What's Changed

Component updates ⬆️

• (cherry-pick) fix: avoid panic in user audit event resolver on nil event data (#23461) by @Aloui-Ikram in #23501
• (cherry-pick) fix: Constrain /registries/ping to the saved URL for existing registries (#23463) by @Aloui-Ikram in #23502
• (cherry-pick) Add a size limit for manifest uploads by @Aloui-Ikram in #23503
• cherry-pick: fix(ui): use dark login background in dark mode by @bupd in #23539
• ci: remove third-party docker action by @stonezdj in #23693
• (cherry-pick) neutralize CSV formula in scan export by @stonezdj in #23696
• (cherry-pick): prevent proxy-cache poisoning via robot-name prefix by @stonezdj in #23695
• (cherry-pick) Exclude replication from dockerhub in github action by @stonezdj in #23715
• (cherry-pick) fix: convert setup_timestamp, status_revision, and revision columns to bigint to avoid Y2K38 overflow (#23711) by @stonezdj in #23719
• (cherry-pick) add size limit for audit log payload by @stonezdj in #23758
• (cherry-pick) Refine utils function IsLocalPath by @stonezdj in #23757
• [Backport] test(api): enhance stability of test_copy_disability in tag immutability by @fiona-xie in #23775
• (cherry-pick): query robot account to validate proxy session and fix UT by @stonezdj in #23780
• [cherry-pick]fix: correct grammar and typos in user-facing error messages by @wy65701436 in #23822
• [cherry pick] Remove hardcoded credentials and prevernt passwords in logs by @jUDASmILE in #23865
• make hostname comparisons case-insensitive by @stonezdj in #23833
• [cherry pick] improve HTTP client request logging and credential str… by @jUDASmILE in #23876
• [cherry pick]refactor: sanitize connection details in logs and enhance error messa… by @jUDASmILE in #23886
• (cherry-pick) make endpoint handling and validation case-insensitive by @stonezdj in #23887

Bump Component Version 🤖

• bump the v2.15.3 by @wy65701436 in #23508
• chore(deps): bump the patch-updates group across 1 directory with 3 updates by @dependabot[bot] in #23728
• chore(deps-dev): bump stylelint from 14.16.1 to 17.14.1 in /src/portal by @dependabot[bot] in #23741
• bump golang to v1.26.7 and refresh base image by @stonezdj in #23797
• Bump trivy(0.74.0) and trivy adapter(0.39.0) by @stonezdj in #23796
• chore(deps): upgrade Go dependencies to fix CVEs by @stonezdj in #23802
• (cherry-pick): bump golang.org/x/crypto to v0.55.0 by @stonezdj in #23825
• chore(deps-dev): bump express and @types/express in /src/portal by @dependabot[bot] in #23739
• Bump up distribution version by @stonezdj in #23811
• chore(deps): upgrade Go dependencies to fix CVEs by @stonezdj in #23877
• Bump up distribution version by @stonezdj in #23890

Other Changes

• (cherry-pick) Fix job service dashboard testcase failed issue by @stonezdj in #23492
• (cherry-pick): fix race condition in log rotation test by polling job status by @stonezdj in #23525
• (cherry-pick)ci: pin docker-practice/actions-setup-docker to a full commit SHA (#23554) by @stonezdj in #23667
• (cherry-pick): add explicit permissions block to workflows by @stonezdj in #23694
• (cherry-pick) fix: system_cve testcase failing at end of month by @stonezdj in #23817
• ci: Make go mod tidy work without generated swagger code so Dependabot can update Go modules (release-2.15.0) by @Vad1mo in #23841

Full Changelog: v2.15.2...v2.15.3-rc1

Upgrade Notice: Internal PostgreSQL Upgrade

Upgrading to Harbor v2.15.2 (Helm Chart v1.19.2) automatically updates the bundled internal database from PostgreSQL 15 to PostgreSQL 18 via pg_upgrade upon container startup.

Action Items & Considerations

1. Backup Data: Back up your database before applying the upgrade or restarting the database pod.
2. Maintenance Downtime: pg_upgrade runs on pod startup and may temporarily extend initialization time depending on database size.
3. Reindexing (Non-ASCII Data & Troubleshooting): Major PostgreSQL collation changes can cause existing B-Tree indexes to become stale or corrupted.
   • Proactive Maintenance: To avoid collation index issues post-upgrade, environments with non-ASCII should execute reindexdb during a maintenance window.
   • Troubleshooting: If you experience issues after upgrading—such as robot account permission failures, UI lists loading indefinitely, or index queries returning empty results—run the following command during a maintenance window:
     reindexdb --all-databases -U postgres

What's Changed

Component updates ⬆️

• [CHERRY-PICK] Make openapi-generator-cli download URL configurable (#23186) by @chlins in #23221
• bump Go version from 1.25.9 to 1.26.3 by @stonezdj in #23236
• [cherry-pick] Rebuild goharbor/photon image before create new harbor base images by @jUDASmILE in #23250
• [cherry-pick]remove install net-tools from db dockerfile as photon removed it by @jUDASmILE in #23267
• [CHERRY-PICK] feat: replace redis with valkey as cache backend (#23157) by @chlins in #23261
• [CHERRY-PICK] test(cosign): disable tlog for signing checks by @chlins in #23280
• [CHERRY-PICK] fix(cosign): ignore tlog during verification by @chlins in #23286
• [CHERRY-PICK] fix: Bump repository update_time on tag and artifact changes (#23225) by @chlins in #23292
• [CHERRY-PICK] fix(security): validate blob-mount source project and reject tokens missing iat (#23270) by @Vad1mo in #23297
• (cherry-pick) Upgrade harbor go.mod OSS packages by @stonezdj in #23328
• [cherry-pick] Harden crypto usage and drop unused SMTP package (#23307) by @wy65701436 in #23356
• (cherry-pick) Update Makefile PIP_INDEX_URL to use default value if not defined by @stonezdj in #23377
• [Backport 2.15.0] test(api_db): support dynamic OpenAPI generator and PyPI URLs via env vars by @fiona-xie in #23381
• bump golang to v1.26.4 by @wy65701436 in #23382
• (cherry-pick) Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22 by @stonezdj in #23379
• [Cherry-Pick] test(ui): Fix db_schedule and replication failed cases after Angular&Clarity upgrade by @fiona-xie in #23395
• (cherry-pick) fix UI issues across portal components by @stonezdj in #23399
• cherry-pick: fix(ui): use selected tag for pull command copy (#23240) to release-2.15.0 by @stonezdj in #23426
• cherry-pick: fix(ui): fix UI issues #48–#54 across portal components (#23427) to release-2.15.0 by @stonezdj in #23428
• Fix build issue related to npm package by @stonezdj in #23435
• [cherry-pick] fix: multiple UI/UX fixes for checkboxes, alignment, dark theme, and i18n (#23439) to release-2.15.0 by @stonezdj in #23440
• [cherry-pick] fix(portal): align pending job queue counts and improve form styling by @wy65701436 in #23459
• build(registry): update registry source tag to rc.5 by @chlins in #23465

Bump Component Version 🤖

• bump harbor v2.15.2 by @wy65701436 in #23362
• (cherry-pick)Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml by @stonezdj in #23378
• Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1 by @stonezdj in #23386
• Bump Trivy adapter version to v0.37.1 by @stonezdj in #23422
• Bump base photon OS image by @stonezdj in #23424
• sync package-lock.json in UI by @stonezdj in #23431
• Bump trivy(0.72.0) and trivy adatper(0.38.0) by @stonezdj in #23480
• build(registry): use stable registry source tag v2.8.3-harbor.1 by @chlins in #23482
• update base image by @stonezdj in #23485

Other Changes

• [CHERRY-PICK] support configurable PIP_INDEX_URL for swagger client build (#23241) by @stonezdj in #23242
• build: use dev-legacy tags to decouple 2.15 builds from main by @wy65701436 in #23360
• [Backport 2.15.0] test(UI): fix UI robot test cases for Angular and Clarity Upgrade by @fiona-xie in #23380
• [Cherry-Pick] test(ui): add retry for Get Harbor CA to improve stability (#23396) by @fiona-xie in #23405
• Downgrade node-release to 2.0.48 for build compatibility by @stonezdj in #23432

Full Changelog: v2.15.1...v2.15.2

What's Changed

Component updates ⬆️

• [CHERRY-PICK] Make openapi-generator-cli download URL configurable (#23186) by @chlins in #23221
• bump Go version from 1.25.9 to 1.26.3 by @stonezdj in #23236
• [cherry-pick] Rebuild goharbor/photon image before create new harbor base images by @jUDASmILE in #23250
• [cherry-pick]remove install net-tools from db dockerfile as photon removed it by @jUDASmILE in #23267
• [CHERRY-PICK] feat: replace redis with valkey as cache backend (#23157) by @chlins in #23261
• [CHERRY-PICK] test(cosign): disable tlog for signing checks by @chlins in #23280
• [CHERRY-PICK] fix(cosign): ignore tlog during verification by @chlins in #23286
• [CHERRY-PICK] fix: Bump repository update_time on tag and artifact changes (#23225) by @chlins in #23292
• [CHERRY-PICK] fix(security): validate blob-mount source project and reject tokens missing iat (#23270) by @Vad1mo in #23297
• (cherry-pick) Upgrade harbor go.mod OSS packages by @stonezdj in #23328
• [cherry-pick] Harden crypto usage and drop unused SMTP package (#23307) by @wy65701436 in #23356
• (cherry-pick) Update Makefile PIP_INDEX_URL to use default value if not defined by @stonezdj in #23377
• [Backport 2.15.0] test(api_db): support dynamic OpenAPI generator and PyPI URLs via env vars by @fiona-xie in #23381
• bump golang to v1.26.4 by @wy65701436 in #23382
• (cherry-pick) Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22 by @stonezdj in #23379
• [Cherry-Pick] test(ui): Fix db_schedule and replication failed cases after Angular&Clarity upgrade by @fiona-xie in #23395
• (cherry-pick) fix UI issues across portal components by @stonezdj in #23399
• cherry-pick: fix(ui): use selected tag for pull command copy (#23240) to release-2.15.0 by @stonezdj in #23426
• cherry-pick: fix(ui): fix UI issues #48–#54 across portal components (#23427) to release-2.15.0 by @stonezdj in #23428
• Fix build issue related to npm package by @stonezdj in #23435
• [cherry-pick] fix: multiple UI/UX fixes for checkboxes, alignment, dark theme, and i18n (#23439) to release-2.15.0 by @stonezdj in #23440
• [cherry-pick] fix(portal): align pending job queue counts and improve form styling by @wy65701436 in #23459
• build(registry): update registry source tag to rc.5 by @chlins in #23465

Bump Component Version 🤖

• bump harbor v2.15.2 by @wy65701436 in #23362
• (cherry-pick)Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml by @stonezdj in #23378
• Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1 by @stonezdj in #23386
• Bump Trivy adapter version to v0.37.1 by @stonezdj in #23422
• Bump base photon OS image by @stonezdj in #23424
• sync package-lock.json in UI by @stonezdj in #23431
• Bump trivy(0.72.0) and trivy adatper(0.38.0) by @stonezdj in #23480
• build(registry): use stable registry source tag v2.8.3-harbor.1 by @chlins in #23482
• update base image by @stonezdj in #23485

Other Changes

• [CHERRY-PICK] support configurable PIP_INDEX_URL for swagger client build (#23241) by @stonezdj in #23242
• build: use dev-legacy tags to decouple 2.15 builds from main by @wy65701436 in #23360
• [Backport 2.15.0] test(UI): fix UI robot test cases for Angular and Clarity Upgrade by @fiona-xie in #23380
• [Cherry-Pick] test(ui): add retry for Get Harbor CA to improve stability (#23396) by @fiona-xie in #23405
• Downgrade node-release to 2.0.48 for build compatibility by @stonezdj in #23432

Full Changelog: v2.15.1...v2.15.2-rc3

What's Changed

Component updates ⬆️

• [CHERRY-PICK] Make openapi-generator-cli download URL configurable (#23186) by @chlins in #23221
• bump Go version from 1.25.9 to 1.26.3 by @stonezdj in #23236
• [cherry-pick] Rebuild goharbor/photon image before create new harbor base images by @jUDASmILE in #23250
• [cherry-pick]remove install net-tools from db dockerfile as photon removed it by @jUDASmILE in #23267
• [CHERRY-PICK] feat: replace redis with valkey as cache backend (#23157) by @chlins in #23261
• [CHERRY-PICK] test(cosign): disable tlog for signing checks by @chlins in #23280
• [CHERRY-PICK] fix(cosign): ignore tlog during verification by @chlins in #23286
• [CHERRY-PICK] fix: Bump repository update_time on tag and artifact changes (#23225) by @chlins in #23292
• [CHERRY-PICK] fix(security): validate blob-mount source project and reject tokens missing iat (#23270) by @Vad1mo in #23297
• (cherry-pick) Upgrade harbor go.mod OSS packages by @stonezdj in #23328
• [cherry-pick] Harden crypto usage and drop unused SMTP package (#23307) by @wy65701436 in #23356
• (cherry-pick) Update Makefile PIP_INDEX_URL to use default value if not defined by @stonezdj in #23377
• [Backport 2.15.0] test(api_db): support dynamic OpenAPI generator and PyPI URLs via env vars by @fiona-xie in #23381
• bump golang to v1.26.4 by @wy65701436 in #23382
• (cherry-pick) Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22 by @stonezdj in #23379
• [Cherry-Pick] test(ui): Fix db_schedule and replication failed cases after Angular&Clarity upgrade by @fiona-xie in #23395
• (cherry-pick) fix UI issues across portal components by @stonezdj in #23399
• cherry-pick: fix(ui): use selected tag for pull command copy (#23240) to release-2.15.0 by @stonezdj in #23426
• cherry-pick: fix(ui): fix UI issues #48–#54 across portal components (#23427) to release-2.15.0 by @stonezdj in #23428
• Fix build issue related to npm package by @stonezdj in #23435
• [cherry-pick] fix: multiple UI/UX fixes for checkboxes, alignment, dark theme, and i18n (#23439) to release-2.15.0 by @stonezdj in #23440

Bump Component Version 🤖

• bump harbor v2.15.2 by @wy65701436 in #23362
• (cherry-pick)Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml by @stonezdj in #23378
• Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1 by @stonezdj in #23386
• Bump Trivy adapter version to v0.37.1 by @stonezdj in #23422
• Bump base photon OS image by @stonezdj in #23424
• sync package-lock.json in UI by @stonezdj in #23431

Other Changes

• [CHERRY-PICK] support configurable PIP_INDEX_URL for swagger client build (#23241) by @stonezdj in #23242
• build: use dev-legacy tags to decouple 2.15 builds from main by @wy65701436 in #23360
• [Backport 2.15.0] test(UI): fix UI robot test cases for Angular and Clarity Upgrade by @fiona-xie in #23380
• [Cherry-Pick] test(ui): add retry for Get Harbor CA to improve stability (#23396) by @fiona-xie in #23405
• Downgrade node-release to 2.0.48 for build compatibility by @stonezdj in #23432

Full Changelog: v2.15.1...v2.15.2-rc2

What's Changed

Component updates ⬆️

• [CHERRY-PICK] Make openapi-generator-cli download URL configurable (#23186) by @chlins in #23221
• bump Go version from 1.25.9 to 1.26.3 by @stonezdj in #23236
• [cherry-pick] Rebuild goharbor/photon image before create new harbor base images by @jUDASmILE in #23250
• [cherry-pick]remove install net-tools from db dockerfile as photon removed it by @jUDASmILE in #23267
• [CHERRY-PICK] feat: replace redis with valkey as cache backend (#23157) by @chlins in #23261
• [CHERRY-PICK] test(cosign): disable tlog for signing checks by @chlins in #23280
• [CHERRY-PICK] fix(cosign): ignore tlog during verification by @chlins in #23286
• [CHERRY-PICK] fix: Bump repository update_time on tag and artifact changes (#23225) by @chlins in #23292
• [CHERRY-PICK] fix(security): validate blob-mount source project and reject tokens missing iat (#23270) by @Vad1mo in #23297
• (cherry-pick) Upgrade harbor go.mod OSS packages by @stonezdj in #23328
• [cherry-pick] Harden crypto usage and drop unused SMTP package (#23307) by @wy65701436 in #23356
• (cherry-pick) Update Makefile PIP_INDEX_URL to use default value if not defined by @stonezdj in #23377
• [Backport 2.15.0] test(api_db): support dynamic OpenAPI generator and PyPI URLs via env vars by @fiona-xie in #23381
• bump golang to v1.26.4 by @wy65701436 in #23382
• (cherry-pick) Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22 by @stonezdj in #23379

Bump Component Version 🤖

• bump harbor v2.15.2 by @wy65701436 in #23362
• (cherry-pick)Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml by @stonezdj in #23378
• Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1 by @stonezdj in #23386

Other Changes

• [CHERRY-PICK] support configurable PIP_INDEX_URL for swagger client build (#23241) by @stonezdj in #23242
• build: use dev-legacy tags to decouple 2.15 builds from main by @wy65701436 in #23360
• [Backport 2.15.0] test(UI): fix UI robot test cases for Angular and Clarity Upgrade by @fiona-xie in #23380

Full Changelog: v2.15.1...v2.15.2-rc1

What's Changed

Component updates ⬆️

• [CHERRY_PICK] fix(session): fix SessionRegenerate save args and lifetime by @chlins in #22882
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23098
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23109
• (cherry-pick) Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23208
• bump Go to 1.25.9 and use goharbor/photon:5.0 base images by @stonezdj in #23204
• Bump up the go.opentelemetry.io/otel/sdk and github.com/go-jose/go-jose package by @stonezdj in #23215
• (cherry-pick) Fix the issue distribution instance edit without creden… by @chlins in #23220

Full Changelog: v2.14.3...v2.14.4

What's Changed

Component updates ⬆️

• [CHERRY_PICK] fix(session): fix SessionRegenerate save args and lifetime by @chlins in #22882
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23098
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23109
• (cherry-pick) Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23208
• bump Go to 1.25.9 and use goharbor/photon:5.0 base images by @stonezdj in #23204
• Bump up the go.opentelemetry.io/otel/sdk and github.com/go-jose/go-jose package by @stonezdj in #23215
• (cherry-pick) Fix the issue distribution instance edit without creden… by @chlins in #23220

Full Changelog: v2.14.3...v2.14.4-rc1

What's Changed

Component updates ⬆️

• (cherry-pick) Fix Last Pull time on parent/child artifacts and on creation by @stonezdj in #23022
• (cherry-pick) Add User-Agent to all request by @stonezdj in #23054
• (cherry-pick): fix proxy cache serve local on remote not found by @stonezdj in #23049
• [cherry-pick] Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23096
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23097
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23108
• bump base for v2.15.1 by @wy65701436 in #23120
• [CHERRY-PICK] fix(gc): redact redis_url_reg from GC extra attrs (#23134) by @chlins in #23141
• (cherry-pick) Fix the issue distribution instance edit without credential can not save by @stonezdj in #23166
• Update photon packages to fix CVEs by @stonezdj in #23176
• Revert the previous change in Dockerfile.base and change base image to goharbor/photon:5.0 by @stonezdj in #23180

Bump Component Version 🤖

• bump go to 1.25.9 and refresh base images by @stonezdj in #23150
• Upgrade go deps go-jose and otel sdk by @stonezdj in #23158

Full Changelog: v2.15.0...v2.15.1

What's Changed

Component updates ⬆️

• (cherry-pick) Fix Last Pull time on parent/child artifacts and on creation by @stonezdj in #23022
• (cherry-pick) Add User-Agent to all request by @stonezdj in #23054
• (cherry-pick): fix proxy cache serve local on remote not found by @stonezdj in #23049
• [cherry-pick] Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23096
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23097
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23108
• bump base for v2.15.1 by @wy65701436 in #23120
• [CHERRY-PICK] fix(gc): redact redis_url_reg from GC extra attrs (#23134) by @chlins in #23141
• (cherry-pick) Fix the issue distribution instance edit without credential can not save by @stonezdj in #23166
• Update photon packages to fix CVEs by @stonezdj in #23176
• Revert the previous change in Dockerfile.base and change base image to goharbor/photon:5.0 by @stonezdj in #23180

Bump Component Version 🤖

• bump go to 1.25.9 and refresh base images by @stonezdj in #23150
• Upgrade go deps go-jose and otel sdk by @stonezdj in #23158

Full Changelog: v2.15.0...v2.15.1-rc2

What's Changed

Component updates ⬆️

• (cherry-pick) Fix Last Pull time on parent/child artifacts and on creation by @stonezdj in #23022
• (cherry-pick) Add User-Agent to all request by @stonezdj in #23054
• (cherry-pick): fix proxy cache serve local on remote not found by @stonezdj in #23049
• [cherry-pick] Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23096
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23097
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23108
• bump base for v2.15.1 by @wy65701436 in #23120
• [CHERRY-PICK] fix(gc): redact redis_url_reg from GC extra attrs (#23134) by @chlins in #23141
• (cherry-pick) Fix the issue distribution instance edit without credential can not save by @stonezdj in #23166
• Update photon packages to fix CVEs by @stonezdj in #23176
• Revert the previous change in Dockerfile.base and change base image to goharbor/photon:5.0 by @stonezdj in #23180

Bump Component Version 🤖

• bump go to 1.25.9 and refresh base images by @stonezdj in #23150
• Upgrade go deps go-jose and otel sdk by @stonezdj in #23158

Full Changelog: v2.15.0...v2.15.1-rc1