Harbor

v2.16.0Storage & Data

2026년 11월 9일

다중 아키텍처 지원과 proxy-cache 및 API 기능이 확대되고, 구성 기본값과 컴포넌트 이미지가 갱신된 유지보수 릴리스입니다. 보안 취약점과 로그 정보 노출, 토큰 검증 문제를 포함한 여러 정확성 문제도 함께 수정했습니다.

조치 필요 (21)

securityTrivy v0.69.2로 업데이트
공급망 사고에 대응해 Trivy를 v0.69.2로 올렸습니다.
securitygo-jose/go-jose/v4 업데이트
DoS 취약점을 수정하기 위해 go-jose/go-jose/v4를 v4.1.4로 올렸습니다.
securitySQL 삽입 문제 수정
잠재적인 SQL 삽입 문제를 수정했습니다.
security타이밍 취약점 수정
이론상 가능한 타이밍 취약점을 수정했습니다.
securityRedis 비밀번호 오류 로그 노출 방지
오류 로그에 Redis 비밀번호가 노출되지 않도록 수정했습니다.
securityrobot 이름 접두사를 이용한 proxy-cache 오염 방지
robot 이름 접두사를 이용한 proxy-cache 오염을 막습니다.
securityGo modules 업데이트
알려진 취약점을 수정하기 위해 Go modules를 업데이트했습니다.
securitynpm dependencies 업데이트
남아 있던 취약한 npm dependencies를 업데이트했습니다.
securityAngular packages 업데이트
알려진 취약점을 수정하기 위해 Angular packages를 업데이트했습니다.
security디버그 로그의 자격 증명 및 비밀 정보 기록 방지
디버그 로그에 자격 증명과 비밀 정보가 기록되지 않도록 수정했습니다.
security빈 secret 거부
인증 우회를 막기 위해 빈 secret을 거부합니다.
securityGo dependencies 업데이트
CVE를 수정하기 위해 Go dependencies를 업데이트했습니다.
breaking구성 감사 로그 payload 제거
구성 감사 로그에서 payload를 제거했습니다.
breaking이전 bearer 토큰 거부
프로젝트가 생성되기 전에 발급된 bearer 토큰을 거부합니다.
breakingPIP_INDEX_URL 기본값 변경
PIP_INDEX_URL의 기본값을 https://pypi.org/simple로 설정했습니다.
pypi.org/…/simple
breakingiat 누락 토큰 거부
iat가 없는 토큰을 거부합니다.
breaking임시 SBOM 권한 재정의 제거
임시 SBOM 권한 재정의를 제거했습니다.
breaking매니페스트 업로드 크기 제한
매니페스트 업로드 크기에 제한을 추가했습니다.
breaking감사 로그 payload 크기 제한
감사 로그 payload 크기에 제한을 추가했습니다.
breaking사설 네트워크 접근 기본 허용
회귀를 막기 위해 기본적으로 사설 네트워크 접근을 허용합니다.
breaking레거시 서명자 pull 기본 허용
회귀를 막기 위해 기본적으로 레거시 서명자의 pull을 허용합니다.

영향 확인 (3)

breakingGC 추가 속성의 redis_url_reg 비공개 처리
redis_url_reg을 설정한 경우 적용됩니다.
GC 추가 속성에서 redis_url_reg을 가립니다.
breaking빈 robot_name_prefix 거부
robot_name_prefix를 설정한 경우 적용됩니다.
비어 있는 robot_name_prefix를 허용하지 않습니다.
breaking기존 레지스트리의 registries ping URL 제한
기존 레지스트리를 사용하는 경우 적용됩니다.
기존 레지스트리에서는 /registries/ping이 저장된 URL만 사용하도록 제한합니다.

그 외 기록된 변경 181건 전체fixes 80 · value changes 72 · additions 15 · constraints 8 · removals 4 · renames 2

fixes (80)

Fix Last Pull time on parent/child artifacts and on creation
preserve URL path prefix during registry auth discovery
enable chunked blob upload for Azure ACR replication
implement signature inheritance for OCI index children
return 404 when listing artifacts of a non-existing repository
Update Verify Remote Cert tooltip for registry endpoints
wrong operation response name for UpdateRepository
use correct maxlifetime in SessionRegenerate
check error first before other checks
UI Statistics display are not aligned
proxy cache serve local on remote not found
fix db scheme migration issue
Fix issue related to scanner API
use created time from annotations in accessory art
add nil guard in auditext manager Create function
fix full table scan in blob unassociation check during GC
distribution instance edit without credential can not save
TCR provider adaptor can't parse intertional secret ID
correct max_upstream_conn validation and disabled bindings
Bump repository update_time on tag and artifact changes
validate blob-mount source project
use amazonaws.com.cn domain for AWS China region endpoints
Update bindings in Project Policy Config
skip corrupted encrypted config values on decryption failure
fix UI issues across portal components
Project Tab Access Permissions Match the User Permissions
propagate CSV marshal errors in scan data export
fix UI issues #48–#54 across portal components
use validated scan type in StopScanArtifact
replace keyMutex with singleflight and avoid canceling cache
multiple UI/UX fixes for checkboxes, alignment, dark theme, and i18n
align pending job queue counts and improve form styling
Fix/api completeness
avoid panic in user audit event resolver on nil event data
use dark login background in dark mode
fix(retention): avoid stripping repository path twice
fix(replication): fix incorrect error propagation in getAccessoryArts
fix: address unsafe type assertions causing potential panics across packages
fix: guard against division by zero when merging scan report summaries
bugfix/max-upstream-comm
fix: use LEFT JOIN in projectBasicSQL to include projects without quota records
Fix: member audit log resolution after transaction commit
fix: allow resizing of the SBOM column in artifact table
fix: fix tags column text truncation and count badge overlap
Prevent 500 if no project members have been provided
Prevent 500 on invalid query input for robot accounts
neutralize CSV formula in scan export
Add missing validation when creating a rb account
Add \n to the escape pattern
Refactor registry update handling to improve URL validation
convert setup_timestamp, status_revision, and revision columns to bigint to avoid Y2K38 overflow
query robot account to validate proxy session
Fix CPU saturation from full table scans during artifact deletion by indexing sbom_digest
enable retry backoff on quota usage updates
correct grammar and typos in user-facing error messages
make hostname comparisons case-insensitive
Invalid UTF-8 Input Should not Cause HTTP 500 Errors
improve Korean translation of FULL_NAME
make hostname and endpoint comparisons case-insensitive(2)
Keep the swagger-ui loading page intact when webpack minifies HTML
make endpoint handling and validation case-insensitive
make sbom_report index creation idempotent
avoid double prefix when removing expired entries
ignore http.ErrServerClosed on graceful shutdown
make HTTPS URL scheme check case-insensitive for CA download
do not count blobs missing from storage as freed space
correct grammar, formatting, and non-actionable error messages
drop retention_id metadata on project delete
update label and tooltip of serve stale content option
Use the current registry Redis URL for scheduled runs
validate upload Location against the request origin
translate remaining French UI strings
keep multi-value filters when editing a P2P preheat policy
scope scan stop lookup to caller artifact
prevent CPU spin from unreachable cron expressions
Fix webhook egress allow all
make the image resource filter take effect again
preserve artifact type for multi-tier accessories in replication
restore robot member role assignment compatibility
* fix: publish harbor-*-base images as multi-arch manifests by @Vad1mo in https://github.com/goharbor/harbor/pull/23348

value changes (72)

Update artifact_accessory to add source column to identify accessory
Proxy the referrer API to upstream registry with paging and local merge
aggregate execution error messages and surface task failure details
filter event policies in query
Bump trivy to 0.69.3 & adapter to v0.35.1-rc.1
Bump trivy-adapter v0.35.1 GA on main
migrate model-spec to modelpack org
Call /v2/auth/token api to get bearer token for dockerhub adapter
prevent background polling from renewing session TTL
use human-readable sizes in GC log messages
bump Go version from 1.25.7 to 1.26.3
bump pg to v18
ignore tlog during verification
Upgrade harbor go.mod OSS packages
publish goharbor/photon:5.0 as a multi-arch manifest
Harden crypto usage
pin Photon base to stable multi-arch digest
Update and improve zh-TW Traditional Chinese locale
update distribution source tag to rc.5
Set blob response headers before streaming the body
convert robot account ID columns and sequence to bigint
revert github.com/gorilla/csrf to v1.7.2
Harden proxy cache repository filter validation
improve HTTP client request logging and credential string formatting
sanitize connection details in logs and enhance error message formatting
forward-port the release-2.15.0 go module bumps to main
redact scanner URL in candidate list for non-admin users
Improve global label listing behavior
Improve job status hook handling
Align manual preheat execution with update permissions
Stamp version info into the bundled Trivy adapter binary
Improve project metadata cache consistency
bump Trivy, Trivy adapter, and Distribution versions
bump up Go version to v1.27.3
Bump Trivy to v0.76.1 and adapter to v0.40.0-rc2
Change the size of the add-role wizard and add horizontal scroll when required
audit-log events for custom roles
bump base vserion for v2.16.0
bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /src
upgrade Angular to v21, Clarity to v18, Node.js to v22
Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1
bump form-data from 4.0.5 to 4.0.6 in /src/portal
update Trivy adapter version to …×3
bump up golang to 1.26.4 and trivy adapter version to v0.37.2-rc2
Bump up trivy to 0.72.0
use stable registry source release v2.8.3-harbor.1
bump pygments from 2.19.2 to 2.20.0 in /make/photon/prepare
bump uuid and webpack-dev-server in /src/portal/app-swagger-ui
update go.mod dependencies to patch versions
bump golang.org/x/crypto to v0.55.0
bump hono from 4.13.2 to 4.13.8 in /src/portal
bump the patch-updates group across 1 directory with 2 updates
bump fast-uri from 3.1.5 to 3.1.8 in /src/portal
* chore(deps): bump css-loader from 6.11.0 to 7.1.5 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23848
* chore(deps): bump baseline-browser-mapping from 2.10.33 to 2.11.24 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23883
* chore(deps): bump the patch-updates group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23843
* chore(deps-dev): bump webpack-cli from 4.10.0 to 7.2.3 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23850
* chore(deps-dev): bump webpack from 5.107.2 to 5.111.0 in /src/portal/app-swagger-ui by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23951
* chore(deps-dev): bump cypress from 15.20.1 to 16.0.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23953
* chore(deps-dev): bump eslint-config-prettier from 9.1.2 to 10.1.8 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23956
* chore(deps-dev): bump https-proxy-agent from 5.0.1 to 9.1.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23954
* chore(deps): bump marked from 18.0.12 to 18.0.13 in /src/portal in the patch-updates group across 1 directory by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23952
* chore(deps-dev): bump stylelint from 14.16.1 to 17.15.0 in /src/portal by @dependabot[bot] in https://github.com/goharbor/harbor/pull/23957
* bump: bump up Go version to v1.26.9 by @stonezdj in https://github.com/goharbor/harbor/pull/24120
* Bump trivy adapter to v0.39.1 and distribution to v2.8.3-harbor.2 by @stonezdj in https://github.com/goharbor/harbor/pull/24118×2
* bump: bump up Go version to v1.27.2 by @stonezdj in https://github.com/goharbor/harbor/pull/24119
* chore(deps): bump google.golang.org/grpc to v1.82.2 and golang/x/net to v0.60.0 by @stonezdj in https://github.com/goharbor/harbor/pull/24167×2
* chore: refresh base image by @stonezdj in https://github.com/goharbor/harbor/pull/24253

additions (15)

Full Multi-Architecture Enablement for Harbor (amd64 + arm64)
Add ListReferrers API to registry client
support advanced proxy cache configurations in UI
implement proxy cache repository filter API
Custom project roles — frontend UI
Add UI option to enable proxy cache referrer API
add member create/update/delete audit events
Add proxy cache hit/miss metrics
Add User-Agent to all request
add Docker HEALTHCHECK
Expose retention setting during proxy-cache project creation
custom project roles (hybrid — built-ins in code, custom in DB)
add webhook egress policy levels and allowlist
separate event-triggered replication into dedicate…
* Add proxy cache from dockerhub, harbor, jfrog by @stonezdj in https://github.com/goharbor/harbor/pull/23121

constraints (8)

add registry component to proxy configuration support
add missing AWS regions to ECR adapter endpoint list
allow for ecr-public to be mirored
build valkey from source to support arm64
add artifact to supported resource types
increase access_key column length to 4096
enforce actual byte limit to prevent decompression
* Support custom PyPI index URL for prepare image builds by @stonezdj in https://github.com/goharbor/harbor/pull/23205

removals (4)

remove install net-tools from db dockerfile
skip spectral image when creating multi-arch manifests
exclude helper images from manifest creation
drop unused SMTP package

renames (2)

replace redis with valkey as cache backend
replace gorilla/csrf with net/http.CrossOriginProtection

Harbor 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →

공식 릴리스 노트 ↗Harbor 릴리스 전체 →