# Harbor v2.16.0

> Storage & Data · 2026-11-09

A broad maintenance release adds multi-architecture, proxy-cache, API, and configuration capabilities alongside extensive correctness and security fixes. It also updates dependencies and component images, so operators should review the security-related corrections and any changed defaults.

## Action needed
- **[security]** The `Trivy` version
  - `Trivy` is updated to v0.69.2 following a supply chain incident.
- **[security]** The `go-jose/go-jose/v4` version
  - `go-jose/go-jose/v4` is updated to v4.1.4 to fix a denial-of-service vulnerability.
- **[security]** Potential SQL injection correction
  - A potential SQL injection issue is fixed.
- **[security]** Theoretical timing vulnerability correction
  - A theoretical timing vulnerability is fixed.
- **[security]** Redis password protection in error logs
  - Redis passwords are prevented from appearing in error logs.
- **[security]** Proxy-cache poisoning protection
  - Proxy-cache poisoning through the robot-name prefix is prevented.
- **[security]** The Go module versions
  - Go modules are updated to fix known vulnerabilities.
- **[security]** The remaining npm dependency versions
  - The remaining vulnerable npm dependencies are updated.
- **[security]** The Angular package versions
  - Angular packages are updated to fix known vulnerabilities.
- **[security]** Credential and secret protection in debug logs
  - Credentials and secrets are prevented from appearing in debug logs.
- **[security]** Empty secret validation
  - Empty secrets are rejected to prevent authentication bypass.
- **[security]** The Go dependency versions
  - Go dependencies are updated to fix CVEs.
- **[breaking]** Config audit log payload removal
  - The payload is removed from the config audit log.
- **[breaking]** Bearer token issuance-time validation
  - Harbor rejects bearer tokens issued before project creation.
- **[breaking]** The default `PIP_INDEX_URL` value
  - The default `PIP_INDEX_URL` is set to `https://pypi.org/simple`.
- **[breaking]** `iat` validation for tokens
  - Tokens without `iat` are rejected.
- **[breaking]** Temporary SBOM permission override removal
  - The temporary SBOM permission override is removed.
- **[breaking]** Manifest upload size limits
  - Manifest uploads have a size limit.
- **[breaking]** Audit log payload size limits
  - Audit log payloads have a size limit.
- **[breaking]** The default private network access setting
  - Private network access is allowed by default.
- **[breaking]** The default legacy signer pull setting
  - Legacy signer pulls are allowed by default.

## Check if affected
- **[breaking]** `redis_url_reg` redaction in GC attributes
  - Applies if you configure `redis_url_reg`.
  - The `redis_url_reg` value is redacted from GC extra attributes.
- **[breaking]** `robot_name_prefix` validation
  - Applies if you configure `robot_name_prefix`.
  - Empty `robot_name_prefix` values are disallowed.
- **[breaking]** Saved-URL constraint for `/registries/ping`
  - Applies for existing registries.
  - The `/registries/ping` endpoint is constrained to the saved URL for existing registries.

## Other recorded changes
- 181 (defect_corrected 80, value_changed 72, added 15, constraint_changed 8, removed 4, renamed 2)

[Full analysis](https://ratatosk.io/en/releases/harbor/v2.16.0)

[Original release notes](https://github.com/goharbor/harbor/releases/tag/v2.16.0)