Release notes v2.15.4

Released 2026-07-31. Compare with v2.15.3.

Features

• ci: Add Zero CVE Pipeline (#359)
• lint: Add Go Quality Linters (#325)

Bug Fixes

• add missing release cherry-pick updates
• Address upstream sync review feedback
• Bound Proxy-Cache Background Goroutines To Prevent Leak (#392)
• Cache the Scannability Lookups Per Artifact-List Request (#212) (#417)
• constrain /registries/ping to saved registry settings (#403)
• deps: Align release Go toolchain version
• deps: Bump Harbor Scanner Trivy To v0.38.1 (#416)
• deps: Remediate zero CVE findings (#467)
• deps: Remediate zero CVE findings (#509)
• deps: Remediate zero CVE findings (#516)
• deps: Resolve Non-UI CVEs (#374)
• max_upstream_conn validation bugs
• nil deref in StopScanArtifact scan type param
• propagate CSV marshal error in scan data export
• Remove unintended 2.16 accessory migration from release 2.15 (#514)
• Resolve Upstream Sync Review Inconsistencies
• Restore Buildable Trivy Adapter Pin
• ui: remove hardcoded SBOM permission override, closes #23218
• Update Harbor Satellite adapter for referrers

Upstream

• 【fix issue 22865】TCR provider adaptor can’t parse intertional secret ID
• Add ListReferrers API to registry client and update parseScopes
• bump Go version from 1.25.7 to 1.26.3
• Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1
• chore: update Trivy adapter version to v0.37.1
• feat(acr): add artifact to supported resource types
• fix: Add i18n keys and missing translations
• fix: Bump repository update_time on tag and artifact changes
• fix: correct max_upstream_conn validation and disabled bindings
• fix: Disallow Empty robot_name_prefix to prevent OIDC CLI login from being blocked — Docs: Changing Default Robot Accounts Prefix
• fix: duplicated “by” in beego ORM TableName comments
• fix: enable chunked blob upload for Azure ACR replication
• fix: Fix potential SQLi
• fix: Fix theoretical timing vulnerability (goharbor/harbor#23433) (#378)
• fix: propagate CSV marshal errors in scan data export
• fix: skip corrupted encrypted config values on decryption failure
• fix: use validated scan type in StopScanArtifact (#367)
• fix(ecr): use amazonaws.com.cn domain for AWS China region endpoints
• fix(i18n): localize max upstream connection placeholder
• fix(portal): remove temporary SBOM permission override
• fix(security): validate blob-mount source project and reject tokens missing iat
• fix(ui): Update bindings in Project Policy Config
• fix(ui): use selected tag for pull command copy
• Fix/api completeness (goharbor/harbor#23476) (#432)
• Harden crypto usage and drop unused SMTP package
• perf(replication): filter event policies in query
• refactor(config): centralize registry HTTP client timeout
• refactor(task): use Redis SET with SPOP for outdate execution status …
• Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml
• Update and improve zh-TW Traditional Chinese locale
• Update artifact_accessory to add source column to identify accessory
• update ECR adapter to allow for ecr-public to be mirored — Docs: Endpoints For Replications and Proxy Cache
• Upgrade harbor go.mod OSS packages

Code Refactoring

• task: use Redis SET with SPOP for outdate execution status refresh

Commercial Features

This release includes the following commercial enhancements:

• Branding customization
• Hybrid multi-auth
• SFTP storage adapter
• Workload Identity Federation
• PGX DB monitoring with OTel metrics
• AWS RDS IAM authn

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.4