Harbor v2.15.12

Released 2026-10-15.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

Summary

Trusted issuers gain an audience column. The (issuer, project_id) uniqueness constraint is dropped.

Commercial Features

Federated Robot Accounts

Reject deleting a trusted issuer’s aud or iss claim with 400; they are immutable like on create (container-registry/8gcr#522)
Answer 400 for a trusted issuer id of 0 or less instead of 404 (container-registry/8gcr#522)
A trusted issuer now declares its audience as a field; issuer plus audience is its identity, so several trusted issuers may share an issuer URL with different audiences, and aud or iss are no longer accepted as claim rules (container-registry/8gcr#527)

Upgrade Notes

On upgrade, a trusted issuer created before this change gets its audience filled from its legacy issuer-level aud claim (#1249), provided that claim has exactly one value and no other trusted issuer with the same issuer URL has or would get the same audience. A trusted issuer left without an audience rejects tokens with the error “trusted issuer has no audience”. Set it once via the portal edit form or PUT /api/v2.0/trusted-issuers/{id} with {"audience": "<the token aud>"}; robots and claims need no change (container-registry/8gcr#527).

Fixes

db: Add The Trusted Issuer Audience Column (backport #1236) (#1239)
db: Fill The Trusted Issuer Audience From Its Legacy aud Claim (backport #1248) (#1249)

Reverts

Drop The Project-Admin Grant Guard (backport #1137 revert) (#1227)

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Image	Reference
`harbor-core`	`8gears.container-registry.com/8gcr/harbor-core:v2.15.12`
`harbor-jobservice`	`8gears.container-registry.com/8gcr/harbor-jobservice:v2.15.12`
`harbor-registryctl`	`8gears.container-registry.com/8gcr/harbor-registryctl:v2.15.12`
`harbor-exporter`	`8gears.container-registry.com/8gcr/harbor-exporter:v2.15.12`
`harbor-portal`	`8gears.container-registry.com/8gcr/harbor-portal:v2.15.12`
`harbor-registry`	`8gears.container-registry.com/8gcr/harbor-registry:v2.15.12`
`trivy-adapter`	`8gears.container-registry.com/8gcr/trivy-adapter:v2.15.12`

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.12