.42.5 to 1.43.0

Commits

• 0be05fa Release 2023-11-17
• d0c9d42 Regenerated Clients
• e2ede40 Update endpoints model
• 7720f87 Update API model
• 4bd06b9 Merge customizations for service s3
• 24bd514 Merge pull request #2373 from aws/deprecate-macie
• ce87b84 Add changelog for last commit
• ea520b6 Remove macie service
• a2a621e Release 2023-11-16
• 5590a87 Regenerated Clients
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions