All notable changes to this project will be documented in this file.
This changelog mirrors GitHub Releases.
2.15.0 (2026-05-12)
- Add CI/CD Pipelines, Release Automation, and Developer Tooling (#45) (aed9379)
- Add Conditional Immutability Rules Compatible with Retention Policy (#33) (ab409ac)
- Add configurable landing page for unauthenticated users (#152) (67fb2d6)
- Add LDAP Admin Filter (#34) (7a919e9)
- Add Subscription Menu With Chargebee Integration (#40) (850da22)
- Audit Log Max Page Size up to 10000 (#37) (21862b1)
- compose: production compose, images, devenv overhaul with DHI base images, non-root containers, production compose (bcc27db)
- db: Upgrade to pgx/v5 and pgxpool for connection pooling (#118) (612a3c5)
- docs: Add documentation generation tasks for helm-docs and SVGBob diagrams (79abc5e)
- portal: Add Copy Pull Command Button on Tags (#61) (73ec73b)
- portal: Add copy pull command to tag links (e3fb9d3)
- portal: add download button to export audit logs (b536ad1)
- portal: Add Repository-Level Pull Command to Artifact List Tab (#32) (c3b9cf9)
- portal: always build OpenAPI UI in background (7c27b9f)
- Randomise Seconds When Scheduling Jobs (#35) (e88647f)
- ui: Redirect Pull URLs to Project Repository Page (#63) (3cfd879)
- unauthenticated access to ui (704dcd4)
- [upstream] Add missing AWS ECR regions by @nicknikolakakis in goharbor/harbor#22941 (0d50d99)
- [upstream] Add User-Agent header to all registry requests by @stonezdj in goharbor/harbor#23054 (e7d0be5)
- [upstream] Append Custom CAs to System CA Pool by @wy65701436 in goharbor/harbor#22826 (d8d52f9)
- [upstream] Bump Trivy to v0.69.2 Following Supply Chain Incident by @wy65701436 in goharbor/harbor#22911 (c17e06c)
- [upstream] Check Error First Before Other Checks by @liubin in goharbor/harbor#22884 (2abc8da)
- [upstream] Format version span indentation in about dialog by @chlins in goharbor/harbor#23012 (74ce587)
- [upstream] Proxy Cache Serve Local on Remote Not Found by @stonezdj in goharbor/harbor#23049 (4d1c757)
- [upstream] Remove Payload From Config Audit Log by @stonezdj in goharbor/harbor#22917 (b4a0a2c)
- [upstream] Swagger Replication Rule Invalid JSON by @mlimardo1984 in goharbor/harbor#22724 (6d0f605)
- [upstream] Update parent and child artifact pull times by @stonezdj in goharbor/harbor#23022 (0fc0ec7)
- [upstream] Update Verify Remote Cert Tooltip for Registry Endpoints by @wy65701436 in goharbor/harbor#22867 (8f997c2)
- [upstream] Wrong Operation Response Name for UpdateRepository by @liubin in goharbor/harbor#22851 (e4e3a48)
- add -trimpath to go build flags to prevent local path leaks (31351a2)
- Add Dockerfile Healthchecks (#204) (1bf2770)
- Address Devenv Review Feedback (#196) (5903d32)
- Address PR #119 review feedback (d683f71)
- Allow Negative Serial Numbers in x509 Certificates (#36) (b3c99cb)
- Avoid holding pull time lock during async DB flushes (d19d080)
- Classify BuildKit attestations as accessories (#85) (01d2fc3)
- Clean up unused portal UI components and configuration (966baee)
- db: Remove redundant sql.DB Close in dbpool.Pool.Close() (#150) (6b0e929)
- deps: Bump go-jose/go-jose/v4 to v4.1.4 for CVE-2026-34986 (dce1151)
- deps: Bump go.opentelemetry.io/otel/sdk to v1.43.0 for PATH hijack CVE (45b8d5f)
- devenv: registryctl crashes on startup , missing config file argument (#28) (7e10546)
- dev: Fix Dev Environment Docker Compose and Trivy Adapter Setup (#83) (6bbe1e9)
- Expand Global Search Input (6c15cf3)
- exporter: Bake Harbor version into exporter image at build time (22b73ff)
- exporter: Remove redundant database URL field from exporter config (#148) (00b151e)
- Handle proxy-cache races in UpdatePullTime and correct artForPullTime construction (1d9cc7e)
- Honor unauthenticated project redirects (#187) (362039c)
- image: Use pre-built binaries in registry and trivy-adapter dockerfiles, fix --load/--push output (c7fd1bb)
- implement cosign signature inheritance for OCI index children (#27) (c6f9e37)
- Improve CA Pool Test Assertion and Use Typed NotFoundError in Purge API (#55) (f499a3c)
- portal: [upstream] UI Statistics Display Are Not Aligned by @mmoreiradj in goharbor/harbor#22042 (78dc662)
- portal: Fix i18n Key Typos and Add Missing zh-TW Translation (#64) (7759d0c)
- portal: Fix Proxy Cache Checkbox Visibility, Guard, and i18n Keys (#54) (d2034f0)
- portal: stabilize test runner (3b23e05)
- Proxy Cache Fallback Local - Even When Remote Does Not Exist (#38) (0fe897d)
- proxy: [upstream] Preserve URL path prefix during registry auth discovery by @mco69 in goharbor/harbor#22989 (cf4f538)
- proxy: [upstream] Serve local artifact on remote not found in proxy cache by @stonezdj in goharbor/harbor#23049 (e9877f1)
- Re-add missing in-toto attestation accessory model import (#149) (a508b0a)
- remove unauthorised banner (704dcd4)
- Replace scannable content type skiplist with allowlist and add scan timeout (#151) (29a0245)
- Resolve Lint And Vulnerability Issues (#210) (7e5d534)
- Restore Postgres 18 Volume Mount (#197) (b99f6f3)
- security: [upstream] Reject Bearer Tokens Issued Before Project Creation by @wy65701436 in goharbor/harbor#22938 (4efbb56)
- security: reject bearer tokens issued before project creation (#31) (a7a7ce1)
- session: [upstream] Use Correct Maxlifetime in SessionRegenerate by @chlins in goharbor/harbor#22881 (f8b5f82)
- Set Release-Please Manifest to 2.14.0 for Correct 2.15.0 First Release (#51) (0afa522)
- Use fully qualified PostgreSQL image name for Podman compatibility (c300e3f)
- [upstream] Omit Unnecessary Reassignment by @vastonus in goharbor/harbor#22407 (1f412ed)
- portal: portal openapi refactor (#48) (7532146)
- Add PR Description Template to CLAUDE.md (#62) (ce9bffe)
- Add Security Policy (#190) (63a5db2)
- Align README security reporting (#195) (12fa891)
- Simplify CLAUDE.md (#159) (d19f8d3)
- Update CONTRIBUTING.md with PR Description Template and Title Format (#81) (53cc0fa)
Component updates and bug fixes including trivy adapter bump and search user/groups fixes.
- Add max_upstream_conn parameter for proxy_cache projects
- UI for limit upstream registry connection
- Robot account fixes and audit log improvements
New Features:
- Enhanced Proxy-cache: Syncs state with upstream registry by deleting local cache when artifacts are removed
- Single Active Replication: Prevents parallel runs under the same policy
- Enhanced artifact scanning: Support for fixVersion in CVE reports
- Enhanced garbage collection: Displays GC progress while running
- Enhanced CNAI Model integration: Support for raw CNAI model format
- Russian language support
Breaking Changes:
- Replication adapter whitelist introduced to define actively supported adapters
Bug fixes including artifact_type column typo fix and trivy adapter bump.
Component updates and build improvements.
Component updates including ORM filter updates and trivy bump.
Component updates including Helm Chart Copy Button fix and build improvements.
New Features:
- Audit log extension: Enhanced granular tracking of user actions and system events
- Enhanced OIDC: Improved support for user session logout and PKCE
- Integration with CloudNativeAI (CNAI): AI model management and processing capabilities
- Redis TLS support: Enhanced security for Redis communication
- Enhanced Dragonfly Preheating: New parameters and customizable scope
Breaking Changes:
- Updated CSRF key generation
- Removed with_signature parameter
- Project maintainers, developers, and guests do not have permission to list project logs
Deprecations:
- Removed robotV1 from code base
Component updates and build fixes.
Component updates including UI fixes and trivy adapter pin.
Base image updates.
Bug fixes including robot deletion event and export CVE permission fixes.
New Features:
- Enhanced robot account: Additional configuration options for better CI/CD integration
- Speed limit of proxy cache project: Control network speed when pulling from proxy cache
- Enhanced LDAP on-boarding process: Improved user login performance
- Integration with ACR & ACR EE Registry: Seamless image replication
- SBOM Generation and Management: Generate, view, download, and replicate SBOMs
Component updates including golang bump and beego upgrade.
Cherry-pick fixes including artifact accessory URL and scan button fixes.
New Features:
- SBOM Generation and Management: Manual or automatic SBOM generation
- Supporting OCI Distribution Spec v1.1.0
- Integration with VolcEngine Registry
- Korean UI Translation
Component updates and bug fixes.
Bug fixes including retention task panic fix.
Bug fixes including quota permissions and limited guest repository access.
New Features:
- Robot Account Full Access: User-friendly tutorial for robot creation with customizable permissions
- Supporting OCI Distribution Spec v1.1.0-rc3
- Quota Sorting: Enable storage sorting in quota management
- OIDC provider name customization
- Large-size blob support: Uploads up to 128GB by default
- GDPR compliant audit logs
Component updates and bug fixes.
Component updates including trivy bump and golang upgrade.
Component updates including IP family config and strong SSL ciphers.
Bug fixes including scanner skip update pull time and accessory ordering.
Component updates including redis batch job listing and trivy bump.
New Features:
- Security Hub: Security insights including scanned/unscanned artifacts and vulnerability search
- GC Enhancements: Detailed execution history and parallel deletion
- Supporting OCI Distribution Spec v1.1.0-rc2: Notation signature and Nydus conversion support
- Customized banner message
- Quota Update Provider: Redis-based optimistic locking for quota updates
Deprecations:
- Removal of Notary: No longer included in UI or backend
Breaking Changes:
- Only PostgreSQL >= 12 supported for external databases
Component updates and bug fixes.
Bug fixes including beego max memory increase and URL limit to local site.
Component updates including redis keys scan migration and cache db customization.
Component updates including gitlab adapter fix and trivy bump.
Bug fixes including proxy cache pull time and 429 error handling.
Bug fixes including list artifacts performance improvement.
New Features:
- Supporting OCI Distribution Spec v1.1.0-rc1: Referrers API
- CloudEvents format for webhooks
- Jobservice Dashboard Phase 2: Logs for running tasks, cleanup expired executions
- Option to Skip Update Pull Time for Scanner
- Primary auth method from Identity Provider
Deprecations:
- Removal of ChartMuseum: No longer included in UI or backend
Component updates including golang and trivy bumps.
Bug fixes including list artifacts performance and redis keys scan migration.
Bug fixes including copy artifact and retention webhook fixes.
Bug fixes including schedule list and retention/immutable API fixes.
New Features:
- Jobservice monitor: Dashboard to monitor and control job queues/schedules/workers
- Replication by chunk: Copy over chunk when copying image blobs
- JFrog Artifactory as Proxy-Cache source
- OIDC group filter
- Session timeout customization
Deprecations:
- Chartmuseum deprecation (removal in v2.8.0)
- Notary deprecation (removal in v2.8.0)
- Email configuration removed
- PostgreSQL 9.6 support dropped
Bug fixes including retention/immutable API and user password reset fixes.
Bug fixes including RedHat registry proxy cache fix.
Added copy-by-chunk for replication and registry HTTP client timeout customization.
Bug fixes including sentinel redis URL parsing and audit log forward fixes.
New Features:
- Cache Layer: Improved performance for pulling artifacts in high concurrency
- CVE Export: Export vulnerability data for artifacts
- Purge AuditLog: Periodic purge and remote syslog forwarding
- Backup/Restore with Velero
- GDPR compliant user deletion
- WebAssembly artifact support (Experimental)
- GitHub GHCR as proxy cache
Bug fixes including retention/immutable API and trivy bump.
Bug fixes including RedHat registry proxy cache fix.
Bug fixes including robot update regression and docker compose v2 support.
Bug fixes including execution status repair.
Bug fixes including jobservice hook retry and retention policy update.
Bug fixes including GC history update time and accessory count fixes.
New Features:
- Cosign Artifact Signing and Verification: Sigstore/Cosign support for artifact signing
- Improved performance for concurrent pull requests
- Improved GC failure tolerance
- Replication skip for proxy cache projects
- Distribution upload purging
Breaking Changes:
- Only PostgreSQL >= 10 supported for external databases
Bug fixes including retention policy and robot account update fixes.
Bug fixes including LDAP user group privileges and GC failure tolerance.
Bug fixes including user groups pagination and RSA key format fix.
New Features:
- Distributed tracing: Enhanced troubleshooting and performance identification
- Replication with Robot Account
- Stop scan jobs
- Replication exclusions and rate limits
- OIDC auth based user deletion
- Trivy 0.20 with go.sum scanning
Deprecations:
- Legacy robot account removed
- Limited ChartMuseum support
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
New Features:
- Declarative Config: Environment variables to overwrite Harbor configuration
- IPv6 support: Running on IPv6-only infrastructure
- Photon 4.0 upgrade: PostgreSQL v13.3, Redis v6.0.13
- Jobservice metrics
- Destination namespace flattening for replication
- Trivy 0.17 with JAR/WAR/EAR and Go binary scanning
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
New Features:
- System Level Robot Account: Access multiple projects with selective API access
- Metrics & Observability: Performance and system information indicators
- OIDC Admin Group: Privileged admin group for OIDC auth
- Aqua CSP Scanner support
- Proxy cache for GCR, ECR, Azure, Quay.io
- Dell EMC ECS s3 support
Deprecations:
- Built-in Clair deprecated
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
New Features:
- Non-blocking Garbage Collection: Continue pushing/pulling during GC
- Proxy Cache: Pull through cache for Dockerhub and Harbor
- P2P Preheat: Integration with Alibaba Dragonfly and Uber Kraken
- Harbor for AI/ML: Kubeflow datamodels support
- Sysdig Image Scanner support
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
New Features:
- OCI compliant cloud native artifact support: OCI images, image indexes, multi-arch images
- Trivy as default scanner
- TLS between Harbor components
- Webhook enhancements: Slack support, selectable events, multiple endpoints
- Robot account expiration: Individual expiration time per robot
- View and manage untagged images in UI
Breaking Changes:
- REST APIs use
/api/v2.0prefix - Default configuration file renamed to
harbor.yml.tmpl - Project quota based on image count removed
- CRON schedule follows UTC timezone
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
Security and bug fixes.
New Features:
- Pluggable Scanners: Aqua Security and Anchore scanner support
- Tag Immutability: Prevent overwriting images with matching tags
- Replication enhancements: Gitlab, Quay.io, JFrog Artifactory support
- OIDC groups and user-defined CLI secrets
- Limited Guest role: Lower permissions than Guest
- Project quota exceeded webhook
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
New Features:
- Project Quotas: Limit artifacts or storage per project
- Tag Retention: Rules to retain/remove tags based on criteria
- Webhooks: Integration for push, pull, delete, scan events
- CVE whitelists: Exception policies for certain CVEs
- Replication enhancements: GCR, Azure, ECR, Alibaba Cloud, Helm Hub support
- Groups privileges prioritization
- External syslog endpoint configuration
- Non-root container security enhancement
- Robot accounts for chart upload/fetch
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Bug fixes.
Full list of issues fixed in v1.8.0
- Support for OpenID Connect - OpenID Connect (OIDC) is an authentication layer on top of OAuth 2.0, allowing Harbor to verify the identity of users based on the authentication performed by an external authorization server or identity provider.
- Robot accounts - Robot accounts can be configured to provide administrators with a token that can be granted appropriate permissions for pulling or pushing images. Harbor users can continue operating Harbor using their enterprise SSO credentials, and use robot accounts for CI/CD systems that perform Docker client commands.
- Replication advancements - Harbor new version replication allows you to replicate your Harbor repository to and from non-Harbor registries. Harbor 1.8 expands on the Harbor-to-Harbor replication feature, adding the ability to replicate resources between Harbor and Docker Hub, Docker Registry, and Huawei Registry. This is enabled through both push and pull mode replication.
- Health check API, showing detailed status and health of all Harbor components.
- Support for defining cron-based scheduled tasks in the Harbor UI. Administrators can now use cron strings to define the schedule of a job. Scan, garbage collection and replication jobs are all supported. API explorer integration. End users can now explore and trigger Harbor's API via the swagger UI nested inside Harbor's UI.
- Introduce a new master role to project, the role's permissions are more than developer and less than project admin.
- Introduce harbor.yml as the replacement of harbor.cfg and refactor the prepare script to provide more flexibility to the installation process based on docker-compose
- Enhancement of the Job Service engine to include webhook events, additional APIs for automation, and numerous bug fixes to improve the stability of the service.
- Docker Registry upgraded to v2.7.1.
- Bumped up Clair to v2.0.8
- Fixed issues in supporting windows images. #6992 #6369
- Removed user-agent check-in notification handler. #5729
- Fixed the issue global search not working if chartmuseum is not installed #6753
Full list of issues fixed in v1.7.4
Full list of issues fixed in v1.7.1
- Support deploy Harbor with Helm Chart, enables the user to have high availability of Harbor services, refer to the Installation and Configuration Guide.
- Support on-demand Garbage Collection, enables the admin to configure run docker registry garbage collection manually or automatically with a cron schedule.
- Support Image Retag, enables the user to tag image to different repositories and projects, this is particularly useful in cases when images need to be retagged programmatically in a CI pipeline.
- Support Image Build History, makes it easy to see the contents of a container image, refer to the User Guide.
- Support Logger customization, enables the user to customize STDOUT / STDERR / FILE / DB logger of running jobs.
- Improve the user experience of Helm Chart Repository:
- Chart searching is included in the global search results
- Show the total number of chart versions in the chart list
- Mark labels in helm charts
- The latest version can be downloaded as default one on the chart list view
- The chart can be deleted by deleting all the versions under it
- Support manages Helm Charts: From version 1.6.0, Harbor is upgraded to be a composite cloud-native registry, which supports both image management and helm charts management.
- Support LDAP group: User can import an LDAP/AD group to Harbor and assign project roles to it.
- Replicate images with label filter: Use newly added label filter to narrow down the sourcing image list when doing image replication.
- Migrate multiple databases to one unified PostgreSQL database.
- Support read-only mode for registry: Admin can set registry to read-only mode before GC. Details
- Label support: User can add label to image/repository, and filter images by label on UI/API. Details
- Show repositories via Cardview.
- Re-work Job service to make it HA ready.
- Replication policy rework to support wildcard, scheduled replication.
- Support repository level description.
- Batch operation on projects/repositories/users from UI.
- On board LDAP user when adding a member to a project.
- Project level policies for blocking the pull of images with vulnerabilities and unknown provenance.
- Remote certificate verification of replication moved to target level.
- Refined all images to improve security.
- Authentication and authorization, implementing vCenter Single Sign On across components and role-based access control at the project level. Read more
- Full integration of the vSphere Integrated Containers Registry and Management Portal user interfaces. Read more
- Image vulnerabilities scanning.
- Add in Notary support
- User can update the configuration through Harbor UI
- Redesign of Harbor's UI using Clarity
- Some changes to API
- Fix some security issues in the token service
- Upgrade the base image of nginx to the latest openssl version
- Various bug fixes.
- Refactor for a new build process
- Easier configuration for HTTPS in prepare script
- Script to collect logs of a Harbor deployment
- User can view the storage usage (default location) of Harbor.
- Add an attribute to disable normal users from creating projects.
- Various bug fixes.
For Harbor virtual appliance:
- Improve the bootstrap process of ova installation.
- Enable HTTPS by default for .ova deployment, users can download the default root cert from UI for docker client or VCH.
- Preload a photon:1.0 image to Harbor for users who have no internet connection.
- Virtual appliance of Harbor for vSphere.
- Refactor for new build process.
- Easier configuration for HTTPS in prepare step.
- Updated documents.
- Various bug fixes.
- Database schema changed, data migration/upgrade is needed for previous version.
- A project can be deleted when no images and policies are under it.
- Deleted users can be recreated.
- Replication policy can be deleted.
- Enhanced LDAP authentication, allowing multiple uid attributes.
- Pagination in UI.
- Improved authentication for remote image replication.
- Display release version in UI
- Offline installer.
- Various bug fixes.
- Vendoring all dependencies and remove go get from dockerfile
- Installer using Docker Hub to download images
- Harbor base images moved to Photon OS (except for official images from third party)
- New Harbor logo
- Various bug fixes
- Database schema changed, data migration/upgrade is needed for previous version.
- New UI
- Image replication across multiple registry instances
- Integration with registry v2.4.0 to support image deletion and garbage collection
- Database migration tool
- Bug fixes
- Refactored database schema
- Migrate to docker-compose v2 template
- Update token service to support layer mount
- Various bug fixes
Initial release, key features include
- Role based access control (RBAC)
- LDAP / AD integration
- Graphical user interface (GUI)
- Auditing and logging
- RESTful API
- Internationalization