github goharbor/harbor v2.16.0-rc1
on GitHub

pre-release3 hours ago

What's Changed

Exciting New Features 🎉

  • Update artifact_accessory to add source column to identify accessory by @stonezdj in #23144
  • feat: replace redis with valkey as cache backend by @chlins in #23157
  • Full Multi-Architecture Enablement for Harbor (amd64 + arm64) by @ranimandepudi in #22311
  • Add ListReferrers API to registry client and update parseScopes by @stonezdj in #23170
  • Proxy the referrer API to upstream registry with paging and local merge by @stonezdj in #23237
  • feat(ui): support advanced proxy cache configurations in UI by @stonezdj in #23536
  • feat(backend): implement proxy cache repository filter API by @stonezdj in #23527
  • test: add api and ui integration tests for proxy cache repository filter by @fiona-xie in #23744
  • Custom project roles — frontend UI by @maxgraustenzel-create in #23970
  • feat(task): aggregate execution error messages and surface task failure details by @stonezdj in #24028

Enhancement 🚀

  • Fix Last Pull time on parent/child artifacts and on creation by @BojanZelic in #22402
  • fix(proxy): preserve URL path prefix during registry auth discovery by @mco69 in #22989
  • Add UI option to enable proxy cache referrer API by @stonezdj in #23151
  • ci: add API schema drift check for v2.0 swagger spec by @infracore in #23089
  • refactor(task): use Redis SET with SPOP for outdate execution status … by @chlins in #23183
  • test(cosign): disable tlog for signing checks by @chlins in #23279
  • perf(replication): filter event policies in query by @chlins in #23283
  • fix: enable chunked blob upload for Azure ACR replication by @xrkolovos in #23016
  • feat(audit): add member create/update/delete audit events by @Mauraza in #23228
  • fix: add registry component to proxy configuration support by @Kibakus in #23437
  • fix: set MaxIdleConnsPerHost on internal HTTP transports by @chlins in #23591
  • Add proxy cache hit/miss metrics by @Jason-Lee3 in #23578
  • fix: implement signature inheritance for OCI index children by @Aloui-Ikram in #23540
  • fix(api): return 404 when listing artifacts of a non-existing repository by @tpoxa in #17618

Component updates ⬆️

  • fix the git action publish permission issue by @wy65701436 in #22840
  • fix: Update Verify Remote Cert tooltip for registry endpoints by @dee077 in #22812
  • fix: wrong operation response name for UpdateRepository by @liubin in #22851
  • fix(session): use correct maxlifetime in SessionRegenerate by @chlins in #22873
  • chore(go): ignore frontend portal directory using Go 1.25 by @Iam-Karan-Suresh in #22702
  • fix: check error first before other checks by @liubin in #22884
  • fix: bump Trivy to v0.69.2 following supply chain incident by @Aloui-Ikram in #22896
  • Remove payload from config audit log by @stonezdj in #22913
  • fix codecov issue by @wy65701436 in #22922
  • fix(portal): UI Statistics display are not aligned by @mmoreiradj in #22042
  • Bump trivy to 0.69.3 & adapter to v0.35.1-rc.1 on main by @MinerYang in #22932
  • fix(security): reject bearer tokens issued before project creation by @Vad1mo in #22900
  • add the 2.14.1 sql into main by @wy65701436 in #22947
  • Bump trivy-adapter v0.35.1 GA on main by @MinerYang in #22966
  • fix: proxy cache serve local on remote not found by @AYDEV-FR in #22153
  • fix(replication): add missing AWS regions to ECR adapter endpoint list by @nicknikolakakis in #22941
  • add docker check before running 'make gen_apis' by @yaten2302 in #22907
  • fix db scheme migration issue by @wy65701436 in #22998
  • fix(about-dialog): format version span indentation by @chlins in #23012
  • build(deps): migrate model-spec to modelpack org by @chlins in #23021
  • Add User-Agent to all request by @stonezdj in #23030
  • Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23088
  • fix(deps): Bump go-jose/go-jose/v4 to v4.1.4 to fix DoS vulnerability by @bupd in #23090
  • feat(session): prevent background polling from renewing session TTL by @chlins in #22980
  • Fix issue related to scanner API by @stonezdj in #23061
  • fix(dao): use context-aware methods for database operations in MetaDAO by @mxab in #23074
  • feat(gc): use human-readable sizes in GC log messages by @chlins in #23123
  • fix(gc): redact redis_url_reg from GC extra attrs by @chlins in #23134
  • fix(scan): use created time from annotations in accessory art by @chlins in #23113
  • fix: add nil guard in auditext manager Create function by @ipsitapp8 in #23107
  • perf(blob): fix full table scan in blob unassociation check during GC by @paragdudeja in #22994
  • fix(exporter): add Docker HEALTHCHECK by @intojhanurag in #22778
  • Fix the issue distribution instance edit without credential can not save by @stonezdj in #23165
  • ci: disable exporter cache in API tests by @chlins in #23177
  • refactor(config): centralize registry HTTP client timeout by @chlins in #23154
  • fix(i18n): localize max upstream connection placeholder by @bupd in #23197
  • 【fix issue 22865】TCR provider adaptor can't parse intertional secret ID by @pikehuang in #22869
  • FIX: Disallow Empty robot_name_prefix to prevent OIDC CLI login from being blocked by @falconlee236 in #22556
  • Fix spelling error in comments by @rakshityadav1868 in #23217
  • fix(build): default PIP_INDEX_URL to https://pypi.org/simple by @Vad1mo in #23227
  • fix: correct max_upstream_conn validation and disabled bindings by @Tusharjamdade in #22681
  • feat: Add gosec linter by @bupd in #22668
  • bump Go version from 1.25.7 to 1.26.3 by @stonezdj in #23235
  • fix: lang file sync by @bupd in #23002
  • Rebuild goharbor/photon image before create new harbor base images by @jUDASmILE in #23248
  • fix(ui): use selected tag for pull command copy by @bupd in #23240
  • fix: duplicated �y\ in beego ORM TableName comments by @vip892766gma in #23234
  • bump pg to v18 by @wy65701436 in #23184
  • remove install net-tools from db dockerfile as photon removed it by @jUDASmILE in #23266
  • build(registry): bump source tag to rc.2 by @chlins in #23269
  • update ECR adapter to allow for ecr-public to be mirored by @goshlanguage in #22351
  • fix(cosign): ignore tlog during verification by @chlins in #23284
  • fix: Bump repository update_time on tag and artifact changes by @Aloui-Ikram in #23225
  • fix(security): validate blob-mount source project and reject tokens missing iat by @Vad1mo in #23270
  • build(registry): update source tag to rc.4 by @chlins in #23300
  • fix: build valkey from source to support arm64 by @ranimandepudi in #23282
  • Upgrade harbor go.mod OSS packages by @stonezdj in #23314
  • fix(ecr): use amazonaws.com.cn domain for AWS China region endpoints by @amaanx86 in #23326
  • fix: publish goharbor/photon:5.0 as a multi-arch manifest (#23324) by @Vad1mo in #23334
  • skip spectral image when creating multi-arch manifests by @wy65701436 in #23340
  • exclude helper images from manifest creation by @wy65701436 in #23343
  • test(UI): fix and upgrade UI robot test cases for Angular v21 / Clarity v18 by @fiona-xie in #23344
  • Harden crypto usage and drop unused SMTP package by @wy65701436 in #23307
  • fix: solve db build conflict and robustify workflow repo list saving by @wy65701436 in #23350
  • fix(build): pin Photon base to stable multi-arch digest by @wy65701436 in #23352
  • ci: use local base for component builds; fix flaky log rotation test by @wy65701436 in #23357
  • Migrate direct yaml.v2 imports to github.com/goccy/go-yaml by @stonezdj in #23349
  • Update and improve zh-TW Traditional Chinese locale by @PeterDaveHello in #23315
  • fix(ui): Update bindings in Project Policy Config by @vg006 in #22694
  • fix: skip corrupted encrypted config values on decryption failure by @rossigee in #23376
  • fix(ui): fix UI issues across portal components by @zoom2ashish in #23393
  • test(ui): add retry for Get Harbor CA to improve stability by @fiona-xie in #23396
  • fix(portal): Project Tab Access Permissions Match the User Permissions by @vg006 in #22708
  • feat(acr): add artifact to supported resource types by @SurbhiAgarwal1 in #23392
  • fix: increase access_key column length to 4096 by @Yanni8 in #23414
  • fix: propagate CSV marshal errors in scan data export by @ashnaaseth2325-oss in #23369
  • fix(portal): remove temporary SBOM permission override by @kimjune01 in #23223
  • fix(ui): fix UI issues #48–#54 across portal components by @zoom2ashish in #23427
  • fix: use validated scan type in StopScanArtifact by @ashnaaseth2325-oss in #23412
  • fix: Fix potentional SQLi by @Yanni8 in #23418
  • fix(cache): replace keyMutex with singleflight and avoid canceling cache by @air1bzz in #23336
  • fix: Fix theoretical timing vulnerability by @Yanni8 in #23433
  • fix: multiple UI/UX fixes for checkboxes, alignment, dark theme, and i18n by @stonezdj in #23439
  • fix(portal): align pending job queue counts and improve form styling by @wy65701436 in #23457
  • build(registry): update distribution source tag to rc.5 by @chlins in #23464
  • Fix job service dashboard testcase failed issue by @stonezdj in #23488
  • Fix/api completeness by @qcserestipy in #23476
  • fix: avoid panic in user audit event resolver on nil event data by @Aloui-Ikram in #23461
  • Constrain /registries/ping to the saved URL for existing registries by @Aloui-Ikram in #23463
  • Add a size limit for manifest uploads by @Aloui-Ikram in #23500
  • test(apitests): fix race condition in log rotation test by polling job status by @stonezdj in #23516
  • fix(ui): use dark login background in dark mode by @bupd in #23535
  • Fix typo: 'commitedKey' -> 'committedKey' in comments by @magic-peach in #23541
  • fix(retention): avoid stripping repository path twice by @esadakcam in #23546
  • fix(replication): fix incorrect error propagation in getAccessoryArts by @jUDASmILE in #23569
  • test: add UI e2e test for per-endpoint CA certificate setting by @Adityakumar37 in #23556
  • fix: address unsafe type assertions causing potential panics across packages by @Norway-02 in #23571
  • fix: guard against division by zero when merging scan report summaries by @Norway-02 in #23572
  • Set blob response headers before streaming the body by @shrenikgala in #23374
  • fix(cnai-parser): enforce actual byte limit to prevent decompression by @chlins in #23497
  • bugfix/max-upstream-comm by @intojhanurag in #22678
  • refactor: remove deprecated io/ioutil usage by @Norway-02 in #23611
  • refactor: replace deprecated golang.org/x/net/context by @Norway-02 in #23630
  • fix: use LEFT JOIN in projectBasicSQL to include projects without quota records by @cdarninsuang-bamfunds in #23520
  • Fix: member audit log resolution after transaction commit by @Mauraza in #23586
  • fix: use errors.Is for sentinel error checks in usergroup controller by @Norway-02 in #23636
  • fix: allow resizing of the SBOM column in artifact table by @La1itchauhan in #23646
  • fix: fix tags column text truncation and count badge overlap by @AllForNothing in #23607
  • fix: Prevent redis pw exposure in error logs by @Yanni8 in #23657
  • Refactor manifest abstraction into a registry by @Vad1mo in #23647
  • Prevent 500 if no project members have been provided by @Yanni8 in #23642
  • fix: convert robot account ID columns and sequence to bigint by @wy65701436 in #23633
  • fix: Prevent 500 on invalid query input for robot accounts by @Yanni8 in #23670
  • fix(repoproxy): prevent proxy-cache poisoning via robot-name prefix by @jUDASmILE in #23675
  • fix: neutralize CSV formula in scan export by @stonezdj in #23677
  • fix(ci): add explicit permissions block to workflows by @jUDASmILE in #23676
  • fix: Add missing validation when creating a rb account by @Yanni8 in #23691
  • test: accelerate flaky tests by removing time.Sleep by @Norway-02 in #23692
  • fix: Add \n to the escape pattern by @stonezdj in #23697
  • fix(ci): remove contents read permission from label check workflow by @stonezdj in #23702
  • fix(registry): Refactor registry update handling to improve URL validation by @jUDASmILE in #23671
  • fix: convert setup_timestamp, status_revision, and revision columns to bigint to avoid Y2K38 overflow (#23711) by @stonezdj in #23718
  • chore(deps): bump Go modules to fix known vulnerabilities by @bupd in #23720
  • chore(deps): bump remaining vulnerable npm dependencies by @bupd in #23725
  • chore(deps): bump Angular packages to fix known vulnerabilities by @bupd in #23724
  • test: add API test for signature inheritance on OCI index children by @Aloui-Ikram in #23707
  • add size limit for audit log payload by @stonezdj in #23755
  • Refine utils function IsLocalPath by @stonezdj in #23756
  • chore(deps): revert github.com/gorilla/csrf to v1.7.2 by @stonezdj in #23759
  • test: reduce arbitrary sleep delays in core auth and awsecr tests by @Norway-02 in #23722
  • test(api): enhance stability of test_copy_disability in tag immutability by @fiona-xie in #23774
  • fix(repoproxy): query robot account to validate proxy session and fix ut by @stonezdj in #23776
  • fix: Harden proxy cache repository filter validation by @bupd in #23762
  • Fix CPU saturation from full table scans during artifact deletion by indexing sbom_digest by @raudhra in #23773
  • fix(quota): enable retry backoff on quota usage updates by @Vad1mo in #23789
  • fix: system_cve testcase failing at end of month by @Yanni8 in #23661
  • fix: correct grammar and typos in user-facing error messages by @wy65701436 in #23818
  • fix: correct typos in comments and two log/error messages by @MsfPablo in #23829
  • fix: make hostname comparisons case-insensitive by @stonezdj in #23827
  • Remove hardcoded credentials placeholders and prevent log credential/secret in debug log by @jUDASmILE in #23835
  • fix: Invalid UTF-8 Input Should not Cause HTTP 500 Errors by @Vad1mo in #22612
  • fix(i18n): improve Korean translation of FULL_NAME by @InGyu-Moon in #22701
  • fix: make hostname and endpoint comparisons case-insensitive(2) by @stonezdj in #23842
  • refactor(p2p): improve HTTP client request logging and credential string formatting by @jUDASmILE in #23873
  • refactor: sanitize connection details in logs and enhance error message formatting by @jUDASmILE in #23878
  • fix(portal): Keep the swagger-ui loading page intact when webpack minifies HTML by @Vad1mo in #23859
  • fix: make endpoint handling and validation case-insensitive by @stonezdj in #23889
  • fix(migration): make sbom_report index creation idempotent by @stonezdj in #23895
  • docs: fix typo wating -> waiting by @vaibhav8a in #23807
  • fix(cache): avoid double prefix when removing expired entries by @Hanabi9248 in #23913
  • fix: ignore http.ErrServerClosed on graceful shutdown by @Vad1mo in #23296
  • fix(systeminfo): make HTTPS URL scheme check case-insensitive for CA download by @Norway-02 in #23888
  • feat: Expose retention setting during proxy-cache project creation by @Yanni8 in #23863
  • fix(gc): do not count blobs missing from storage as freed space by @velmoga in #23972
  • fix: correct grammar, formatting, and non-actionable error messages by @jUDASmILE in #23974
  • fix(retention): drop retention_id metadata on project delete by @warisshaikh1 in #23942
  • fix(portal): update label and tooltip of serve stale content option by @stonezdj in #23978
  • ci: retry the spectral binary download by @velmoga in #23984
  • feat: custom project roles (hybrid — built-ins in code, custom in DB) by @maxgraustenzel-create in #23804
  • fix(gc): Use the current registry Redis URL for scheduled runs by @Vad1mo in #24037
  • fix(webhook): allow private network access by default to avoid regres… by @wy65701436 in #24078
  • feat(webhook): add webhook egress policy levels and allowlist by @Vad1mo in #24079
  • fix(contenttrust): allow legacy signer pull by default to avoid regre… by @wy65701436 in #24085
  • chore(deps): forward-port the release-2.15.0 go module bumps to main by @bupd in #24093
  • fix(registry): validate upload Location against the request origin, n… by @wy65701436 in #24113
  • fix(i18n): translate remaining French UI strings by @berlewis in #24088
  • fix(ui): keep multi-value filters when editing a P2P preheat policy by @velmoga in #24056
  • fix(scan): scope scan stop lookup to caller artifact by @stonezdj in #23948
  • fix(scanner): redact scanner URL in candidate list for non-admin users by @stonezdj in #23947
  • fix(registryctl): reject empty secrets to prevent authentication bypass by @stonezdj in #23946
  • Improve global label listing behavior by @jUDASmILE in #24140
  • Improve job status hook handling by @jUDASmILE in #24137
  • fix(jobservice): prevent CPU spin from unreachable cron expressions by @nikitakodkany in #23925
  • Align manual preheat execution with update permissions by @jUDASmILE in #24141
  • feat(replication): separate event-triggered replication into dedicate… by @stonezdj in #24138
  • Fix webhook egress allow all by @stonezdj in #24126
  • portal: align robot account immutability label by @NUAAwqy in #24171
  • Stamp version info into the bundled Trivy adapter binary by @fjvbn2003 in #24164
  • fix(replication): make the image resource filter take effect again by @chlins in #24176
  • Improve project metadata cache consistency by @jUDASmILE in #24139
  • chore: bump Trivy, Trivy adapter, and Distribution versions by @stonezdj in #24179
  • [release-2.16] chore(deps): bump up Go version to v1.27.3 (#24188) by @bupd in #24192
  • (cherry-pick): preserve artifact type for multi-tier accessories in replication by @stonezdj in #24203

Docs update 🗄️

  • docs: fix contributing fork setup instructions to cd before git clone by @mlhv in #23367
  • docs: fix broken installation guide link in contrib doc by @s3onghyun in #23406
  • docs: fix markdown formatting issues in CONTRIBUTING.md and README.md by @magic-peach in #23537
  • docs: switch security reporting to GitHub private vulnerability reporting by @Vad1mo in #23559
  • docs: update the minor release support matrix by @bupd in #24060

Bump Component Version 🤖

  • bump base vserion for v2.16.0 by @wy65701436 in #22837
  • chore(deps): bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /src by @dependabot[bot] in #23009
  • feat(portal): upgrade Angular to v21, Clarity to v18, Node.js to v22 (#22937 by @zoom2ashish in #23078
  • Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1 by @stonezdj in #23388
  • chore(deps-dev): bump form-data from 4.0.5 to 4.0.6 in /src/portal by @dependabot[bot] in #23403
  • chore: update Trivy adapter version to v0.37.1 by @stonezdj in #23423
  • chore: update Trivy adapter version to v0.37.2-rc1 by @stonezdj in #23456
  • bump: bump up golang to 1.26.4 and trivy adapter version to v0.37.2-rc2 by @stonezdj in #23460
  • chore: update Trivy adapter version to v0.38.0-rc1 by @stonezdj in #23469
  • Bump up trivy to 0.72.0 by @stonezdj in #23478
  • build(registry): use stable registry source release v2.8.3-harbor.1 by @chlins in #23481
  • chore(deps-dev): bump pygments from 2.19.2 to 2.20.0 in /make/photon/prepare by @dependabot[bot] in #23053
  • chore(deps): bump uuid and webpack-dev-server in /src/portal/app-swagger-ui by @dependabot[bot] in #23631
  • chore(deps): update go.mod dependencies to patch versions by @stonezdj in #23751
  • chore(deps): upgrade Go dependencies to fix CVEs by @stonezdj in #23801
  • chore(deps): bump golang.org/x/crypto to v0.55.0 by @stonezdj in #23826
  • chore(deps): bump hono from 4.13.2 to 4.13.8 in /src/portal by @dependabot[bot] in #23884
  • chore(deps): bump the patch-updates group across 1 directory with 2 updates by @dependabot[bot] in #23766
  • chore(deps-dev): bump fast-uri from 3.1.5 to 3.1.8 in /src/portal by @dependabot[bot] in #23831
  • chore(deps): bump css-loader from 6.11.0 to 7.1.5 in /src/portal/app-swagger-ui by @dependabot[bot] in #23848
  • chore(deps): bump baseline-browser-mapping from 2.10.33 to 2.11.24 in /src/portal/app-swagger-ui by @dependabot[bot] in #23883
  • chore(deps): bump the patch-updates group across 1 directory with 2 updates by @dependabot[bot] in #23843
  • chore(deps-dev): bump webpack-cli from 4.10.0 to 7.2.3 in /src/portal/app-swagger-ui by @dependabot[bot] in #23850
  • chore(deps-dev): bump webpack from 5.107.2 to 5.111.0 in /src/portal/app-swagger-ui by @dependabot[bot] in #23951
  • chore(deps-dev): bump cypress from 15.20.1 to 16.0.0 in /src/portal by @dependabot[bot] in #23953
  • chore(deps-dev): bump eslint-config-prettier from 9.1.2 to 10.1.8 in /src/portal by @dependabot[bot] in #23956
  • chore(deps-dev): bump https-proxy-agent from 5.0.1 to 9.1.0 in /src/portal by @dependabot[bot] in #23954
  • chore(deps): bump marked from 18.0.12 to 18.0.13 in /src/portal in the patch-updates group across 1 directory by @dependabot[bot] in #23952
  • chore(deps-dev): bump stylelint from 14.16.1 to 17.15.0 in /src/portal by @dependabot[bot] in #23957
  • bump: bump up Go version to v1.26.9 by @stonezdj in #24120
  • Bump trivy adapter to v0.39.1 and distribution to v2.8.3-harbor.2 by @stonezdj in #24118
  • bump: bump up Go version to v1.27.2 by @stonezdj in #24119
  • chore(deps): bump google.golang.org/grpc to v1.82.2 and golang/x/net to v0.60.0 by @stonezdj in #24167

Other Changes

  • chore(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in #22461
  • docs: fix minor typos and grammar improvements in README by @Starksid007 in #22934
  • Add proxy cache from dockerhub, harbor, jfrog by @stonezdj in #23121
  • Support custom PyPI index URL for prepare image builds by @stonezdj in #23205
  • Fix the GC robot testcase fail issue by @stonezdj in #23214
  • test: use harbor-redis-base instead of harbor-valkey-base in SecurityHub CI by @stonezdj in #23213
  • support configurable PIP_INDEX_URL for swagger client build by @stonezdj in #23241
  • Update Makefile PIP_INDEX_URL to use default value if not defined by @stonezdj in #23273
  • fix: publish harbor-*-base images as multi-arch manifests by @Vad1mo in #23348
  • test(api_db): support dynamic OpenAPI generator and PyPI URLs via env vars by @fiona-xie in #23361
  • test(ui): Fix db_schedule and replication failed cases after Angular&Clarity upgrade by @fiona-xie in #23394
  • chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #23191
  • chore(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.2.1 by @dependabot[bot] in #23192
  • chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.2 by @dependabot[bot] in #23193
  • chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #23495
  • chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #23494
  • chore(deps): bump codecov/codecov-action from 5 to 7 by @dependabot[bot] in #23499
  • chore(deps): bump kentaro-m/auto-assign-action from 2.0.1 to 2.0.2 by @dependabot[bot] in #23498
  • Fix grammar: 'can not be override' -> 'cannot be overridden' in comment by @magic-peach in #23542
  • ci: migrate all GitHub workflows to CNCF-hosted runners by @Vad1mo in #23545
  • chore(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #23493
  • ci: pin docker-practice/actions-setup-docker to a full commit SHA by @kobihikri in #23554
  • chore(deps): bump aws-actions/configure-aws-credentials from 6.2.1 to 6.2.3 by @dependabot[bot] in #23563
  • ci: remove third-party docker action by @stonezdj in #23683
  • chore(deps): bump actions/setup-go from 5 to 7 by @dependabot[bot] in #23698
  • Exclude replication from dockerhub in github action by @stonezdj in #23713
  • chore(deps): bump actions/cache from 4 to 6 by @dependabot[bot] in #23705
  • ci: pin GitHub Actions to full commit SHAs by @bupd in #23712
  • chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #23727
  • chore(deps): bump actions/setup-node from 6.5.0 to 7.0.0 by @dependabot[bot] in #23726
  • chore(ci): update dependabot configuration for release 2.15 by @stonezdj in #23723
  • chore(deps): bump actions/stale from 10.0.0 to 11.0.0 by @dependabot[bot] in #22852
  • chore(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.2 by @dependabot[bot] in #23509
  • chore(deps): bump the patch-updates group with 3 updates by @dependabot[bot] in #23745
  • chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.2.0 by @dependabot[bot] in #23746
  • chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #23760
  • test: optimize proxy cache filter UI test with dynamic polling mechansim and cleanup local images before pulling by @fiona-xie in #23754
  • chore(deps): bump the patch-updates group across 1 directory with 3 updates by @dependabot[bot] in #23781
  • chore(deps): bump the patch-updates group across 1 directory with 4 updates by @dependabot[bot] in #23820
  • chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 in the patch-updates group by @dependabot[bot] in #23836
  • ci: Group Angular, Kubernetes and OpenTelemetry updates in dependabot.yml by @Vad1mo in #23839
  • ci: Ignore Angular and TypeScript major updates in the portal Dependabot groups by @Vad1mo in #23858
  • ci: bump all github/codeql-action steps in one dependabot PR by @Vad1mo in #23929
  • chore(deps): bump the codeql-action group with 3 updates by @dependabot[bot] in #23934
  • chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #23855
  • ci: Add merge_group trigger to CI and CodeQL workflows by @bupd in #23986
  • test(apitests): add missing get_member_role_id to project helper by @stonezdj in #23997
  • fix(test): update expected CVE export toast message in Robot test by @stonezdj in #24010
  • chore(deps): bump trivy to 0.75.0 and the trivy adapter to 0.39.1-rc2 by @bupd in #24092
  • test(robot): update guest member radio button locator by @stonezdj in #24154
  • test(robot): expect inherited signature for unsigned index child in r… by @stonezdj in #24026
  • (cherry-pick): handle empty parameter introduced by #22311 by @stonezdj in #24242
  • (cherry-pick): use runner Docker to avoid Buildx permission failure by @stonezdj in #24243

New Contributors

Full Changelog: v2.15.0...v2.16.0-rc1

Check out latest releases or
releases around goharbor/harbor v2.16.0-rc1

Don't miss a new harbor release

NewReleases is sending notifications on new releases.

Get notifications