LoginSign Up
← Back to all sparks
H

Harbor

INFRA · APIS
Velocity5.0

Open source container image registry with security scanning and RBAC

goharbor.io ↗

Harbor backports security hardening to 2.15 while 2.16 nears GA.

container-registryrbacproxy-cachemulti-archvalkey
◆Current state
Harbor spent September and October on security patch candidates and rolling back defaults that broke webhooks and legacy signer pulls. The 2.16.0 candidates are its first feature release in that window, with arm64 builds, custom project roles, proxy-cache filters, referrer API proxying and Valkey caching. 2.15.5-rc1 brings the same period's hardening to the older line: size limits on audited and manifest request bodies, redacted URLs in error messages, a fix for replication filters and updated Trivy and Go versions.
◆Where it's heading
Three candidates in two weeks suggest 2.16.0 is close to final. The release moves Harbor toward multi-arch and finer access control after a quarter of security-only work.
◆Prediction
Expect 2.16.0 GA within one to two weeks, followed by matching 2.15.x and 2.14.x patch releases.

◆Recent moves

  1. 2d ago

    2.15.5 RC1: request size limits, redacted errors, replication fix

    The 2.15 line gets the hardening work done for 2.16: bounded request bodies, redacted upload and pagination URLs in errors, a working image filter for replication and a newer Trivy. Harbor keeps two lines patched while 2.16 heads to GA.

    View source ↗
  2. 4d ago

    2.16.0 RC3: arm64, custom roles, referrer API proxying

    The third 2.16 candidate keeps the full feature list (arm64 builds, custom project roles, proxy-cache filters, referrer API proxying, Valkey cache) and adds fixes such as path-prefix preservation in registry auth. It signals the release is nearing GA.

    View source ↗
  3. 8d ago

    2.16.0 RC2: Valkey cache, task failure details, ACR chunked uploads

    The second 2.16 candidate brings the Valkey cache backend to the main line, surfaces aggregated task failure details and fixes Azure ACR replication uploads, on top of RC1's arm64 builds and custom roles. The feature release is still growing before GA.

    View source ↗
  4. 18d ago

    2.16.0 RC1: arm64 builds, custom project roles, proxy-cache filters

    The first 2.16 candidate ends months of patch-only releases with real features: official arm64 builds, custom project roles in the UI, proxy-cache repository filters, and referrer API proxying to upstream registries. Cache hit/miss metrics and member audit events round it out. It is a substantial minor, still at RC stage.

    View source ↗
  5. 23d ago

    2.14.6 RC2: Go CVE fixes and decompression limit

    The second 2.14.6 candidate adds Go CVE upgrades and a decompression byte limit on top of RC1's webhook and signer-pull rollbacks. It shows the 2.14 line still getting both security fixes and regression repairs.

    View source ↗
  6. 1mo ago

    2.14.6 RC1: private-network webhooks and legacy signer pulls restored

    This backports the 2.15.4 regression fixes to the 2.14 line: webhooks can reach private networks again, legacy signer pulls are allowed by default, and harbor.yml gets a switch for them. It also refreshes the bundled Trivy.

    View source ↗