v2.10.0

Known issue

• known issue #19912 will affect nginx component of offline-installer when specify strong_cipher.enabled in harbor.yml but not been rendered in config file properly. Impact version are v2.9.0, v2.9.1, v2.9.2, v2.10.0. Will fixed in v2.10.1. if you do need set strong_cipher, please refer to manually-add-strong-cipher

What's Changed

Exciting New Features 🎉

Robot Account Full Access

Delivers a user-friendly tutorial that walks you through the creation of a new robot. With a simple click, you can seamlessly customize permission sets at both system and project levels.

• Add full permissions for the robot account by @AllForNothing in #19507
• subject: fix missing media type recognition for nydus by @imeoer in #19453

Supporting OCI Distribution Spec v1.1.0-rc3

Harbor now supports OCI Distribution Spec v1.1.0-rc3

• change Referrers Content-Type to application/vnd.oci.image.index.v1+json by @MinerYang in #19212
• support accessory in either order by @wy65701436 in #19375

Additional Features

Quota Sorting

Enable storage sorting in the quota management page

• Add quota sorting to the project quotas list by @AllForNothing in #19576

Allow customization of the OIDC provider name

• Add oidc provider name to systeminfo API by @stonezdj in #19575
• Show OIDC provider name on the OIDC login button by @AllForNothing in #19581

Enable support for large-size blobs

Harbor now facilitates uploads of layers up to 128GB by default, with configurable options if required.

• fix: increase beego max memory and upload size by @chlins in #19578

Ensure audit logs comply with GDPR regulations for data privacy.

• Feature: GDPR compliant audit logs by @tpoxa in #17396

Enhancement 🚀

• feat: enhance the replication webhook payload by @chlins in #19433
• fix: Accessibility - change color for WCAG AA by @SphinxKnight in #19472
• perf: optimize the trigger retention API by @chlins in #19533
• Add a placeholder to the cards for the security-hub by @AllForNothing in #19536
• perf: optimize the performance of accessory query by @chlins in #19557

Component updates ⬆️

• Add label's description as tooltip by @Nhqml in #19421
• fix: privileges member successfully typo by @testwill in #19091
• fix: add storage_limit check by @zyyw in #19095
• fix: cron string validation by @zyyw in #19071
• ignore spaces for vulnerability filters by @AllForNothing in #19180
• Update zh-tw (Traditional Chinese) locale by @PeterDaveHello in #19161
• chore: fix incorrect otel timeout in harbor yaml template by @chlins in #19120
• Update the max length for the filters by @AllForNothing in #19194
• Filter artifact without CVE from top 5 dangerous artifacts by @stonezdj in #19187
• log: change log level to reduce the noise logs by @chlins in #19146
• Wrong artifact scanned count by @stonezdj in #19198
• fix: support customize cache db for business by @chlins in #19182
• fix gc dry run issue by @wy65701436 in #19208
• Add new uri path to ShouldNotReuseRoute array by @AllForNothing in #19217
• Refine total artifact and scanned artifact by @stonezdj in #19228
• i18n: fix typo for CONFIRM_SECRET by @liubin in #19140
• Add a tooltip for the page title of security hub by @AllForNothing in #19231
• change JOB_ID to Task_ID by @lengrongfu in #19127
• fix typo in ROADMAP.md by @liubin in #19247
• Delete unused code by @liubin in #19061
• exporter: add field alias for count(*) func by @liubin in #18840
• Switch to a new chart library by @AllForNothing in #19262
• Remove job status track information from redis after stop by @stonezdj in #19227
• remove chart-museum related to logic by @lengrongfu in #18722
• fix storage.redirect.disable migrate template error by @MinerYang in #19335
• Upgrade UI packages by @AllForNothing in #19330
• Remove duplicated sort fields from order by clause by @liubin in #19347
• fix user resource by @wy65701436 in #19366
• update default processor for unknwon type config by @MinerYang in #19372
• Hide version property if the value is undefined by @AllForNothing in #19395
• feat(i18n): update french translations by @Nhqml in #19418
• bump golang to 1.20.10 by @MinerYang in #19430
• Change fixed_version to package_version in query dangerous CVE sql by @stonezdj in #19397
• fix issue 19392 by @wy65701436 in #19437
• fix: bump up TRIVYVERSION=v0.46.0 && TRIVYADAPTERVERSION=v0.30.17 by @zyyw in #19446
• Update the style for operation-component by @AllForNothing in #19445
• bump golang.org/x/net to v0.17.0 && go.opentelemetry.io/contrib by @MinerYang in #19461
• Use batch to list the job id in the job queue to avoid crash redis by @stonezdj in #19444
• Delete tag retention rule and tag immutable rule when deleting project by @stonezdj in #19390
• bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/m… by @MinerYang in #19477
• Not allow comma for the user name by @AllForNothing in #19501
• bump golang to 1.21.3 by @MinerYang in #19504
• Add a tooltip for the replication rule by @AllForNothing in #19509
• Replace comma in username to avoid casbin issue by @stonezdj in #19505
• Update the style for severity by @AllForNothing in #19525
• Remove vendor folder from harbor code base by @reasonerjt in #19508
• fix: bump up TRIVYVERSION=v0.46.1 && TRIVYADAPTERVERSION=v0.30.18 by @zyyw in #19500
• Skip to validate username when update user profile by @stonezdj in #19552
• Update UI package to clear security alerts by @AllForNothing in #19553
• Delete project member when delete project by @stonezdj in #19523
• add permission api by @wy65701436 in #19543
• Allow POST method to request service/token in readonly mode by @stonezdj in #19556
• 19559 cannot see full label easily by @jmichot-exotec in #19564
• fix: sorting quota by @zyyw in #19538
• Avoid menu closure when filtering labels by @AllForNothing in #19561
• Correct loop condition for replication tasks by @AllForNothing in #19570
• Return empty result when no scanner configured by @stonezdj in #19577
• bump golang to 1.21.4 by @MinerYang in #19601
• add permission validation for robot creating and updating. by @wy65701436 in #19598
• add prepare migration script for 2.10 by @MinerYang in #19600
• Update the permission scope by @AllForNothing in #19603
• fix system label resource by @wy65701436 in #19621
• Bump golang.org/x/time from 0.0.0-20220210224613-90d013bbcef8 to 0.4.0 in /src by @dependabot in #19541
• fix robot account access issue by @wy65701436 in #19627
• fix: update TRIVYVERSION=v0.47.0 && TRIVYADAPTERVERSION=v0.30.19 by @zyyw in #19624
• Bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.7.0 in /src by @dependabot in #19542
• Update the name checking for the robot account by @AllForNothing in #19645
• fix 2.10 prepare migration version by @MinerYang in #19665
• fix: upgrade google.golang.org/grpc by @zyyw in #19648
• Update the style for the robot acccount ui by @AllForNothing in #19663
• Update the wording text for the system robot account by @AllForNothing in #19666
• Add min-width to the permission column by @AllForNothing in #19675
• Bump github.com/robfig/cron/v3 from 3.0.0 to 3.0.1 in /src by @dependabot in #19633
• Bump github.com/gorilla/handlers from 1.5.1 to 1.5.2 in /src by @dependabot in #19632
• Bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 in /src by @dependabot in #19636
• Bump sigs.k8s.io/yaml from 1.3.0 to 1.4.0 in /src by @dependabot in #19631
• bump distribution by @wy65701436 in #19669

Docs update 🗄️

• Add heading to contributing docs by @mterwill in #19412
• [release-note/docs] swagger.yaml
  epositoryName\ parameter description update by @azsteinb in #19651

Community update 🧑🏻‍🤝‍🧑🏾

• Add NS as Harbor adopter by @slushysnowman in #18878
• Add PITS Globale Datenrettungsdienste as an adopter by @arnoldberlin in #18884
• Add CERN as adopter by @OrlinVasilev in #19097

Deprecations ❌

• deprecate resource label by @wy65701436 in #19349

Other Changes

• Bump up setup-gcloud to 430.0.0 by @YangJiao0817 in #19116
• bump up base version by @wy65701436 in #19124
• Update the image version for trivy scan by @AllForNothing in #19264
• Refactor unstable test cases by @YangJiao0817 in #19350
• Add security hub API test case by @YangJiao0817 in #19376
• Add security hub UI test case by @YangJiao0817 in #19448
• Add GC accessory API test case by @YangJiao0817 in #19462
• Add GC accessory UI test case by @YangJiao0817 in #19470
• Add GC details and GC workers API test case by @YangJiao0817 in #19482
• Add GC details and GC workers UI test case by @YangJiao0817 in #19487
• Add banner message API test case by @YangJiao0817 in #19510
• Add banner message UI test case by @YangJiao0817 in #19529
• Update E2E test engine images by @YangJiao0817 in #19544
• Add notation sign artifact API test case by @YangJiao0817 in #19549
• Add API permission testcase by @YangJiao0817 in #19571
• Add API(audit-log,project,registry,replication) permission testcase by @YangJiao0817 in #19584
• Add test cases for the project level permissions by @AllForNothing in #19593
• Add API(scan,volumes,jobservice,scanner,label,securityhub,catalog) permission testcases by @YangJiao0817 in #19595
• Add notation accessory copy test case by @YangJiao0817 in #19605
• Bump actions/setup-node from 3 to 4 by @dependabot in #19478
• Add notation pull policy test case by @YangJiao0817 in #19625
• Add jump to CNAB Bundle index artifact list test case by @YangJiao0817 in #19629
• Update the test script for the project permissions by @AllForNothing in #19623
• Add user API test case by @YangJiao0817 in #19638
• Add external scanner test case by @YangJiao0817 in #19682
• Updating Permission Test Scripts by @YangJiao0817 in #19687
• Bump google-github-actions/auth from 1 to 2 by @dependabot in #19649
• Bump actions/setup-go from 1 to 5 by @dependabot in #19684

New Contributors

• @slushysnowman made their first contribution in #18878
• @arnoldberlin made their first contribution in #18884
• @mterwill made their first contribution in #19412
• @Nhqml made their first contribution in #19418
• @imeoer made their first contribution in #19453
• @SphinxKnight made their first contribution in #19472
• @jmichot-exotec made their first contribution in #19564
• @azsteinb made their first contribution in #19651

Full Changelog: v2.9.0...v2.10.0