Harbor v2.15.9

Released 2026-09-16.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

Fixes

• api: Reject query operands the column cannot take (backport #925)
• compose: Preserve the request port in the nginx Host header (#926)
• db: Widen execution.revision to bigint (backport #924)
• deps: Bump go dependencies minor versions (backport #895) (#899)
• deps: Bump vendored builds: trivy 0.74.0, adapter v0.41.0, pin cleanup (backport #893) (#898)
• deps: Upgrade Go to 1.26.8 (backport #892) (#897)
• quota: Enable retry backoff on quota usage updates (backport #716)
• registry: Answer 400 when the endpoint URL cannot be reached (#923)
• replication: Normalise CORE_URL comparison in isLocalHarbor (#873)
• scan: Keep the last report when the raw report is empty (backport #863)

Upstream

• add size limit for audit log payload (goharbor/harbor#23755) (45e97fd)
• fix(i18n): improve Korean translation of FULL_NAME (goharbor/harbor#22701) (9ea0d71)
• Prevent 500 if no project members have been provided (goharbor/harbor#23642) (c518ae7)

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.9