RATATOSKRATATOSK
Sign in

Harbor

v2.16.0Storage & Data
Nov 9, 2026

ACTION 21CHECK 3OTHER 181

A broad maintenance release adds multi-architecture, proxy-cache, API, and configuration capabilities alongside extensive correctness and security fixes. It also updates dependencies and component images, so operators should review the security-related corrections and any changed defaults.

Action needed (21)

  • securityThe Trivy version

    Trivy is updated to v0.69.2 following a supply chain incident.

  • securityThe go-jose/go-jose/v4 version

    go-jose/go-jose/v4 is updated to v4.1.4 to fix a denial-of-service vulnerability.

  • securityPotential SQL injection correction

    A potential SQL injection issue is fixed.

  • securityTheoretical timing vulnerability correction

    A theoretical timing vulnerability is fixed.

  • securityRedis password protection in error logs

    Redis passwords are prevented from appearing in error logs.

  • securityProxy-cache poisoning protection

    Proxy-cache poisoning through the robot-name prefix is prevented.

  • securityThe Go module versions

    Go modules are updated to fix known vulnerabilities.

  • securityThe remaining npm dependency versions

    The remaining vulnerable npm dependencies are updated.

  • securityThe Angular package versions

    Angular packages are updated to fix known vulnerabilities.

  • securityCredential and secret protection in debug logs

    Credentials and secrets are prevented from appearing in debug logs.

  • securityEmpty secret validation

    Empty secrets are rejected to prevent authentication bypass.

  • securityThe Go dependency versions

    Go dependencies are updated to fix CVEs.

  • breakingConfig audit log payload removal

    The payload is removed from the config audit log.

  • breakingBearer token issuance-time validation

    Harbor rejects bearer tokens issued before project creation.

  • breakingThe default PIP_INDEX_URL value

    The default PIP_INDEX_URL is set to https://pypi.org/simple.

    pypi.org/…/simple

  • breakingiat validation for tokens

    Tokens without iat are rejected.

  • breakingTemporary SBOM permission override removal

    The temporary SBOM permission override is removed.

  • breakingManifest upload size limits

    Manifest uploads have a size limit.

  • breakingAudit log payload size limits

    Audit log payloads have a size limit.

  • breakingThe default private network access setting

    Private network access is allowed by default.

  • breakingThe default legacy signer pull setting

    Legacy signer pulls are allowed by default.

Check if affected (3)

  • breakingredis_url_reg redaction in GC attributes

    Applies if you configure redis_url_reg.

    The redis_url_reg value is redacted from GC extra attributes.

  • breakingrobot_name_prefix validation

    Applies if you configure robot_name_prefix.

    Empty robot_name_prefix values are disallowed.

  • breakingSaved-URL constraint for /registries/ping

    Applies for existing registries.

    The /registries/ping endpoint is constrained to the saved URL for existing registries.

All 181 other recorded changesfixes 80 · value changes 72 · additions 15 · constraints 8 · removals 4 · renames 2

fixes (80)

  • Fix Last Pull time on parent/child artifacts and on creation
  • preserve URL path prefix during registry auth discovery
  • enable chunked blob upload for Azure ACR replication
  • implement signature inheritance for OCI index children
  • return 404 when listing artifacts of a non-existing repository
  • Update Verify Remote Cert tooltip for registry endpoints
  • wrong operation response name for UpdateRepository
  • use correct maxlifetime in SessionRegenerate
  • check error first before other checks
  • UI Statistics display are not aligned
  • proxy cache serve local on remote not found
  • fix db scheme migration issue
  • Fix issue related to scanner API
  • use created time from annotations in accessory art
  • add nil guard in auditext manager Create function
  • fix full table scan in blob unassociation check during GC
  • distribution instance edit without credential can not save
  • TCR provider adaptor can't parse intertional secret ID
  • correct max_upstream_conn validation and disabled bindings
  • Bump repository update_time on tag and artifact changes
  • validate blob-mount source project
  • use amazonaws.com.cn domain for AWS China region endpoints
  • Update bindings in Project Policy Config
  • skip corrupted encrypted config values on decryption failure
  • fix UI issues across portal components
  • Project Tab Access Permissions Match the User Permissions
  • propagate CSV marshal errors in scan data export
  • fix UI issues #48–#54 across portal components
  • use validated scan type in StopScanArtifact
  • replace keyMutex with singleflight and avoid canceling cache
  • multiple UI/UX fixes for checkboxes, alignment, dark theme, and i18n
  • align pending job queue counts and improve form styling
  • Fix/api completeness
  • avoid panic in user audit event resolver on nil event data
  • use dark login background in dark mode
  • fix(retention): avoid stripping repository path twice
  • fix(replication): fix incorrect error propagation in getAccessoryArts
  • fix: address unsafe type assertions causing potential panics across packages
  • fix: guard against division by zero when merging scan report summaries
  • bugfix/max-upstream-comm
  • fix: use LEFT JOIN in projectBasicSQL to include projects without quota records
  • Fix: member audit log resolution after transaction commit
  • fix: allow resizing of the SBOM column in artifact table
  • fix: fix tags column text truncation and count badge overlap
  • Prevent 500 if no project members have been provided
  • Prevent 500 on invalid query input for robot accounts
  • neutralize CSV formula in scan export
  • Add missing validation when creating a rb account
  • Add \n to the escape pattern
  • Refactor registry update handling to improve URL validation
  • convert setup_timestamp, status_revision, and revision columns to bigint to avoid Y2K38 overflow
  • query robot account to validate proxy session
  • Fix CPU saturation from full table scans during artifact deletion by indexing sbom_digest
  • enable retry backoff on quota usage updates
  • correct grammar and typos in user-facing error messages
  • make hostname comparisons case-insensitive
  • Invalid UTF-8 Input Should not Cause HTTP 500 Errors
  • improve Korean translation of FULL_NAME
  • make hostname and endpoint comparisons case-insensitive(2)
  • Keep the swagger-ui loading page intact when webpack minifies HTML
  • make endpoint handling and validation case-insensitive
  • make sbom_report index creation idempotent
  • avoid double prefix when removing expired entries
  • ignore http.ErrServerClosed on graceful shutdown
  • make HTTPS URL scheme check case-insensitive for CA download
  • do not count blobs missing from storage as freed space
  • correct grammar, formatting, and non-actionable error messages
  • drop retention_id metadata on project delete
  • update label and tooltip of serve stale content option
  • Use the current registry Redis URL for scheduled runs
  • validate upload Location against the request origin
  • translate remaining French UI strings
  • keep multi-value filters when editing a P2P preheat policy
  • scope scan stop lookup to caller artifact
  • prevent CPU spin from unreachable cron expressions
  • Fix webhook egress allow all
  • make the image resource filter take effect again
  • preserve artifact type for multi-tier accessories in replication
  • restore robot member role assignment compatibility
  • * fix: publish harbor-*-base images as multi-arch manifests by @Vad1mo in https://github.com/goharbor/harbor/pull/23348

value changes (72)

  • Update artifact_accessory to add source column to identify accessory
  • Proxy the referrer API to upstream registry with paging and local merge
  • aggregate execution error messages and surface task failure details
  • filter event policies in query
  • Bump trivy to 0.69.3 & adapter to v0.35.1-rc.1
  • Bump trivy-adapter v0.35.1 GA on main
  • migrate model-spec to modelpack org
  • Call /v2/auth/token api to get bearer token for dockerhub adapter
  • prevent background polling from renewing session TTL
  • use human-readable sizes in GC log messages
  • bump Go version from 1.25.7 to 1.26.3
  • bump pg to v18
  • ignore tlog during verification
  • Upgrade harbor go.mod OSS packages
  • publish goharbor/photon:5.0 as a multi-arch manifest
  • Harden crypto usage
  • pin Photon base to stable multi-arch digest
  • Update and improve zh-TW Traditional Chinese locale
  • update distribution source tag to rc.5
  • Set blob response headers before streaming the body
  • convert robot account ID columns and sequence to bigint
  • revert github.com/gorilla/csrf to v1.7.2
  • Harden proxy cache repository filter validation
  • improve HTTP client request logging and credential string formatting
  • sanitize connection details in logs and enhance error message formatting
  • forward-port the release-2.15.0 go module bumps to main
  • redact scanner URL in candidate list for non-admin users
  • Improve global label listing behavior
  • Improve job status hook handling
  • Align manual preheat execution with update permissions
  • Stamp version info into the bundled Trivy adapter binary
  • Improve project metadata cache consistency
  • bump Trivy, Trivy adapter, and Distribution versions
  • bump up Go version to v1.27.3
  • Bump Trivy to v0.76.1 and adapter to v0.40.0-rc2
  • Change the size of the add-role wizard and add horizontal scroll when required
  • audit-log events for custom roles
  • bump base vserion for v2.16.0
  • bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /src
  • upgrade Angular to v21, Clarity to v18, Node.js to v22
  • Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1
  • bump form-data from 4.0.5 to 4.0.6 in /src/portal
  • update Trivy adapter version to …×3
  • bump up golang to 1.26.4 and trivy adapter version to v0.37.2-rc2
  • Bump up trivy to 0.72.0
  • use stable registry source release v2.8.3-harbor.1
  • bump pygments from 2.19.2 to 2.20.0 in /make/photon/prepare
  • bump uuid and webpack-dev-server in /src/portal/app-swagger-ui
  • update go.mod dependencies to patch versions
  • bump golang.org/x/crypto to v0.55.0
  • bump hono from 4.13.2 to 4.13.8 in /src/portal
  • bump the patch-updates group across 1 directory with 2 updates
  • bump fast-uri from 3.1.5 to 3.1.8 in /src/portal
  • * chore(deps): bump css-loader from 6.11.0 to 7.1.5 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23848
  • * chore(deps): bump baseline-browser-mapping from 2.10.33 to 2.11.24 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23883
  • * chore(deps): bump the patch-updates group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23843
  • * chore(deps-dev): bump webpack-cli from 4.10.0 to 7.2.3 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23850
  • * chore(deps-dev): bump webpack from 5.107.2 to 5.111.0 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23951
  • * chore(deps-dev): bump cypress from 15.20.1 to 16.0.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23953
  • * chore(deps-dev): bump eslint-config-prettier from 9.1.2 to 10.1.8 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23956
  • * chore(deps-dev): bump https-proxy-agent from 5.0.1 to 9.1.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23954
  • * chore(deps): bump marked from 18.0.12 to 18.0.13 in /src/portal in the patch-updates group across 1 directory by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23952
  • * chore(deps-dev): bump stylelint from 14.16.1 to 17.15.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23957
  • * bump: bump up Go version to v1.26.9 by @stonezdj in https://github.com/goharbor/harbor/pull/24120
  • * Bump trivy adapter to v0.39.1 and distribution to v2.8.3-harbor.2 by @stonezdj in https://github.com/goharbor/harbor/pull/24118×2
  • * bump: bump up Go version to v1.27.2 by @stonezdj in https://github.com/goharbor/harbor/pull/24119
  • * chore(deps): bump google.golang.org/grpc to v1.82.2 and golang/x/net to v0.60.0 by @stonezdj in https://github.com/goharbor/harbor/pull/24167×2
  • * chore: refresh base image by @stonezdj in https://github.com/goharbor/harbor/pull/24253

additions (15)

  • Full Multi-Architecture Enablement for Harbor (amd64 + arm64)
  • Add ListReferrers API to registry client
  • support advanced proxy cache configurations in UI
  • implement proxy cache repository filter API
  • Custom project roles — frontend UI
  • Add UI option to enable proxy cache referrer API
  • add member create/update/delete audit events
  • Add proxy cache hit/miss metrics
  • Add User-Agent to all request
  • add Docker HEALTHCHECK
  • Expose retention setting during proxy-cache project creation
  • custom project roles (hybrid — built-ins in code, custom in DB)
  • add webhook egress policy levels and allowlist
  • separate event-triggered replication into dedicate…
  • * Add proxy cache from dockerhub, harbor, jfrog by @stonezdj in https://github.com/goharbor/harbor/pull/23121

constraints (8)

  • add registry component to proxy configuration support
  • add missing AWS regions to ECR adapter endpoint list
  • allow for ecr-public to be mirored
  • build valkey from source to support arm64
  • add artifact to supported resource types
  • increase access_key column length to 4096
  • enforce actual byte limit to prevent decompression
  • * Support custom PyPI index URL for prepare image builds by @stonezdj in https://github.com/goharbor/harbor/pull/23205

removals (4)

  • remove install net-tools from db dockerfile
  • skip spectral image when creating multi-arch manifests
  • exclude helper images from manifest creation
  • drop unused SMTP package

renames (2)

  • replace redis with valkey as cache backend
  • replace gorilla/csrf with net/http.CrossOriginProtection
Add Harbor to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Harbor releases →