---
title: "Harbor v2.15.13"
description: "Release notes for Container Registry 2.15.13: reverts durable deletion authority so group-based admins can save scheduled retention; Developers keep read only."
date: 2026-10-20
lastmod: 2026-10-23
canonical: "https://container-registry.com/docs/release-notes/harbor/v2.15.13/"
source: "https://container-registry.com/docs/release-notes/harbor/v2.15.13/index.md"
harbor_version: "2.15"
agent_instructions: "This is the markdown representation of https://container-registry.com/docs/release-notes/harbor/v2.15.13/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/docs/release-notes/harbor/v2.15.13/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Harbor v2.15.13

*Release notes for Container Registry 2.15.13: reverts durable deletion authority so group-based admins can save scheduled retention; Developers keep read only.*

Harbor v2.15.13
===============

Released 2026-10-19.

Supported until v2.17. Container Registry supports the current and previous minor releases; this version reaches end of support when the second newer minor (v2.17) is published.

## Summary

Reverts the scheduled-retention change from v2.15.10 ([#1171](https://github.com/container-registry/harbor-next/issues/1171)). Project Admins and Maintainers whose role comes from an OIDC, LDAP or auth-proxy group, and admins who are admins through the auth provider's admin group, can save scheduled tag retention policies again.


> **Warning:** The Developer role no longer holds create, update, delete or run on tag retention; it keeps read and list. This closes a tag retention privilege issue without recording an execution principal. Maintainers and Project Admins are unchanged.



> **Important:** Existing scheduled policies are untouched. Harbor does not record who created a policy, so admins should review scheduled retention policies after upgrading.


## Upgrading from v2.15.11 or Earlier


> **Important:** v2.15.12 made the audience a field of each Federated Robot Accounts trusted issuer. A trusted issuer that the upgrade migration could not give an audience refuses every token afterwards. Follow the <a href="/docs/release-notes/harbor/harbor-v2-15-12.md#upgrade-notes">v2.15.12 upgrade notes</a> right after upgrading: find trusted issuers with an empty audience and set it once.


## Reverts

- Durable Deletion Authority And Limit Developers To Reading Policies (Revert [#1171](https://github.com/container-registry/harbor-next/issues/1171) / [#1164](https://github.com/container-registry/harbor-next/issues/1164)) ([#1268](https://github.com/container-registry/harbor-next/issues/1268))

## Container Images

Multi-arch images (`linux/amd64`, `linux/arm64`) signed with [cosign](https://github.com/sigstore/cosign).

| Image | Reference |
|-------|-----------|
| `harbor-core` | `8gears.container-registry.com/8gcr/harbor-core:v2.15.13` |
| `harbor-jobservice` | `8gears.container-registry.com/8gcr/harbor-jobservice:v2.15.13` |
| `harbor-registryctl` | `8gears.container-registry.com/8gcr/harbor-registryctl:v2.15.13` |
| `harbor-exporter` | `8gears.container-registry.com/8gcr/harbor-exporter:v2.15.13` |
| `harbor-portal` | `8gears.container-registry.com/8gcr/harbor-portal:v2.15.13` |
| `harbor-registry` | `8gears.container-registry.com/8gcr/harbor-registry:v2.15.13` |
| `trivy-adapter` | `8gears.container-registry.com/8gcr/trivy-adapter:v2.15.13` |

**Verify an image signature:**
```sh
cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-next/.github/workflows/release-please.yml@refs/heads/release-2.15" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-core:v2.15.13
```