Release notes v2.15.5

Released 2026-08-07.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

Commercial Features

This release includes the following commercial enhancements:

• Branding customization
• SFTP storage adapter
• Workload Identity Federation
• PGX DB monitoring with OTel metrics
• AWS RDS IAM authn
• Multi-Format Artifact Repositories

Bug Fixes

• scan: Keep SBOM accessory push on the local registry when CORE_URL has no port (#465)
• security: avoid audit event panic on nil user data (#402)

Upstream

• Add a size limit for manifest uploads (goharbor/harbor#23500) (#440)
• fix: add registry component to proxy configuration support (goharbor/harbor#23437) (#472)
• fix: address unsafe type assertions causing potential panics across packages (goharbor/harbor#23571) (#475)
• fix: guard against division by zero when merging scan report summaries (goharbor/harbor#23572) (#476)
• fix: validate max_upstream_conn values on the backend (#508)
• fix(cache): replace keyMutex with singleflight and avoid canceling cache (goharbor/harbor#23336) (#377)
• fix(cnai-parser): enforce actual byte limit to prevent decompression (goharbor/harbor#23497) (#503)
• fix(replication): fix incorrect error propagation in getAccessoryArts (goharbor/harbor#23569) (#473)
• fix(retention): avoid stripping repository path twice (goharbor/harbor#23546) (#470)
• Set blob response headers before streaming the body (goharbor/harbor#23374) (#498)

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/publish-images.yml@refs/heads/42d9e9979e04bcf8cd66fe4a54d11186533d176e" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.5