Harbor

v2.16.0Storage & Data

2026年11月9日

マルチアーキテクチャ対応、プロキシキャッシュと API の機能、設定の既定値を拡充した、広範な保守リリースです。正確性の修正、セキュリティ強化、依存関係とツールチェーンの更新、コンポーネントイメージの更新も含まれ、セキュリティ関連の修正が多数あります。

要対応 (21)

securityTrivy の v0.69.2 への更新
供給網インシデントを受けて、Trivy を v0.69.2 に更新しました。
securitygo-jose/go-jose/v4 の v4.1.4 への更新
DoS 脆弱性の修正として、go-jose/go-jose/v4 を v4.1.4 に更新しました。
securitySQL インジェクションの可能性の修正
SQL インジェクションの可能性を修正しました。
securityタイミング脆弱性の修正
理論上のタイミング脆弱性を修正しました。
securityエラーログでの Redis パスワード露出の防止
エラーログに Redis のパスワードが露出しないよう修正しました。
securityロボット名接頭辞によるプロキシキャッシュ汚染の防止
ロボット名の接頭辞を介したプロキシキャッシュの汚染を防止しました。
securityGo modules の更新
既知の脆弱性を修正するため、Go modules を更新しました。
security脆弱な npm 依存関係の更新
脆弱性が残る npm 依存関係を更新しました。
securityAngular パッケージの更新
既知の脆弱性を修正するため、Angular パッケージを更新しました。
securityデバッグログでの認証情報とシークレットの記録防止
デバッグログに認証情報やシークレットが記録されないようにしました。
security空のシークレットの拒否
認証バイパスを防ぐため、空のシークレットを拒否するようにしました。
securityGo 依存関係の更新
CVE を修正するため、Go の依存関係を更新しました。
breaking設定監査ログのペイロード除外
設定監査ログからペイロードを除外しました。
breakingプロジェクト作成前の Bearer トークンの拒否
プロジェクト作成前に発行された Bearer トークンを拒否するようにしました。
breakingPIP_INDEX_URL の既定値変更
PIP_INDEX_URL の既定値を https://pypi.org/simple に変更しました。
pypi.org/…/simple
breakingiat のないトークンの拒否
iat クレームがないトークンを拒否するようにしました。
breaking一時的な SBOM 権限上書きの削除
一時的な SBOM 権限の上書きを削除しました。
breakingマニフェストアップロードのサイズ上限
マニフェストのアップロードにサイズ上限を設けました。
breaking監査ログペイロードのサイズ上限
監査ログのペイロードにサイズ上限を設けました。
breakingプライベートネットワークアクセスの既定許可
プライベートネットワークへのアクセスを既定で許可するようにしました。
breakingレガシー署名者によるプルの既定許可
レガシー署名者によるプルを既定で許可するようにしました。

影響確認 (3)

breakingGC 追加属性での redis_url_reg の伏せ字化
redis_url_reg を設定している場合に該当します。
GC の追加属性で redis_url_reg を伏せ字にしました。
breaking空の robot_name_prefix の禁止
robot_name_prefix を設定している場合に該当します。
空の robot_name_prefix を指定できないようにしました。
breaking/registries/ping の対象 URL 制限
既存のレジストリの場合に該当します。
/registries/ping を、保存済みの URL に対してのみ実行するよう制限しました。

その他の記録済み変更 181 件すべてfixes 80 · value changes 72 · additions 15 · constraints 8 · removals 4 · renames 2

fixes (80)

Fix Last Pull time on parent/child artifacts and on creation
preserve URL path prefix during registry auth discovery
enable chunked blob upload for Azure ACR replication
implement signature inheritance for OCI index children
return 404 when listing artifacts of a non-existing repository
Update Verify Remote Cert tooltip for registry endpoints
wrong operation response name for UpdateRepository
use correct maxlifetime in SessionRegenerate
check error first before other checks
UI Statistics display are not aligned
proxy cache serve local on remote not found
fix db scheme migration issue
Fix issue related to scanner API
use created time from annotations in accessory art
add nil guard in auditext manager Create function
fix full table scan in blob unassociation check during GC
distribution instance edit without credential can not save
TCR provider adaptor can't parse intertional secret ID
correct max_upstream_conn validation and disabled bindings
Bump repository update_time on tag and artifact changes
validate blob-mount source project
use amazonaws.com.cn domain for AWS China region endpoints
Update bindings in Project Policy Config
skip corrupted encrypted config values on decryption failure
fix UI issues across portal components
Project Tab Access Permissions Match the User Permissions
propagate CSV marshal errors in scan data export
fix UI issues #48–#54 across portal components
use validated scan type in StopScanArtifact
replace keyMutex with singleflight and avoid canceling cache
multiple UI/UX fixes for checkboxes, alignment, dark theme, and i18n
align pending job queue counts and improve form styling
Fix/api completeness
avoid panic in user audit event resolver on nil event data
use dark login background in dark mode
fix(retention): avoid stripping repository path twice
fix(replication): fix incorrect error propagation in getAccessoryArts
fix: address unsafe type assertions causing potential panics across packages
fix: guard against division by zero when merging scan report summaries
bugfix/max-upstream-comm
fix: use LEFT JOIN in projectBasicSQL to include projects without quota records
Fix: member audit log resolution after transaction commit
fix: allow resizing of the SBOM column in artifact table
fix: fix tags column text truncation and count badge overlap
Prevent 500 if no project members have been provided
Prevent 500 on invalid query input for robot accounts
neutralize CSV formula in scan export
Add missing validation when creating a rb account
Add \n to the escape pattern
Refactor registry update handling to improve URL validation
convert setup_timestamp, status_revision, and revision columns to bigint to avoid Y2K38 overflow
query robot account to validate proxy session
Fix CPU saturation from full table scans during artifact deletion by indexing sbom_digest
enable retry backoff on quota usage updates
correct grammar and typos in user-facing error messages
make hostname comparisons case-insensitive
Invalid UTF-8 Input Should not Cause HTTP 500 Errors
improve Korean translation of FULL_NAME
make hostname and endpoint comparisons case-insensitive(2)
Keep the swagger-ui loading page intact when webpack minifies HTML
make endpoint handling and validation case-insensitive
make sbom_report index creation idempotent
avoid double prefix when removing expired entries
ignore http.ErrServerClosed on graceful shutdown
make HTTPS URL scheme check case-insensitive for CA download
do not count blobs missing from storage as freed space
correct grammar, formatting, and non-actionable error messages
drop retention_id metadata on project delete
update label and tooltip of serve stale content option
Use the current registry Redis URL for scheduled runs
validate upload Location against the request origin
translate remaining French UI strings
keep multi-value filters when editing a P2P preheat policy
scope scan stop lookup to caller artifact
prevent CPU spin from unreachable cron expressions
Fix webhook egress allow all
make the image resource filter take effect again
preserve artifact type for multi-tier accessories in replication
restore robot member role assignment compatibility
* fix: publish harbor-*-base images as multi-arch manifests by @Vad1mo in https://github.com/goharbor/harbor/pull/23348

value changes (72)

Update artifact_accessory to add source column to identify accessory
Proxy the referrer API to upstream registry with paging and local merge
aggregate execution error messages and surface task failure details
filter event policies in query
Bump trivy to 0.69.3 & adapter to v0.35.1-rc.1
Bump trivy-adapter v0.35.1 GA on main
migrate model-spec to modelpack org
Call /v2/auth/token api to get bearer token for dockerhub adapter
prevent background polling from renewing session TTL
use human-readable sizes in GC log messages
bump Go version from 1.25.7 to 1.26.3
bump pg to v18
ignore tlog during verification
Upgrade harbor go.mod OSS packages
publish goharbor/photon:5.0 as a multi-arch manifest
Harden crypto usage
pin Photon base to stable multi-arch digest
Update and improve zh-TW Traditional Chinese locale
update distribution source tag to rc.5
Set blob response headers before streaming the body
convert robot account ID columns and sequence to bigint
revert github.com/gorilla/csrf to v1.7.2
Harden proxy cache repository filter validation
improve HTTP client request logging and credential string formatting
sanitize connection details in logs and enhance error message formatting
forward-port the release-2.15.0 go module bumps to main
redact scanner URL in candidate list for non-admin users
Improve global label listing behavior
Improve job status hook handling
Align manual preheat execution with update permissions
Stamp version info into the bundled Trivy adapter binary
Improve project metadata cache consistency
bump Trivy, Trivy adapter, and Distribution versions
bump up Go version to v1.27.3
Bump Trivy to v0.76.1 and adapter to v0.40.0-rc2
Change the size of the add-role wizard and add horizontal scroll when required
audit-log events for custom roles
bump base vserion for v2.16.0
bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /src
upgrade Angular to v21, Clarity to v18, Node.js to v22
Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1
bump form-data from 4.0.5 to 4.0.6 in /src/portal
update Trivy adapter version to …×3
bump up golang to 1.26.4 and trivy adapter version to v0.37.2-rc2
Bump up trivy to 0.72.0
use stable registry source release v2.8.3-harbor.1
bump pygments from 2.19.2 to 2.20.0 in /make/photon/prepare
bump uuid and webpack-dev-server in /src/portal/app-swagger-ui
update go.mod dependencies to patch versions
bump golang.org/x/crypto to v0.55.0
bump hono from 4.13.2 to 4.13.8 in /src/portal
bump the patch-updates group across 1 directory with 2 updates
bump fast-uri from 3.1.5 to 3.1.8 in /src/portal
* chore(deps): bump css-loader from 6.11.0 to 7.1.5 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23848
* chore(deps): bump baseline-browser-mapping from 2.10.33 to 2.11.24 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23883
* chore(deps): bump the patch-updates group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23843
* chore(deps-dev): bump webpack-cli from 4.10.0 to 7.2.3 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23850
* chore(deps-dev): bump webpack from 5.107.2 to 5.111.0 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23951
* chore(deps-dev): bump cypress from 15.20.1 to 16.0.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23953
* chore(deps-dev): bump eslint-config-prettier from 9.1.2 to 10.1.8 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23956
* chore(deps-dev): bump https-proxy-agent from 5.0.1 to 9.1.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23954
* chore(deps): bump marked from 18.0.12 to 18.0.13 in /src/portal in the patch-updates group across 1 directory by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23952
* chore(deps-dev): bump stylelint from 14.16.1 to 17.15.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23957
* bump: bump up Go version to v1.26.9 by @stonezdj in https://github.com/goharbor/harbor/pull/24120
* Bump trivy adapter to v0.39.1 and distribution to v2.8.3-harbor.2 by @stonezdj in https://github.com/goharbor/harbor/pull/24118×2
* bump: bump up Go version to v1.27.2 by @stonezdj in https://github.com/goharbor/harbor/pull/24119
* chore(deps): bump google.golang.org/grpc to v1.82.2 and golang/x/net to v0.60.0 by @stonezdj in https://github.com/goharbor/harbor/pull/24167×2
* chore: refresh base image by @stonezdj in https://github.com/goharbor/harbor/pull/24253

additions (15)

Full Multi-Architecture Enablement for Harbor (amd64 + arm64)
Add ListReferrers API to registry client
support advanced proxy cache configurations in UI
implement proxy cache repository filter API
Custom project roles — frontend UI
Add UI option to enable proxy cache referrer API
add member create/update/delete audit events
Add proxy cache hit/miss metrics
Add User-Agent to all request
add Docker HEALTHCHECK
Expose retention setting during proxy-cache project creation
custom project roles (hybrid — built-ins in code, custom in DB)
add webhook egress policy levels and allowlist
separate event-triggered replication into dedicate…
* Add proxy cache from dockerhub, harbor, jfrog by @stonezdj in https://github.com/goharbor/harbor/pull/23121

constraints (8)

add registry component to proxy configuration support
add missing AWS regions to ECR adapter endpoint list
allow for ecr-public to be mirored
build valkey from source to support arm64
add artifact to supported resource types
increase access_key column length to 4096
enforce actual byte limit to prevent decompression
* Support custom PyPI index URL for prepare image builds by @stonezdj in https://github.com/goharbor/harbor/pull/23205

removals (4)

remove install net-tools from db dockerfile
skip spectral image when creating multi-arch manifests
exclude helper images from manifest creation
drop unused SMTP package

renames (2)

replace redis with valkey as cache backend
replace gorilla/csrf with net/http.CrossOriginProtection

Harborをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →

公式リリースノート ↗Harborのリリース一覧 →