v2.9.0

Known issue

• There's a known issue #19320 that occurs when running harbor.yml migrate script with the specific storage_service.redirect.disable configuration. Impact version would be Harbor v2.8 and v2.9, for example migrate from v2.7.X to v2.8.Y or v2.7.X to v2.9.Z. Please refer to this comment as a workaround.

What's Changed

Exciting New Features 🎉

Security Hub

Admin users can now access valuable security insights, which include the number of scanned and unscanned artifacts, identification of dangerous artifacts and CVEs, and advanced search capabilities for vulnerabilities using multiple combined conditions.

• Add Security Hub UI by @AllForNothing in #18942
• Update table scan_report and extract cvss_v3_score from vendor attribute by @stonezdj in #18854
• Add vulnerability search API by @stonezdj in #18924
• Add security hub summary API by @stonezdj in #18872
• Create index in vulnerability_record table by @stonezdj in #18949

GC Enhancements

Improved visibility with detailed GC execution history and enable parallel deletion for faster GC triggers.

• Add worker parameter for GC by @AllForNothing in #18882
• Add more details in gc history by @wy65701436 in #18779
• Add multiple deletions of GC by @wy65701436 in #18855

Supporting OCI Distribution Spec v1.1.0-rc2

Harbor now supports OCI Distribution Spec v1.1.0-rc2 and added support for Notation signature and Nydus conversion as referrers.

• Support OCI-Subject header by @wy65701436 in #18885
• Add notation support by @wy65701436 in #18909
• Enable notary v2 policy checker by @wy65701436 in #18927
• Add Notation UI for deployment security by @AllForNothing in #18952
• Support nydus as an accessory by @wy65701436 in #18953

Additional Features

Customized banner message

Admins can now set a customized banner message displayed on top of Harbor web pages.

• Add customized banner message UI by @AllForNothing in #18827

Quota Update Provider

Introduced a new mechanism utilizing Redis for optimistic locking during quota updates when pushing images. Refer to the documentation at https://github.com/goharbor/perf/wiki/Quota-Update for instructions on enabling and utilizing this feature.

• feat: Optimize quota checking when pushing images by @lengrongfu in #17392
• perf: introduce update quota by redis by @chlins in #18871
• feat: add the configuration for quota update provider by @chlins in #18928

Deprecations ❌

Removal of Notary

Starting with version v2.9.0, Harbor no longer includes Notary in either the user interface or the backend. Please navigate to this page for details.

• Remove notary test cases by @YangJiao0817 in #18620
• Remove notary UI by @AllForNothing in #18666
• Remove the notary from the backend by @wy65701436 in #18668

Known issue

• Harbor v2.9.0 Online/Offline Installer and Docker Version Compatibility
  If you install Harbor v2.9.0 using an online/offline installer with Docker version lower than 20.10.10, you may encounter an issue where the Harbor database container fails to start. This issue is being tracked at (#19141). For more detailed information about this specific problem, you can visit this page (timescale/timescaledb-docker-ha#260). To avoid this issue, we recommend ensuring that your Docker version is equal to or greater than 20.10.10 when using Harbor v2.9.0 with the online/offline installer.

Breaking Changes

• As of Harbor v2.9.0, only PostgreSQL >= 12 is supported for external databases. Before upgrading, you should make sure that your external databases are using a supported version of PostgreSQL.
• Different API behavior in Harbor version 2.9 vs. prior versions: Users with limited_guest role are not able to query the repository endpoint by id #19709

Enhancement 🚀

• Fix message prompt under the header by @AllForNothing in #18613
• fix: improve the performance of list artifacts by @chlins in #18610
• Improve repo_read_only header on the UI by @AllForNothing in #18729
• Add a text to explain the time window for GC by @AllForNothing in #18735
• Add a tooltip for slack notification by @AllForNothing in #18787
• 【UT】add unit test for collector system info by @lengrongfu in #18717
• Add Details column for gc history by @AllForNothing in #18797
• Add Podman push command to the UI by @AllForNothing in #18810
• Add new client Podman to the pull command by @AllForNothing in #18857

Component updates ⬆️

• fix: fix error bitsize of jobservice reaper scan locks by @chlins in #18487
• bump golang 1.20.3 on main by @MinerYang in #18492
• feat: update TRIVYVERSION=v0.39.0 & TRIVYADAPTERVERSION=v0.30.10 by @zyyw in #18501
• Rewords quota definitions based on user input by @OrlinVasilev in #18512
• Synchronize text modification of quota tooltip to all the i18n files by @AllForNothing in #18518
• GC: correctly handle manifest unknown (404) condition in v2DeleteManifest retry loop by @dkulchinsky in #18386
• Change the permissions of the *.go file from 0755 to 0644 by @Iceber in #17919
• feat: log with trace ID by @pgillich in #18181
• Fix typos in common.sh by @Maxi-Mega in #18151
• bump golang.org/x/net && helm.sh/helm/v3 on main by @MinerYang in #18545
• Update position to vertical-align for copy button by @AllForNothing in #18563
• Add missing i18n key-value for helm chart by @AllForNothing in #18578
• Allow redis password using safe special characters by @MinerYang in #18566
• add goheader linter settings by @MinerYang in #18503
• fix: link to Github's rate limiting documentation. by @perjahn in #18588
• fix: error log use wrong variable err by @dyf991645 in #18602
• Upgrade the internal PostgreSQL to 14 in 2.9.0 by @YangJiao0817 in #18612
• Improve zh-tw (Traditional Chinese) locale by @PeterDaveHello in #18608
• bump golang 1.20.4 on main by @MinerYang in #18647
• fix: sweep executions of image scan job by @chlins in #18649
• fix: cherry pick the migration sql by @chlins in #18644
• chore: replace github.com/ghodss/yaml with sigs.k8s.io/yaml by @Juneezee in #18606
• Bump kentaro-m/auto-assign-action from 1.2.4 to 1.2.5 by @dependabot in #18263
• Changed logic search projects in gitlab adapter by @lxShaDoWxl in #18529
• bump up github.com/distribution/distribution v2.8.2 by @MinerYang in #18687
• fix: add retry on the caller of v2DeleteManifest instead within v2DeleteManifest by @zyyw in #18662
• Fix the channel that never receives a value by @iAklis in #18139
• Use subtle.ConstantTimeCompare instead of compare directly by @stonezdj in #18697
• Upgrade Angular and Clarity to the latest version by @AllForNothing in #18709
• chore: bump registry release to 2.8.2 by @davidspek in #18685
• Add support for TLSv1.3 in nginx configurations by @malmor in #18659
• set tag pull time for proxy cache by @wy65701436 in #18731
• http2 enabled and ciphers changed to get an A+ rating instead of B fr… by @mcsage in #16990
• Return error when proxy cache get too many request error(429) by @stonezdj in #18728
• 【optimization】Use URL.Redacted method repleace redacted by @lengrongfu in #18716
• Fix syntax errors in comments by @lishaokai1995 in #18746
• add strong_ssl_ciphers for nginx https jinja template by @MinerYang in #18748
• fix: import optimization by @testwill in #18727
• fix invalid access action by @orblazer in #18188
• Fix: fix function name in comments by @cuishuang in #18726
• fix: clean up scan executions and reports after deleting artifact by @chlins in #18693
• Remove wrong format for boolean value in api definition by @sll552 in #18783
• fix: add checkpoint when enqueue scan tasks for scan all by @chlins in #18680
• Update/improve grafana dashboard by @mac-chaffee in #16661
• fix: optimize the mechanism of quota refresh by @chlins in #18795
• Update the text for the oidc cli secret tooltip by @AllForNothing in #18814
• jobservice: add DB to job logger config by @liubin in #18821
• jobservice: update readme by @liubin in #18849
• refactor: migrate the redis command keys to scan by @chlins in #18825
• Add unit test for hidden columns by @AllForNothing in #18873
• Correct the hidden property for clrDgHideableColumn by @AllForNothing in #18890
• API: update ScannerRegistration.properties.url format by @liubin in #18799
• chore: upgrade golang-migrate to v4.16.2 by @chlins in #18879
• fix: add password/secret length check to be <= 128 by @zyyw in #18916
• update icons by @vndroid in #18767
• Log warning message when current user is freeze by @stonezdj in #18937
• fix: correct the operator in the webhook payload by @chlins in #18906
• Update the regex for policy name and the tooltip message by @AllForNothing in #18947
• fix: replication policy cron setting - the 1st field must be 0; the Minutes field cannot be ADOPTERS.md CHANGELOG.md CODEOWNERS CONTRIBUTING.md LICENSE Makefile OWNERS.md README.md RELEASES.md ROADMAP.md SECURITY.md VERSION api assets codecov.yml contrib docs gha-creds-0f3ff0103af6cfb3.json harbor icons make src tests tools by @zyyw in #18923
• Update the parameter to search cosign by @AllForNothing in #18963
• refactor: remove duplicated artifact deletion handler by @chlins in #18959
• refactor: replace the gc redigo client to the standard cache by @chlins in #18965
• feat: add config for job_loggers by @zyyw in #18970
• fix: bump-up TRIVYVERSION=v0.43.0 and TRIVYADAPTERVERSION=v0.30.14 by @zyyw in #18993
• Fix wrong scanned artifact count when there are multiple report for an artifact by @stonezdj in #18975
• add migration script for 2.9 by @MinerYang in #18997
• Skip to run migrate script when data available by @stonezdj in #18976
• update installation hint by @MinerYang in #19024
• Conserve sentinel_master_set value between upgraded versions by @sixeela in #18875
• fix accessory import issue by @wy65701436 in #19053
• fix dry run creation time by @wy65701436 in #19060
• Update security hub ui by @AllForNothing in #19062
• Remove cache for project policy updating by @AllForNothing in #19068
• Update style for banner message ui by @AllForNothing in #19069
• Add validator for duration of banner message by @AllForNothing in #19057
• bump golang 1.20.6 on main by @MinerYang in #19066
• fix: bump up TRIVYVERSION=v0.44.0 and TRIVYADAPTERVERSION=v0.30.15 by @zyyw in #19087
• Merge cosign check and notation check by @AllForNothing in #19079
• Update ui for gc history and banner message by @AllForNothing in #19094
• Show banner message on log in page by @AllForNothing in #19078
• Update cron ui for add replicatipn rule page by @AllForNothing in #19083
• Convert the string �\ to number 0 by @AllForNothing in #19080
• fix: fix replication list projects with pure numberic name by @chlins in #19090
• Update style for add-replication-rule page by @AllForNothing in #19100
• Fix incorrect artifact and scanned artifact count issue by @stonezdj in #19106
• Add artifact digest to query condition by @stonezdj in #19102
• Sort most dangerous vulnerabilities by score and severity level by @stonezdj in #19103
• fix ScheduleObj.type in swagger by @wy65701436 in #19109
• fix: skip to delete scan reports if the digest still referenced by @chlins in #19110
• Update ui to fix some issues by @AllForNothing in #19101
• bump golang 1.20.7 on main by @MinerYang in #19111

Docs update 🗄️

• Specify proper language in CONTRIBUTING.md code blocks by @PeterDaveHello in #18605
• fix: non-ASCII chars in swagger.yaml by @liubin in #18642

Community update 🧑🏻‍🤝‍🧑🏾

• Update proposal process with steps and board by @OrlinVasilev in #18379
• Add Dynatrace as adopter and fix master to main by @OrlinVasilev in #18823

Other Changes

• Bump mheap/github-action-required-labels from 3 to 4 by @dependabot in #18472
• Update UI testcases by @YangJiao0817 in #18491
• bump base version by @wy65701436 in #18485
• Update nightly-trivy-scan.yml for the workflows by @AllForNothing in #18510
• Upgrade harbor-portal to v2.9.0 by @AllForNothing in #18525
• Add Job Service Dashboard Schedules testcase by @YangJiao0817 in #18555
• Handling skipped but required checks by @YangJiao0817 in #18564
• Fix Handling skipped but required checks by @YangJiao0817 in #18570
• Update Support Matrix by @YangJiao0817 in #18540
• Fix setup docker error by @YangJiao0817 in #18583
• Add Job Service Dashboard Workers testcase by @YangJiao0817 in #18580
• Replace python script with node script for portal Dockerfile by @AllForNothing in #18635
• Copy swagger.json to the dist folder by @AllForNothing in #18646
• Refresh the base images when building on main by @YangJiao0817 in #18661
• Fix build db base image symlink error by @YangJiao0817 in #18673
• Bump google-github-actions/setup-gcloud from 0 to 1 by @dependabot in #17772
• Fix setup-gcloud fails when building package by @YangJiao0817 in #18682
• Add Retain image last pull time API test case by @YangJiao0817 in #18689
• Add Retain image last pull time UI test case by @YangJiao0817 in #18695
• Update e2e engine image by @YangJiao0817 in #18747
• Add Referrers API testcase by @YangJiao0817 in #18775
• Add podman pull & push testcase by @YangJiao0817 in #18790
• chore(deps): bump mheap/github-action-required-labels from 4 to 5 by @dependabot in #18805
• Refactor the keyword in the testcase by @YangJiao0817 in #18898
• Add replication by chunk testcase by @YangJiao0817 in #18904
• Add CloudEvents format webhook testcase by @YangJiao0817 in #18908
• Add OIDC filter group testcase by @YangJiao0817 in #18914
• Add CVE Allowlist expires Test Cases by @YangJiao0817 in #18921
• Fix APITEST_DB_PROXY_CACHE x509 by @YangJiao0817 in #18977
• Update webhook and replication testcase by @YangJiao0817 in #18998
• Fix build harbor-db-base error by @YangJiao0817 in #19003
• Bump up photon version from 4.0 to 5.0 by @YangJiao0817 in #19006
• [cherry-pick]Bump up setup-gcloud to 430.0.0 by @YangJiao0817 in #19118

New Contributors

• @pgillich made their first contribution in #18181
• @Maxi-Mega made their first contribution in #18151
• @yrs147 made their first contribution in #18282
• @perjahn made their first contribution in #18588
• @dyf991645 made their first contribution in #18602
• @PeterDaveHello made their first contribution in #18605
• @iAklis made their first contribution in #18139
• @davidspek made their first contribution in #18685
• @malmor made their first contribution in #18659
• @mcsage made their first contribution in #16990
• @lishaokai1995 made their first contribution in #18746
• @orblazer made their first contribution in #18188
• @cuishuang made their first contribution in #18726
• @sll552 made their first contribution in #18783
• @vndroid made their first contribution in #18767

Full Changelog: v2.8.0...v2.9.0