---
title: "Harbor v2.15.12"
description: "Release notes for Container Registry 2.15.12: trusted issuers gain an audience field filled from the legacy aud claim; the project-admin grant guard is reverted."
date: 2026-10-20
lastmod: 2026-10-20
canonical: "https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.12/"
source: "https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.12/index.md"
harbor_version: "2.15"
agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.12/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.12/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Harbor v2.15.12

*Release notes for Container Registry 2.15.12: trusted issuers gain an audience field filled from the legacy aud claim; the project-admin grant guard is reverted.*

Harbor v2.15.12
===============

Released 2026-10-15.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

## Summary

Trusted issuers gain an `audience` column. The `(issuer, project_id)` uniqueness constraint is dropped.

## Commercial Features

### Federated Robot Accounts

- Reject deleting a trusted issuer's `aud` or `iss` claim with 400; they are immutable like on create (container-registry/8gcr#522)
- Answer 400 for a trusted issuer id of 0 or less instead of 404 (container-registry/8gcr#522)
- A trusted issuer now declares its audience as a field; issuer plus audience is its identity, so several trusted issuers may share an issuer URL with different audiences, and aud or iss are no longer accepted as claim rules (container-registry/8gcr#527)

## Upgrade Notes

On upgrade, a trusted issuer created before this change gets its `audience` filled from its legacy issuer-level `aud` claim ([#1249](https://github.com/container-registry/harbor-next/issues/1249)), provided that claim has exactly one value and no other trusted issuer with the same issuer URL has or would get the same audience. A trusted issuer left without an audience rejects tokens with the error "trusted issuer <name> has no audience". Set it once via the portal edit form or `PUT /api/v2.0/trusted-issuers/{id}` with `{"audience": "<the token aud>"}`; robots and claims need no change (container-registry/8gcr#527).

## Fixes

- **db:** Add The Trusted Issuer Audience Column (backport [#1236](https://github.com/container-registry/harbor-next/issues/1236)) ([#1239](https://github.com/container-registry/harbor-next/issues/1239))
- **db:** Fill The Trusted Issuer Audience From Its Legacy aud Claim (backport [#1248](https://github.com/container-registry/harbor-next/issues/1248)) ([#1249](https://github.com/container-registry/harbor-next/issues/1249))

## Reverts

- Drop The Project-Admin Grant Guard (backport [#1137](https://github.com/container-registry/harbor-next/issues/1137) revert) ([#1227](https://github.com/container-registry/harbor-next/issues/1227))

## Container Images

Multi-arch images (`linux/amd64`, `linux/arm64`) signed with [cosign](https://github.com/sigstore/cosign).

| Image | Reference |
|-------|-----------|
| `harbor-core` | `8gears.container-registry.com/8gcr/harbor-core:v2.15.12` |
| `harbor-jobservice` | `8gears.container-registry.com/8gcr/harbor-jobservice:v2.15.12` |
| `harbor-registryctl` | `8gears.container-registry.com/8gcr/harbor-registryctl:v2.15.12` |
| `harbor-exporter` | `8gears.container-registry.com/8gcr/harbor-exporter:v2.15.12` |
| `harbor-portal` | `8gears.container-registry.com/8gcr/harbor-portal:v2.15.12` |
| `harbor-registry` | `8gears.container-registry.com/8gcr/harbor-registry:v2.15.12` |
| `trivy-adapter` | `8gears.container-registry.com/8gcr/trivy-adapter:v2.15.12` |

**Verify an image signature:**
```sh
cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.12
```