Harbor v2.16.0 (dev)

Features

  • Reconcile the Harbor Next database schema against an authoritative definition (#711)
  • Add a dedicated audit-log configuration page (#705) — Docs: Configure Audit Logging
  • Capture the client IP and user agent in audit logs for artifact push, pull, and delete, validating and truncating the values before they are stored (#701, #704, #709) — Docs: Working With Logs
  • chart: Add a production-ready Helm chart (#56)
  • ci: Add a zero-CVE pipeline (#359)
  • lint: Add Go quality linters (#325)
  • metric: Run the exporter collectors in core (#566)
  • Replace ValidateHTTPURL with a schema-aware ValidateURL (#742)

Bug Fixes

  • Address upstream sync review feedback (63b3ab4, f071003, a01fa1f)
  • Block deleting an attestation out from under its index (311c2aa)
  • Bound proxy-cache background goroutines to prevent a leak (#257)
  • build: Stamp version metadata into the trivy-adapter and Trivy binaries (#459)
  • Cache scannability lookups per artifact-list request (#212)
  • cache: Defer cache eviction until after commit and make retry context-aware (#300)
  • cache: Replace keyMutex with singleflight and stop canceling the cache Save (#277)
  • Carry the X-Is-Resource-Name header into audit metadata (#659)
  • Constrain /registries/ping to saved registry settings (#398)
  • core: Prevent a core file-descriptor and goroutine leak when the registry is unresponsive (#254)
  • core: Reduce auth-failure log noise and skip basic auth for non-admins in OIDC/LDAP/UAA (#313)
  • Correct grammar in a committed key comment (#505)
  • Correct grammar and capitalization inconsistencies across Go source files and docs (9783d50)
  • db: Honour an explicitly configured min_conns of 0 (#565)
  • deps: Bump Harbor Scanner Trivy to v0.38.1 (#415)
  • deps: Remediate zero-CVE findings (#467, #509, #516)
  • deps: Resolve non-UI CVEs (#374)
  • Harden proxy-cache repository filter validation (ef3f626)
  • Install the gh CLI in the release workflow (d5f0674)
  • Return a proper error instead of HTTP 500 on invalid UTF-8 input (#321)
  • ldap: Use a custom orm.ReadOrCreate to prevent LDAP login failures (#323)
  • orm: Discard AfterCommit hooks of a rolled-back savepoint (#598)
  • Point the More Info link to 8GCR (#293)
  • portal: Make log-rotation settings savable and surface no-op purge schedules (#463)
  • Preserve categorized release notes (#215)
  • Push Trivy adapter images without the Harbor prefix (#227)
  • quota: Enable retry backoff on quota-usage updates (#716)
  • release: Track the next development version on main (#360)
  • Resolve upstream sync review inconsistencies (9765e4e)
  • Restore the 0171 migration for the upstream 2.14.x upgrade path (#292)
  • Restore a buildable Trivy adapter pin (a5101ec)
  • Restore dev up with rootless Podman (#401)
  • Return 404 for missing repository artifacts (#322)
  • scan: Keep the SBOM accessory push on the local registry when CORE_URL has no port (#465)
  • scan: Make vulnerability-report persistence idempotent (#259)
  • security: Avoid an audit-event panic on nil user data (#402)
  • Show an ellipsis for truncated tags in the artifact list (#666)
  • Update release-please-config-maintenance.json (aee4893)

Updates

  • blob: Skip a redundant blob Touch when the blob is already StatusNone (#397)
  • core: Avoid eager structured-logger construction on demoted auth-failure logs (#317)
  • quota: Coalesce per-request refresh through the deferred flush (#719)
  • quota: Skip usage reservation when hard limits are unlimited (#734)
  • Bound attestation subject lookups in the index abstractor (5dc252d)
  • Complete the YS review and update to ys-0.2.31 (#672)
  • Decouple the lookup budget from the child count and cache subjects (7a7b308)
  • Extract manifest abstraction into a registry (e32dcbd)
  • Fail startup when a manifest abstractor cannot register (40a463e)
  • Match the upstream comments on AccessoryCandidate (7fd676a)
  • Move attestation classification into the manifest package (3d699f5)
  • Skip building the child list for indexes without attestations (b87515e)

Upstream