RATATOSKRATATOSK
Sign in

Harbor

v2.15.4Storage & Data
Oct 9, 2026

CHECK 3OTHER 3

A patch release that restores private-network webhook behavior by default and changes legacy signer handling. It also updates the bundled Trivy, Trivy adapter, and Distribution components, with no disclosed security changes.

Check if affected (3)

  • breakingLegacy signer pull behavior

    Applicability is not stated in the release notes.

    Harbor 2.15.4 allows legacy signer pulls by default to avoid a regression in content trust.

    harbor#24086

  • breakingThe HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS default

    Applies if you do not configure allow_private_network_access.

    HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS now defaults to true in Harbor 2.15.4, and the setting remains available for operators who want the guard set to false.

  • breakingThe allow_private_network_access migration default

    Applies if you do not configure allow_private_network_access.

    The 2.15.0 migration template writes true for allow_private_network_access unless the old harbor.yml already set a value.

All 3 other recorded changesvalue changes 2 · additions 1

value changes (2)

  • * Bump trivy(0.75.0) and trivy adapter(0.39.1-rc2) by @stonezdj in https://github.com/goharbor/harbor/pull/24080
  • * Bump trivy adapter to v0.39.1 and distribution to v2.8.3-harbor.2 by @stonezdj in https://github.com/goharbor/harbor/pull/24117

additions (1)

  • * fix(prepare): expose the legacy signer pull switch in harbor.yml by @bupd in https://github.com/goharbor/harbor/pull/24101
Add Harbor to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Harbor releases →