Harbor v2.15.13

Released 2026-10-19.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

Summary

Reverts the scheduled-retention change from v2.15.10 (#1171). Project Admins and Maintainers whose role comes from an OIDC, LDAP or auth-proxy group, and admins who are admins through the auth provider’s admin group, can save scheduled tag retention policies again.

The Developer role no longer holds create, update, delete or run on tag retention; it keeps read and list. This closes a tag retention privilege issue without recording an execution principal. Maintainers and Project Admins are unchanged.

Existing scheduled policies are untouched. Harbor does not record who created a policy, so admins should review scheduled retention policies after upgrading.

Upgrading from v2.15.11 or Earlier

v2.15.12 made the audience a field of each Federated Robot Accounts trusted issuer. A trusted issuer that the upgrade migration could not give an audience refuses every token afterwards. Follow the v2.15.12 upgrade notes right after upgrading: find trusted issuers with an empty audience and set it once.

Reverts

• Durable Deletion Authority And Limit Developers To Reading Policies (Revert #1171 / #1164) (#1268)

Container Images

Multi-arch images (linux/amd64, linux/arm64) signed with cosign.

Verify an image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.13