Release notes v2.15.0

Released 2026-05-12. Compare with v2.14.0.

Features

• Add CI/CD Pipelines, Release Automation, and Developer Tooling (#45)
• Add Conditional Immutability Rules Compatible with Retention Policy (#33)
• Add configurable landing page for unauthenticated users (#152)
• Add LDAP Admin Filter (#34)
• Add Subscription Menu With Chargebee Integration (#40)
• Audit Log Max Page Size up to 10000 (#37)
• compose: production compose, images, devenv overhaul with DHI base images, non-root containers, production compose
• db: Upgrade to pgx/v5 and pgxpool for connection pooling (#118)
• portal: Add Copy Pull Command Button on Tags (#61)
• portal: Add copy pull command to tag links
• portal: add download button to export audit logs
• portal: Add Repository-Level Pull Command to Artifact List Tab (#32)
• portal: always build OpenAPI UI in background
• Randomise Seconds When Scheduling Jobs (#35)
• ui: Redirect Pull URLs to Project Repository Page (#63)
• unauthenticated access to ui

Bug Fixes

• [upstream] Add missing AWS ECR regions
• [upstream] Add User-Agent header to all registry requests
• [upstream] Append Custom CAs to System CA Pool
• [upstream] Bump Trivy to v0.69.2 Following Supply Chain Incident
• [upstream] Check Error First Before Other Checks
• [upstream] Format version span indentation in about dialog
• [upstream] Proxy Cache Serve Local on Remote Not Found
• [upstream] Remove Payload From Config Audit Log
• [upstream] Swagger Replication Rule Invalid JSON
• [upstream] Update parent and child artifact pull times
• [upstream] Update Verify Remote Cert Tooltip for Registry Endpoints
• [upstream] Wrong Operation Response Name for UpdateRepository
• add -trimpath to go build flags to prevent local path leaks
• Add Dockerfile Healthchecks (#204)
• Address Devenv Review Feedback (#196)
• Address PR #119 review feedback
• Allow Negative Serial Numbers in x509 Certificates (#36)
• Avoid holding pull time lock during async DB flushes
• Classify BuildKit attestations as accessories (#85)
• Clean up unused portal UI components and configuration
• db: Remove redundant sql.DB Close in dbpool.Pool.Close() (#150)
• deps: Bump go-jose/go-jose/v4 to v4.1.4 for CVE-2026-34986
• deps: Bump go.opentelemetry.io/otel/sdk to v1.43.0 for PATH hijack CVE
• devenv: registryctl crashes on startup , missing config file argument (#28)
• dev: Fix Dev Environment Docker Compose and Trivy Adapter Setup (#83)
• Expand Global Search Input
• exporter: Bake Harbor version into exporter image at build time
• exporter: Remove redundant database URL field from exporter config (#148)
• Handle proxy-cache races in UpdatePullTime and correct artForPullTime construction
• Honor unauthenticated project redirects (#187)
• image: Use pre-built binaries in registry and trivy-adapter dockerfiles, fix –load/–push output
• implement cosign signature inheritance for OCI index children (#27)
• Improve CA Pool Test Assertion and Use Typed NotFoundError in Purge API (#55)
• portal: [upstream] UI Statistics Display Are Not Aligned
• portal: Fix i18n Key Typos and Add Missing zh-TW Translation (#64)
• portal: Fix Proxy Cache Checkbox Visibility, Guard, and i18n Keys (#54)
• portal: stabilize test runner
• Proxy Cache Fallback Local - Even When Remote Does Not Exist (#38)
• proxy: [upstream] Preserve URL path prefix during registry auth discovery
• proxy: [upstream] Serve local artifact on remote not found in proxy cache
• Re-add missing in-toto attestation accessory model import (#149)
• remove unauthorised banner
• Replace scannable content type skiplist with allowlist and add scan timeout (#151)
• Resolve Lint And Vulnerability Issues (#210)
• Restore Postgres 18 Volume Mount (#197)
• security: [upstream] Reject Bearer Tokens Issued Before Project Creation
• security: reject bearer tokens issued before project creation (#31)
• session: [upstream] Use Correct Maxlifetime in SessionRegenerate
• Set Release-Please Manifest to 2.14.0 for Correct 2.15.0 First Release (#51)
• Use fully qualified PostgreSQL image name for Podman compatibility

Performance Improvements

• ci: speed up unit test pipeline (#147)

Code Refactoring

• [upstream] Omit Unnecessary Reassignment
• portal: portal openapi refactor (#48)

Commercial Features

This release includes the following commercial enhancements:

• Branding customization
• Hybrid multi-auth
• SFTP storage adapter
• Workload Identity Federation
• PGX DB monitoring with OTel metrics
• AWS RDS IAM authn

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.0