What's Changed
Exciting New Features 🎉
Robot Account Full Access
Delivers a user-friendly tutorial that walks you through the creation of a new robot. With a simple click, you can seamlessly customize permission sets at both system and project levels.
- Add full permissions for the robot account by @AllForNothing in #19507
- subject: fix missing media type recognition for nydus by @imeoer in #19453
Supporting OCI Distribution Spec v1.1.0-rc3
Harbor now supports OCI Distribution Spec v1.1.0-rc3
- change Referrers Content-Type to application/vnd.oci.image.index.v1+json by @MinerYang in #19212
- support accessory in either order by @wy65701436 in #19375
Additional Features
Quota Sorting
Enable storage sorting in the quota management page
- Add quota sorting to the project quotas list by @AllForNothing in #19576
Allow customization of the OIDC provider name
- Add oidc provider name to systeminfo API by @stonezdj in #19575
- Show OIDC provider name on the OIDC login button by @AllForNothing in #19581
Enable support for large-size blobs
Harbor now facilitates uploads of layers up to 128GB by default, with configurable options if required.
Ensure audit logs comply with GDPR regulations for data privacy.
Enhancement 🚀
- feat: enhance the replication webhook payload by @chlins in #19433
- fix: Accessibility - change color for WCAG AA by @SphinxKnight in #19472
- perf: optimize the trigger retention API by @chlins in #19533
- Add a placeholder to the cards for the security-hub by @AllForNothing in #19536
- perf: optimize the performance of accessory query by @chlins in #19557
Component updates ⬆️
- Add label's description as tooltip by @Nhqml in #19421
- fix: privileges member successfully typo by @testwill in #19091
- fix: add storage_limit check by @zyyw in #19095
- fix: cron string validation by @zyyw in #19071
- ignore spaces for vulnerability filters by @AllForNothing in #19180
- Update zh-tw (Traditional Chinese) locale by @PeterDaveHello in #19161
- chore: fix incorrect otel timeout in harbor yaml template by @chlins in #19120
- Update the max length for the filters by @AllForNothing in #19194
- Filter artifact without CVE from top 5 dangerous artifacts by @stonezdj in #19187
- log: change log level to reduce the noise logs by @chlins in #19146
- Wrong artifact scanned count by @stonezdj in #19198
- fix: support customize cache db for business by @chlins in #19182
- fix gc dry run issue by @wy65701436 in #19208
- Add new uri path to ShouldNotReuseRoute array by @AllForNothing in #19217
- Refine total artifact and scanned artifact by @stonezdj in #19228
- i18n: fix typo for CONFIRM_SECRET by @liubin in #19140
- Add a tooltip for the page title of security hub by @AllForNothing in #19231
- change JOB_ID to Task_ID by @lengrongfu in #19127
- fix typo in ROADMAP.md by @liubin in #19247
- Delete unused code by @liubin in #19061
- exporter: add field alias for count(*) func by @liubin in #18840
- Switch to a new chart library by @AllForNothing in #19262
- Remove job status track information from redis after stop by @stonezdj in #19227
- remove chart-museum related to logic by @lengrongfu in #18722
- fix storage.redirect.disable migrate template error by @MinerYang in #19335
- Upgrade UI packages by @AllForNothing in #19330
- Remove duplicated sort fields from order by clause by @liubin in #19347
- fix user resource by @wy65701436 in #19366
- update default processor for unknwon type config by @MinerYang in #19372
- Hide version property if the value is undefined by @AllForNothing in #19395
- feat(i18n): update french translations by @Nhqml in #19418
- bump golang to 1.20.10 by @MinerYang in #19430
- Change fixed_version to package_version in query dangerous CVE sql by @stonezdj in #19397
- fix issue 19392 by @wy65701436 in #19437
- fix: bump up TRIVYVERSION=v0.46.0 && TRIVYADAPTERVERSION=v0.30.17 by @zyyw in #19446
- Update the style for operation-component by @AllForNothing in #19445
- bump golang.org/x/net to v0.17.0 && go.opentelemetry.io/contrib by @MinerYang in #19461
- Use batch to list the job id in the job queue to avoid crash redis by @stonezdj in #19444
- Delete tag retention rule and tag immutable rule when deleting project by @stonezdj in #19390
- bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/m… by @MinerYang in #19477
- Not allow comma for the user name by @AllForNothing in #19501
- bump golang to 1.21.3 by @MinerYang in #19504
- Add a tooltip for the replication rule by @AllForNothing in #19509
- Replace comma in username to avoid casbin issue by @stonezdj in #19505
- Update the style for severity by @AllForNothing in #19525
- Remove vendor folder from harbor code base by @reasonerjt in #19508
- fix: bump up TRIVYVERSION=v0.46.1 && TRIVYADAPTERVERSION=v0.30.18 by @zyyw in #19500
- Skip to validate username when update user profile by @stonezdj in #19552
- Update UI package to clear security alerts by @AllForNothing in #19553
- Delete project member when delete project by @stonezdj in #19523
- add permission api by @wy65701436 in #19543
- Allow POST method to request service/token in readonly mode by @stonezdj in #19556
- 19559 cannot see full label easily by @jmichot-exotec in #19564
- fix: sorting quota by @zyyw in #19538
- Avoid menu closure when filtering labels by @AllForNothing in #19561
- Correct loop condition for replication tasks by @AllForNothing in #19570
- Return empty result when no scanner configured by @stonezdj in #19577
- bump golang to 1.21.4 by @MinerYang in #19601
- add permission validation for robot creating and updating. by @wy65701436 in #19598
- add prepare migration script for 2.10 by @MinerYang in #19600
- Update the permission scope by @AllForNothing in #19603
- fix system label resource by @wy65701436 in #19621
- Bump golang.org/x/time from 0.0.0-20220210224613-90d013bbcef8 to 0.4.0 in /src by @dependabot in #19541
- fix robot account access issue by @wy65701436 in #19627
- fix: update TRIVYVERSION=v0.47.0 && TRIVYADAPTERVERSION=v0.30.19 by @zyyw in #19624
- Bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.7.0 in /src by @dependabot in #19542
- Update the name checking for the robot account by @AllForNothing in #19645
- fix 2.10 prepare migration version by @MinerYang in #19665
- fix: upgrade google.golang.org/grpc by @zyyw in #19648
- Update the style for the robot acccount ui by @AllForNothing in #19663
- Update the wording text for the system robot account by @AllForNothing in #19666
- Add min-width to the permission column by @AllForNothing in #19675
- Bump github.com/robfig/cron/v3 from 3.0.0 to 3.0.1 in /src by @dependabot in #19633
- Bump github.com/gorilla/handlers from 1.5.1 to 1.5.2 in /src by @dependabot in #19632
- Bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 in /src by @dependabot in #19636
- Bump sigs.k8s.io/yaml from 1.3.0 to 1.4.0 in /src by @dependabot in #19631
- bump distribution by @wy65701436 in #19669
Docs update 🗄️
- Add heading to contributing docs by @mterwill in #19412
- [release-note/docs] swagger.yaml
epositoryName\ parameter description update by @azsteinb in #19651
Community update 🧑🏻🤝🧑🏾
- Add NS as Harbor adopter by @slushysnowman in #18878
- Add PITS Globale Datenrettungsdienste as an adopter by @arnoldberlin in #18884
- Add CERN as adopter by @OrlinVasilev in #19097
Deprecations ❌
- deprecate resource label by @wy65701436 in #19349
Other Changes
- Bump up setup-gcloud to 430.0.0 by @YangJiao0817 in #19116
- bump up base version by @wy65701436 in #19124
- Update the image version for trivy scan by @AllForNothing in #19264
- Refactor unstable test cases by @YangJiao0817 in #19350
- Add security hub API test case by @YangJiao0817 in #19376
- Add security hub UI test case by @YangJiao0817 in #19448
- Add GC accessory API test case by @YangJiao0817 in #19462
- Add GC accessory UI test case by @YangJiao0817 in #19470
- Add GC details and GC workers API test case by @YangJiao0817 in #19482
- Add GC details and GC workers UI test case by @YangJiao0817 in #19487
- Add banner message API test case by @YangJiao0817 in #19510
- Add banner message UI test case by @YangJiao0817 in #19529
- Update E2E test engine images by @YangJiao0817 in #19544
- Add notation sign artifact API test case by @YangJiao0817 in #19549
- Add API permission testcase by @YangJiao0817 in #19571
- Add API(audit-log,project,registry,replication) permission testcase by @YangJiao0817 in #19584
- Add test cases for the project level permissions by @AllForNothing in #19593
- Add API(scan,volumes,jobservice,scanner,label,securityhub,catalog) permission testcases by @YangJiao0817 in #19595
- Add notation accessory copy test case by @YangJiao0817 in #19605
- Bump actions/setup-node from 3 to 4 by @dependabot in #19478
- Add notation pull policy test case by @YangJiao0817 in #19625
- Add jump to CNAB Bundle index artifact list test case by @YangJiao0817 in #19629
- Update the test script for the project permissions by @AllForNothing in #19623
- Add user API test case by @YangJiao0817 in #19638
- Add external scanner test case by @YangJiao0817 in #19682
- Updating Permission Test Scripts by @YangJiao0817 in #19687
- Bump google-github-actions/auth from 1 to 2 by @dependabot in #19649
- Bump actions/setup-go from 1 to 5 by @dependabot in #19684
New Contributors
- @slushysnowman made their first contribution in #18878
- @arnoldberlin made their first contribution in #18884
- @mterwill made their first contribution in #19412
- @Nhqml made their first contribution in #19418
- @imeoer made their first contribution in #19453
- @SphinxKnight made their first contribution in #19472
- @jmichot-exotec made their first contribution in #19564
- @azsteinb made their first contribution in #19651
Full Changelog: v2.9.0...v2.10.0