Harbor v2.15.13

Released 2026-10-19.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

Summary

Reverts the scheduled-retention change from v2.15.10 (#1171). Project Admins and Maintainers whose role comes from an OIDC, LDAP or auth-proxy group, and admins who are admins through the auth provider’s admin group, can save scheduled tag retention policies again.

The Developer role no longer holds create, update, delete or run on tag retention; it keeps read and list. This closes GHSA-9473-v4fc-5c3q (“Tag-retention deletion runs with Harbor’s privileges without checking who asked”) without recording an execution principal. Maintainers and Project Admins are unchanged.

Existing scheduled policies are untouched. Harbor does not record who created a policy, so admins should review scheduled retention policies after upgrading.

Reverts

• Durable Deletion Authority And Limit Developers To Reading Policies (Revert #1171 / #1164) (#1268)

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.13