Harbor
v2.15.0Storage & DataHarbor v2.15.0 delivers proxy cache connection limits, per-endpoint CA certs, Cosign v3 bundle support, and a critical bearer token security fix alongside a Trivy supply chain incident bump.
securityUpdate immediately: Trivy supply chain incident and bearer token bypass
Two separate security issues landed in this release. First, Trivy was bumped to v0.69.3 after a supply chain incident affecting the scanner — run this update before your next scan cycle. Second, the bearer token fix rejects tokens issued before their associated project was created, which plugs an authorization gap. Both issues warrant prompt upgrades rather than waiting for a maintenance window.
breakingGCR replication adapter removed — migrate any existing GCR replication rules
The Google Container Registry adapter is gone. If you have replication rules targeting GCR endpoints, they will break silently after upgrading. Migrate those rules to use Artifact Registry (GAR) endpoints before upgrading to v2.15.0. Also, if you were using proxy cache projects pointed at GCR, those need to be reconfigured.
enhancementCap proxy cache upstream connections to protect upstream registries
The new `max_upstream_conn` parameter lets you throttle outbound connections per proxy cache project. If you're running Harbor as a pull-through cache for Docker Hub or other rate-limited registries, set this to avoid hitting upstream rate limits or overwhelming self-hosted registries. Configure it per-project via the UI or API after upgrading.
主な変更 (7)
- Proxy cache projects now support configurable upstream connection limits via `max_upstream_conn` parameter, controllable through the UI
- Per-endpoint CA certificate support added for registry endpoints, useful for private registries with custom PKI
- Bearer tokens issued before project creation are now rejected — closes a subtle authorization bypass
- Trivy bumped to v0.69.3 following a supply chain incident; this was a reactive security response, not a routine update
- Cosign v3 Bundle signature format supported, and Harbor release artifacts are now signed with Cosign keyless signing
- GCR replication adapter removed since Google Cloud Registry accounts are decommissioned
- Audit log to DB can now be disabled at initialization, reducing write load for high-throughput environments