Harbor

v2.14.6Storage & Data

Oct 23, 2026

A maintenance release with Go dependency updates for security CVEs, default behavior changes, and corrective fixes. It also includes protection against decompression overruns and runtime panics.

Action needed (1)

securityGo dependency security updates
Go dependencies are upgraded to address security CVEs.
harbor#24190

Check if affected (2)

breakingPrivate network access for webhook enabled by default
Applies if you use webhook.
Private network access for webhook is allowed by default in this release.
harbor#24129
breakingLegacy signer pulls for contenttrust enabled by default
Applies if you use contenttrust.
Legacy signer pulls are allowed by default for contenttrust to avoid a regression.
harbor#24132

All 7 other recorded changesvalue changes 4 · fixes 2 · additions 1

value changes (4)

* bump base version for v2.14.6 by @wy65701436 in https://github.com/goharbor/harbor/pull/24115
* Release 2.14 bump go trivy distribution by @wy65701436 in https://github.com/goharbor/harbor/pull/24122
* Cherry pick upload location origin 2.14 (#24114) by @wy65701436 in https://github.com/goharbor/harbor/pull/24131
* bump: bump Go to 1.26.10 for release-2.14.0 by @stonezdj in https://github.com/goharbor/harbor/pull/24199

fixes (2)

* [release-2.14] fix(cnai-parser): enforce actual byte limit to prevent decompression (#23497) by @Vad1mo in https://github.com/goharbor/harbor/pull/24143
* [release-2.14] fix: avoid panic in user audit event resolver on nil event data (#23461) by @Vad1mo in https://github.com/goharbor/harbor/pull/24152

additions (1)

* fix(prepare): expose the legacy signer pull switch in harbor.yml (#24… by @wy65701436 in https://github.com/goharbor/harbor/pull/24130

Add Harbor to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Harbor releases →