---
title: "Harbor v2.16.0 (dev)"
description: "Container Registry v2.16.0 adds client IP and user-agent audit logging, proxy-cache referrer APIs, quota retry backoff, and upstream Harbor fixes."
date: 2026-08-13
lastmod: 2026-10-06
canonical: "https://container-registry.com/docs/2.16/release-notes/harbor-v2.16.0-dev/"
source: "https://container-registry.com/docs/2.16/release-notes/harbor-v2.16.0-dev/index.md"
harbor_version: "2.16"
agent_instructions: "This is the markdown representation of https://container-registry.com/docs/2.16/release-notes/harbor-v2.16.0-dev/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/docs/2.16/release-notes/harbor-v2.16.0-dev/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Harbor v2.16.0 (dev)

*Container Registry v2.16.0 adds client IP and user-agent audit logging, proxy-cache referrer APIs, quota retry backoff, and upstream Harbor fixes.*


Harbor v2.16.0 (dev)
====================

## Features

- Reconcile the Harbor Next database schema against an authoritative definition ([#711](https://github.com/container-registry/harbor-next/pull/711))
- Add a dedicated audit-log configuration page ([#705](https://github.com/container-registry/harbor-next/pull/705)) — <a href="/docs/2.16/administration-manual/other-system-settings/manage-audit-logs/index.md">Docs: Configure Audit Logging</a>
- Capture the client IP and user agent in audit logs for artifact push, pull, and delete, validating and truncating the values before they are stored ([#701](https://github.com/container-registry/harbor-next/pull/701), [#704](https://github.com/container-registry/harbor-next/pull/704), [#709](https://github.com/container-registry/harbor-next/pull/709)) — <a href="/docs/2.16/user-manual/working-with-logs/index.md">Docs: Working With Logs</a>
- **chart:** Add a production-ready Helm chart ([#56](https://github.com/container-registry/harbor-next/pull/56))
- **ci:** Add a zero-CVE pipeline ([#359](https://github.com/container-registry/harbor-next/pull/359))
- **lint:** Add Go quality linters ([#325](https://github.com/container-registry/harbor-next/pull/325))
- **metric:** Run the exporter collectors in core ([#566](https://github.com/container-registry/harbor-next/pull/566))
- Replace ValidateHTTPURL with a schema-aware ValidateURL ([#742](https://github.com/container-registry/harbor-next/pull/742))

## Bug Fixes

- Address upstream sync review feedback ([63b3ab4](https://github.com/container-registry/harbor-next/commit/63b3ab4476691825cd43feb1398dccd7a8d9c806), [f071003](https://github.com/container-registry/harbor-next/commit/f0710039c461179efd61127617ca04e2ce599b94), [a01fa1f](https://github.com/container-registry/harbor-next/commit/a01fa1fffe324977e4f1b6f4df779c291b9ced30))
- Block deleting an attestation out from under its index ([311c2aa](https://github.com/container-registry/harbor-next/commit/311c2aadf4f7c60f59c3d2e92467ecbc379afe4d))
- Bound proxy-cache background goroutines to prevent a leak ([#257](https://github.com/container-registry/harbor-next/pull/257))
- **build:** Stamp version metadata into the trivy-adapter and Trivy binaries ([#459](https://github.com/container-registry/harbor-next/pull/459))
- Cache scannability lookups per artifact-list request ([#212](https://github.com/container-registry/harbor-next/pull/212))
- **cache:** Defer cache eviction until after commit and make retry context-aware ([#300](https://github.com/container-registry/harbor-next/pull/300))
- **cache:** Replace keyMutex with singleflight and stop canceling the cache Save ([#277](https://github.com/container-registry/harbor-next/pull/277))
- Carry the X-Is-Resource-Name header into audit metadata ([#659](https://github.com/container-registry/harbor-next/pull/659))
- Constrain /registries/ping to saved registry settings ([#398](https://github.com/container-registry/harbor-next/pull/398))
- **core:** Prevent a core file-descriptor and goroutine leak when the registry is unresponsive ([#254](https://github.com/container-registry/harbor-next/pull/254))
- **core:** Reduce auth-failure log noise and skip basic auth for non-admins in OIDC/LDAP/UAA ([#313](https://github.com/container-registry/harbor-next/pull/313))
- Correct grammar in a committed key comment ([#505](https://github.com/container-registry/harbor-next/pull/505))
- Correct grammar and capitalization inconsistencies across Go source files and docs ([9783d50](https://github.com/container-registry/harbor-next/commit/9783d50f7556cdc42d238e57d0d54e3a12096028))
- **db:** Honour an explicitly configured min_conns of 0 ([#565](https://github.com/container-registry/harbor-next/pull/565))
- **deps:** Bump Harbor Scanner Trivy to v0.38.1 ([#415](https://github.com/container-registry/harbor-next/pull/415))
- **deps:** Remediate zero-CVE findings ([#467](https://github.com/container-registry/harbor-next/pull/467), [#509](https://github.com/container-registry/harbor-next/pull/509), [#516](https://github.com/container-registry/harbor-next/pull/516))
- **deps:** Resolve non-UI CVEs ([#374](https://github.com/container-registry/harbor-next/pull/374))
- Harden proxy-cache repository filter validation ([ef3f626](https://github.com/container-registry/harbor-next/commit/ef3f626946090e932baf82711b296d3c2f3aef62))
- Install the gh CLI in the release workflow ([d5f0674](https://github.com/container-registry/harbor-next/commit/d5f06748df52a65b0280bd6389fa164d874adcd4))
- Return a proper error instead of HTTP 500 on invalid UTF-8 input ([#321](https://github.com/container-registry/harbor-next/pull/321))
- **ldap:** Use a custom orm.ReadOrCreate to prevent LDAP login failures ([#323](https://github.com/container-registry/harbor-next/pull/323))
- **orm:** Discard AfterCommit hooks of a rolled-back savepoint ([#598](https://github.com/container-registry/harbor-next/pull/598))
- Point the More Info link to 8GCR ([#293](https://github.com/container-registry/harbor-next/pull/293))
- **portal:** Make log-rotation settings savable and surface no-op purge schedules ([#463](https://github.com/container-registry/harbor-next/pull/463))
- Preserve categorized release notes ([#215](https://github.com/container-registry/harbor-next/pull/215))
- Push Trivy adapter images without the Harbor prefix ([#227](https://github.com/container-registry/harbor-next/pull/227))
- **quota:** Enable retry backoff on quota-usage updates ([#716](https://github.com/container-registry/harbor-next/pull/716))
- **release:** Track the next development version on main ([#360](https://github.com/container-registry/harbor-next/pull/360))
- Resolve upstream sync review inconsistencies ([9765e4e](https://github.com/container-registry/harbor-next/commit/9765e4ed03139ba6a69b0dbafec464bf339e8611))
- Restore the 0171 migration for the upstream 2.14.x upgrade path ([#292](https://github.com/container-registry/harbor-next/pull/292))
- Restore a buildable Trivy adapter pin ([a5101ec](https://github.com/container-registry/harbor-next/commit/a5101ec052844ba31573735d3dd4b4b238e100b0))
- Restore dev up with rootless Podman ([#401](https://github.com/container-registry/harbor-next/pull/401))
- Return 404 for missing repository artifacts ([#322](https://github.com/container-registry/harbor-next/pull/322))
- **scan:** Keep the SBOM accessory push on the local registry when CORE_URL has no port ([#465](https://github.com/container-registry/harbor-next/pull/465))
- **scan:** Make vulnerability-report persistence idempotent ([#259](https://github.com/container-registry/harbor-next/pull/259))
- **security:** Avoid an audit-event panic on nil user data ([#402](https://github.com/container-registry/harbor-next/pull/402))
- Show an ellipsis for truncated tags in the artifact list ([#666](https://github.com/container-registry/harbor-next/pull/666))
- Update release-please-config-maintenance.json ([aee4893](https://github.com/container-registry/harbor-next/commit/aee489370f8471ba8ddbec60180e0d0ec3b14f49))

## Updates

- **blob:** Skip a redundant blob Touch when the blob is already StatusNone ([#397](https://github.com/container-registry/harbor-next/pull/397))
- **core:** Avoid eager structured-logger construction on demoted auth-failure logs ([#317](https://github.com/container-registry/harbor-next/pull/317))
- **quota:** Coalesce per-request refresh through the deferred flush ([#719](https://github.com/container-registry/harbor-next/pull/719))
- **quota:** Skip usage reservation when hard limits are unlimited ([#734](https://github.com/container-registry/harbor-next/pull/734))
- Bound attestation subject lookups in the index abstractor ([5dc252d](https://github.com/container-registry/harbor-next/commit/5dc252d69509bcafb78419ac32e91010e6f743fa))
- Complete the YS review and update to ys-0.2.31 ([#672](https://github.com/container-registry/harbor-next/pull/672))
- Decouple the lookup budget from the child count and cache subjects ([7a7b308](https://github.com/container-registry/harbor-next/commit/7a7b3080fd1659a7e34bdc4316c48aaf2fb1fbb9))
- Extract manifest abstraction into a registry ([e32dcbd](https://github.com/container-registry/harbor-next/commit/e32dcbd8e4ec269e1b1e44fbbf01ea1726059e88))
- Fail startup when a manifest abstractor cannot register ([40a463e](https://github.com/container-registry/harbor-next/commit/40a463eba5581208de0d8c8432856f7e93791948))
- Match the upstream comments on AccessoryCandidate ([7fd676a](https://github.com/container-registry/harbor-next/commit/7fd676a25b83b9c41f50c5d7ca230d98d6aa3484))
- Move attestation classification into the manifest package ([3d699f5](https://github.com/container-registry/harbor-next/commit/3d699f50d42a92f63f5929063a89a31ad16afbc1))
- Skip building the child list for indexes without attestations ([b87515e](https://github.com/container-registry/harbor-next/commit/b87515edebabff5a2ae69890e30d70390090dcbd))

## Upstream

- Fix max_upstream_conn validation bugs ([goharbor/harbor#22681](https://github.com/goharbor/harbor/pull/22681))
- Fix a nil dereference in the StopScanArtifact scan-type parameter ([goharbor/harbor#23412](https://github.com/goharbor/harbor/pull/23412))
- Prevent an HTTP 500 on invalid query input ([goharbor/harbor#23670](https://github.com/goharbor/harbor/pull/23670))
- Propagate CSV marshal errors in scan data export ([goharbor/harbor#23369](https://github.com/goharbor/harbor/pull/23369))
- **registry:** Prevent JobserviceSecret and stored-credential exfiltration ([goharbor/harbor#23671](https://github.com/goharbor/harbor/pull/23671))
- Remove the Redis URL from error logs to avoid exposing the Redis password ([goharbor/harbor#23657](https://github.com/goharbor/harbor/pull/23657))
- **ui:** Remove a hardcoded SBOM permission override ([goharbor/harbor#23223](https://github.com/goharbor/harbor/pull/23223))
- Fix TCR provider adapter parsing of international secret IDs ([goharbor/harbor#22869](https://github.com/goharbor/harbor/pull/22869))
- Add a size limit for manifest uploads ([goharbor/harbor#23500](https://github.com/goharbor/harbor/pull/23500))
- Add a ListReferrers API to the registry client and update parseScopes ([goharbor/harbor#23170](https://github.com/goharbor/harbor/pull/23170))
- Add proxy-cache hit/miss metrics ([goharbor/harbor#23578](https://github.com/goharbor/harbor/pull/23578))
- Add a size limit for the audit-log payload ([goharbor/harbor#23755](https://github.com/goharbor/harbor/pull/23755))
- Add a UI option to enable the proxy-cache referrer API ([goharbor/harbor#23151](https://github.com/goharbor/harbor/pull/23151))
- Bump Go from 1.25.7 to 1.26.3 ([goharbor/harbor#23235](https://github.com/goharbor/harbor/pull/23235))
- Bump Trivy to v0.71.1 and the Trivy adapter to v0.37.1-rc.1 ([goharbor/harbor#23388](https://github.com/goharbor/harbor/pull/23388))
- Call the /v2/auth/token API to get a bearer token for the Docker Hub adapter ([goharbor/harbor#23088](https://github.com/goharbor/harbor/pull/23088))
- Update the Trivy adapter to v0.37.1 ([goharbor/harbor#23423](https://github.com/goharbor/harbor/pull/23423))
- **deps:** Bump Go modules to fix known vulnerabilities ([goharbor/harbor#23720](https://github.com/goharbor/harbor/pull/23720))
- **deps:** Revert github.com/gorilla/csrf to v1.7.2 ([goharbor/harbor#23759](https://github.com/goharbor/harbor/pull/23759))
- **deps:** Update go.mod dependencies to patch versions ([goharbor/harbor#23751](https://github.com/goharbor/harbor/pull/23751))
- **acr:** Add artifact to the supported resource types ([goharbor/harbor#23392](https://github.com/goharbor/harbor/pull/23392))
- **audit:** Add member create/update/delete audit events ([goharbor/harbor#23228](https://github.com/goharbor/harbor/pull/23228))
- **backend:** Implement the proxy-cache repository filter API ([goharbor/harbor#23527](https://github.com/goharbor/harbor/pull/23527))
- **gc:** Use human-readable sizes in GC log messages ([goharbor/harbor#23123](https://github.com/goharbor/harbor/pull/23123))
- **session:** Prevent background polling from renewing the session TTL ([goharbor/harbor#22980](https://github.com/goharbor/harbor/pull/22980))
- **ui:** Support advanced proxy-cache configurations in the UI ([goharbor/harbor#23536](https://github.com/goharbor/harbor/pull/23536)) — <a href="/docs/2.16/administration-manual/replication/proxy-cache-projects/index.md">Docs: Proxy Cache Projects</a>
- Fix an issue in the scanner API ([goharbor/harbor#23061](https://github.com/goharbor/harbor/pull/23061))
- Add a newline to the escape pattern ([goharbor/harbor#23697](https://github.com/goharbor/harbor/pull/23697))
- Add i18n keys and missing translations ([goharbor/harbor#23002](https://github.com/goharbor/harbor/pull/23002))
- Add missing validation when creating a robot account ([goharbor/harbor#23691](https://github.com/goharbor/harbor/pull/23691))
- Add a registry component to proxy configuration support ([goharbor/harbor#23437](https://github.com/goharbor/harbor/pull/23437))
- Address unsafe type assertions that could cause panics across packages ([goharbor/harbor#23571](https://github.com/goharbor/harbor/pull/23571))
- Allow resizing the SBOM column in the artifact table ([goharbor/harbor#23646](https://github.com/goharbor/harbor/pull/23646))
- Bump repository update_time on tag and artifact changes ([goharbor/harbor#23225](https://github.com/goharbor/harbor/pull/23225))
- Convert robot-account ID columns and sequence to bigint ([goharbor/harbor#23633](https://github.com/goharbor/harbor/pull/23633))
- Convert setup_timestamp, status_revision, and revision columns to bigint to avoid Y2K38 overflow ([goharbor/harbor#23718](https://github.com/goharbor/harbor/pull/23718))
- Disallow an empty robot_name_prefix so OIDC CLI login is not blocked ([goharbor/harbor#22556](https://github.com/goharbor/harbor/pull/22556))
- Remove a duplicated "by" in beego ORM TableName comments ([goharbor/harbor#23234](https://github.com/goharbor/harbor/pull/23234))
- Enable chunked blob upload for Azure ACR replication ([goharbor/harbor#23016](https://github.com/goharbor/harbor/pull/23016))
- Fix a potential SQL injection ([goharbor/harbor#23418](https://github.com/goharbor/harbor/pull/23418))
- Fix a theoretical timing vulnerability ([goharbor/harbor#23433](https://github.com/goharbor/harbor/pull/23433))
- Guard against division by zero when merging scan-report summaries ([goharbor/harbor#23572](https://github.com/goharbor/harbor/pull/23572))
- Increase the access_key column length to 4096 ([goharbor/harbor#23414](https://github.com/goharbor/harbor/pull/23414))
- Fix member audit-log resolution after transaction commit ([goharbor/harbor#23586](https://github.com/goharbor/harbor/pull/23586))
- Neutralize CSV formula injection in scan export ([goharbor/harbor#23677](https://github.com/goharbor/harbor/pull/23677))
- Skip corrupted encrypted config values on decryption failure ([goharbor/harbor#23376](https://github.com/goharbor/harbor/pull/23376))
- Use errors.Is for sentinel error checks in the usergroup controller ([goharbor/harbor#23636](https://github.com/goharbor/harbor/pull/23636))
- Use a LEFT JOIN in projectBasicSQL to include projects without quota records ([goharbor/harbor#23520](https://github.com/goharbor/harbor/pull/23520))
- Validate max_upstream_conn values on the backend ([goharbor/harbor#22678](https://github.com/goharbor/harbor/pull/22678))
- **auditext:** Add a nil guard in manager Create ([goharbor/harbor#23107](https://github.com/goharbor/harbor/pull/23107))
- **cache:** Replace keyMutex with singleflight and avoid canceling the cache Save ([goharbor/harbor#23336](https://github.com/goharbor/harbor/pull/23336))
- **cnai-parser:** Enforce an actual byte limit to prevent decompression bombs ([goharbor/harbor#23497](https://github.com/goharbor/harbor/pull/23497))
- **dao:** Use context-aware methods for database operations in MetaDAO ([goharbor/harbor#23074](https://github.com/goharbor/harbor/pull/23074))
- **distribution:** Allow editing an instance without credentials ([goharbor/harbor#23165](https://github.com/goharbor/harbor/pull/23165))
- **ecr:** Use the amazonaws.com.cn domain for AWS China region endpoints ([goharbor/harbor#23326](https://github.com/goharbor/harbor/pull/23326))
- **gc:** Redact redis_url_reg from GC extra attrs ([goharbor/harbor#23134](https://github.com/goharbor/harbor/pull/23134))
- **i18n:** Localize the max-upstream-connection placeholder ([goharbor/harbor#23197](https://github.com/goharbor/harbor/pull/23197))
- **replication:** Fix incorrect error propagation in getAccessoryArts ([goharbor/harbor#23569](https://github.com/goharbor/harbor/pull/23569))
- **repoproxy:** Prevent proxy-cache poisoning via the robot-name prefix ([goharbor/harbor#23675](https://github.com/goharbor/harbor/pull/23675))
- **retention:** Avoid stripping the repository path twice ([goharbor/harbor#23546](https://github.com/goharbor/harbor/pull/23546))
- **scan:** Use the created time from annotations in the accessory artifact ([goharbor/harbor#23113](https://github.com/goharbor/harbor/pull/23113))
- **security:** Validate the blob-mount source project and reject tokens missing iat ([goharbor/harbor#23270](https://github.com/goharbor/harbor/pull/23270))
- **ui:** Update bindings in the Project Policy config ([goharbor/harbor#22694](https://github.com/goharbor/harbor/pull/22694))
- **ui:** Use the selected tag for the pull-command copy ([goharbor/harbor#23240](https://github.com/goharbor/harbor/pull/23240))
- Improve API completeness ([goharbor/harbor#23476](https://github.com/goharbor/harbor/pull/23476))
- Harden crypto usage and drop the unused SMTP package ([goharbor/harbor#23307](https://github.com/goharbor/harbor/pull/23307))
- **blob:** Fix a full table scan in the unassociation check ([goharbor/harbor#22994](https://github.com/goharbor/harbor/pull/22994))
- **replication:** Filter event policies in the query ([goharbor/harbor#23283](https://github.com/goharbor/harbor/pull/23283))
- Prevent an HTTP 500 when no project members are provided ([goharbor/harbor#23642](https://github.com/goharbor/harbor/pull/23642))
- Proxy the referrer API to the upstream registry with paging and local merge ([goharbor/harbor#23237](https://github.com/goharbor/harbor/pull/23237))
- Remove deprecated io/ioutil usage ([goharbor/harbor#23611](https://github.com/goharbor/harbor/pull/23611))
- Replace the deprecated golang.org/x/net/context ([goharbor/harbor#23630](https://github.com/goharbor/harbor/pull/23630))
- **config:** Centralize the registry HTTP client timeout ([goharbor/harbor#23154](https://github.com/goharbor/harbor/pull/23154))
- **task:** Use a Redis SET with SPOP for outdate execution-status refresh ([goharbor/harbor#23183](https://github.com/goharbor/harbor/pull/23183))
- Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml ([goharbor/harbor#23349](https://github.com/goharbor/harbor/pull/23349))
- Set blob response headers before streaming the body ([goharbor/harbor#23374](https://github.com/goharbor/harbor/pull/23374))
- Accelerate flaky tests by removing time.Sleep ([goharbor/harbor#23692](https://github.com/goharbor/harbor/pull/23692))
- Reduce arbitrary sleep delays in core auth and awsecr tests ([goharbor/harbor#23722](https://github.com/goharbor/harbor/pull/23722))
- Update and improve the zh-TW Traditional Chinese locale ([goharbor/harbor#23315](https://github.com/goharbor/harbor/pull/23315))
- Add a source column to artifact_accessory to identify the accessory ([goharbor/harbor#23144](https://github.com/goharbor/harbor/pull/23144))
- Update the ECR adapter to allow ecr-public to be mirrored ([goharbor/harbor#22351](https://github.com/goharbor/harbor/pull/22351))
- Upgrade Harbor go.mod OSS packages ([goharbor/harbor#23314](https://github.com/goharbor/harbor/pull/23314))