--- title: "Harbor v2.15.12" description: "Release notes for Container Registry 2.15.12: trusted issuers gain an audience field filled from the legacy aud claim; the project-admin grant guard is reverted." date: 2026-10-20 lastmod: 2026-10-23 canonical: "https://container-registry.com/docs/release-notes/harbor/v2.15.12/" source: "https://container-registry.com/docs/release-notes/harbor/v2.15.12/index.md" harbor_version: "2.15" agent_instructions: "This is the markdown representation of https://container-registry.com/docs/release-notes/harbor/v2.15.12/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt." --- > Agent-friendly representation of . Site index: . # Harbor v2.15.12 *Release notes for Container Registry 2.15.12: trusted issuers gain an audience field filled from the legacy aud claim; the project-admin grant guard is reverted.* Harbor v2.15.12 =============== Released 2026-10-15. Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published. ## Summary Trusted issuers gain an `audience` column. The `(issuer, project_id)` uniqueness constraint is dropped. ## Commercial Features ### Federated Robot Accounts - Reject deleting a trusted issuer's `aud` or `iss` claim with 400; they are immutable like on create (container-registry/8gcr#522) - Answer 400 for a trusted issuer id of 0 or less instead of 404 (container-registry/8gcr#522) - A trusted issuer now declares its audience as a field; issuer plus audience is its identity, so several trusted issuers may share an issuer URL with different audiences, and aud or iss are no longer accepted as claim rules (container-registry/8gcr#527) ## Upgrade Notes > **Warning:** Federated Robot Accounts: check every trusted issuer after upgrading. A trusted issuer left without an audience refuses every token, so all federated robot accounts on it stop authenticating until its audience is set. A trusted issuer now has an `audience` field: the value the token's `aud` claim must carry. Issuer URL plus audience identify a trusted issuer, so several trusted issuers may share an issuer URL with different audiences. `aud` and `iss` are no longer accepted as claim rules (container-registry/8gcr#527). **What the upgrade does.** The database migration fills the audience of each existing trusted issuer from its legacy issuer-level `aud` claim rule ([#1249](https://github.com/container-registry/harbor-next/issues/1249)), provided that rule has exactly one value and no other trusted issuer with the same issuer URL has, or would get, the same audience. The old `aud` claim rule rows stay in place. **What you have to do.** Open **Administration > Federated Robot Accounts** (or `GET /api/v2.0/trusted-issuers`; project-level trusted issuers with `?q=Level=project,ProjectID=`) and look for trusted issuers with an empty audience. Tokens from such an issuer are refused with 401, and harbor-core logs: ```text trusted issuer has no audience; set it before tokens from can be accepted ``` Set the audience once, in the portal edit form or through the API: ```bash curl -u admin -X PUT https://registry.example.com/api/v2.0/trusted-issuers/ \ -H 'Content-Type: application/json' \ -d '{"audience": ""}' ``` Robots and their claim rules need no change. - **Exact match, scheme included.** The audience must equal the token's `aud` exactly. A GitHub Actions workflow that requests its token with `audience=https://registry.example.com` needs the trusted issuer audience `https://registry.example.com`, not `registry.example.com`. Take the value from a decoded token. When `aud` is a list, one matching entry is enough. - **Set once.** The audience can only be set while it is empty. A later change is refused with 400 `cannot modify audience after it is set`. To correct a wrong value, delete the trusted issuer and create it again. A trusted issuer with robots attached cannot be deleted (`Please delete the associated robots before deleting the trusted issuer`), so its federated robot accounts have to be recreated as well. - **New trusted issuers.** Creating a trusted issuer without an audience is refused with 400 `audience is required`. A claim rule on `aud` or `iss` is refused with 400. ## Fixes - **db:** Add The Trusted Issuer Audience Column (backport [#1236](https://github.com/container-registry/harbor-next/issues/1236)) ([#1239](https://github.com/container-registry/harbor-next/issues/1239)) - **db:** Fill The Trusted Issuer Audience From Its Legacy aud Claim (backport [#1248](https://github.com/container-registry/harbor-next/issues/1248)) ([#1249](https://github.com/container-registry/harbor-next/issues/1249)) ## Reverts - Drop The Project-Admin Grant Guard (backport [#1137](https://github.com/container-registry/harbor-next/issues/1137) revert) ([#1227](https://github.com/container-registry/harbor-next/issues/1227)) ## Container Images Multi-arch images (`linux/amd64`, `linux/arm64`) signed with [cosign](https://github.com/sigstore/cosign). | Image | Reference | |-------|-----------| | `harbor-core` | `8gears.container-registry.com/8gcr/harbor-core:v2.15.12` | | `harbor-jobservice` | `8gears.container-registry.com/8gcr/harbor-jobservice:v2.15.12` | | `harbor-registryctl` | `8gears.container-registry.com/8gcr/harbor-registryctl:v2.15.12` | | `harbor-exporter` | `8gears.container-registry.com/8gcr/harbor-exporter:v2.15.12` | | `harbor-portal` | `8gears.container-registry.com/8gcr/harbor-portal:v2.15.12` | | `harbor-registry` | `8gears.container-registry.com/8gcr/harbor-registry:v2.15.12` | | `trivy-adapter` | `8gears.container-registry.com/8gcr/trivy-adapter:v2.15.12` | **Verify an image signature:** ```sh cosign verify \ --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ 8gears.container-registry.com/8gcr/harbor-core:v2.15.12 ```