Shipped · DevOps and infrastructure

What goharbor/harbor shipped

The public repository of Goharbor · github.com/goharbor/harbor

Written by FoxPlug from the repository's own releases; not affiliated with Goharbor. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/goharbor/harbor; Goharbor did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

Follow harbor's weekly shipped digest

Week of October 5, 2026

What shipped

Why it matters

This week was mostly about releases and about undoing a breaking default. Operators upgrading to the 2.13, 2.14 or 2.15 patch releases had webhooks and Slack delivery to internal addresses blocked, including hostnames that resolve to cluster-local names, so many on-premise and Kubernetes receivers stopped working. The follow-up releases make private network access the default again and add policy levels and an allowlist, while content trust keeps legacy signer pull on by default so existing cosign and notation workflows are not broken.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Several patch releases shipped this week. Webhooks to internal addresses are blocked by default in the 2.13, 2.14 and 2.15 releases, then allowed by default again in the follow-ups, which add egress policy levels and an allowlist. Legacy signer pull is on by default.

Post for LinkedIn

This week Harbor published patch releases on several branches, and the headline change for operators is the webhook egress default. The fix for GHSA-2phj-cp9f-qq6w blocks webhook and Slack delivery to private, loopback, link-local and other non-public addresses, including hostnames that resolve to them such as *.svc.cluster.local, so webhooks to internal receivers stopped working after upgrade. The follow-up releases make private network access the default again, keep the setting configurable, and add three egress policy levels plus an allowlist instead of a single boolean. Content trust also defaults to allowing legacy signer pull so existing cosign and notation signing workflows keep working. Other fixes cover redaction of pagination links in rejection errors, the redis base image on the

Week of September 28, 2026

What shipped

Why it matters

This week's changes improve garbage collection reliability after Redis configuration changes, add support for custom project roles alongside built-ins, and clarify proxy cache behavior. Bug fixes and test updates ensure the export and audit features work correctly.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Harbor updates: GC now uses current Redis config at runtime, custom project roles are available, and proxy cache stale content labeling is clearer. CI improvements prevent transient failures.

Post for LinkedIn

This week's Harbor updates focus on reliability and flexibility. Scheduled garbage collection now reads Redis configuration from the environment at runtime, so moves or password changes no longer break GC. Custom project roles join built-in roles for more granular access control. Proxy cache behavior is now more clearly documented. CI improvements make builds more resilient to transient network issues.

Week of September 21, 2026

What shipped

Why it matters

This week addresses data consistency issues in retention policies and garbage collection reporting, while improving the clarity of user-facing messages. These fixes reduce database leaks and ensure GC operations report accurate freed space metrics.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Harbor v2.15.3-rc2 is out. This release fixes retention policy metadata leaks, corrects GC freed space reporting, and improves error messages across the platform.

Post for LinkedIn

Harbor v2.15.3-rc2 is available. Key improvements include fixing retention policy metadata that leaked after project deletion, correcting garbage collection to accurately report freed space without counting missing blobs, and refining error messages for better clarity. These fixes improve data consistency and operational reliability.

Week of September 14, 2026

What shipped

Why it matters

This week's changes improve proxy-cache configuration options, fix protocol handling edge cases, and address cache consistency issues. The fixes ensure cleaner shutdown behavior and more reliable dependency management for the project.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Harbor's latest updates include retention settings for proxy-cache projects, RFC-compliant URL scheme checking, and fixes for cache handling and graceful shutdown behavior.

Post for LinkedIn

Harbor continues improving with this week's releases: retention settings are now configurable during proxy-cache project creation, URL scheme checking for CA downloads is now RFC 3986 compliant, cache prefix handling is fixed to prevent entry duplication, and graceful shutdown produces cleaner logs. Plus updated dependency management strategies for better CI stability.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-12.

Is this your repo? Ask us to remove this page.