# Harbor v2.15.4

> Storage & Data · 2026-10-09

A patch release that restores private-network webhook behavior by default and changes legacy signer handling. It also updates the bundled Trivy, Trivy adapter, and Distribution components, with no disclosed security changes.

## Check if affected
- **[breaking]** Legacy signer pull behavior
  - Applicability is not stated in the release notes.
  - Harbor 2.15.4 allows legacy signer pulls by default to avoid a regression in content trust.
- **[breaking]** The `HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS` default
  - Applies if you do not configure `allow_private_network_access`.
  - `HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS` now defaults to `true` in Harbor 2.15.4, and the setting remains available for operators who want the guard set to `false`.
- **[breaking]** The `allow_private_network_access` migration default
  - Applies if you do not configure `allow_private_network_access`.
  - The 2.15.0 migration template writes `true` for `allow_private_network_access` unless the old `harbor.yml` already set a value.

## Other recorded changes
- 3 (value_changed 2, added 1)

[Full analysis](https://ratatosk.io/en/releases/harbor/v2.15.4)

[Original release notes](https://github.com/goharbor/harbor/releases/tag/v2.15.4)