What's Changed

Component updates ⬆️

• [CHERRY-PICK] Make openapi-generator-cli download URL configurable (#23186) by @chlins in #23221
• bump Go version from 1.25.9 to 1.26.3 by @stonezdj in #23236
• [cherry-pick] Rebuild goharbor/photon image before create new harbor base images by @jUDASmILE in #23250
• [cherry-pick]remove install net-tools from db dockerfile as photon removed it by @jUDASmILE in #23267
• [CHERRY-PICK] feat: replace redis with valkey as cache backend (#23157) by @chlins in #23261
• [CHERRY-PICK] test(cosign): disable tlog for signing checks by @chlins in #23280
• [CHERRY-PICK] fix(cosign): ignore tlog during verification by @chlins in #23286
• [CHERRY-PICK] fix: Bump repository update_time on tag and artifact changes (#23225) by @chlins in #23292
• [CHERRY-PICK] fix(security): validate blob-mount source project and reject tokens missing iat (#23270) by @Vad1mo in #23297
• (cherry-pick) Upgrade harbor go.mod OSS packages by @stonezdj in #23328
• [cherry-pick] Harden crypto usage and drop unused SMTP package (#23307) by @wy65701436 in #23356
• (cherry-pick) Update Makefile PIP_INDEX_URL to use default value if not defined by @stonezdj in #23377
• [Backport 2.15.0] test(api_db): support dynamic OpenAPI generator and PyPI URLs via env vars by @fiona-xie in #23381
• bump golang to v1.26.4 by @wy65701436 in #23382
• (cherry-pick) Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22 by @stonezdj in #23379

Bump Component Version 🤖

• bump harbor v2.15.2 by @wy65701436 in #23362
• (cherry-pick)Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml by @stonezdj in #23378
• Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1 by @stonezdj in #23386

Other Changes

• [CHERRY-PICK] support configurable PIP_INDEX_URL for swagger client build (#23241) by @stonezdj in #23242
• build: use dev-legacy tags to decouple 2.15 builds from main by @wy65701436 in #23360
• [Backport 2.15.0] test(UI): fix UI robot test cases for Angular and Clarity Upgrade by @fiona-xie in #23380

Full Changelog: v2.15.1...v2.15.2-rc1

What's Changed

Component updates ⬆️

• [CHERRY_PICK] fix(session): fix SessionRegenerate save args and lifetime by @chlins in #22882
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23098
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23109
• (cherry-pick) Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23208
• bump Go to 1.25.9 and use goharbor/photon:5.0 base images by @stonezdj in #23204
• Bump up the go.opentelemetry.io/otel/sdk and github.com/go-jose/go-jose package by @stonezdj in #23215
• (cherry-pick) Fix the issue distribution instance edit without creden… by @chlins in #23220

Full Changelog: v2.14.3...v2.14.4

What's Changed

Component updates ⬆️

• [CHERRY_PICK] fix(session): fix SessionRegenerate save args and lifetime by @chlins in #22882
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23098
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23109
• (cherry-pick) Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23208
• bump Go to 1.25.9 and use goharbor/photon:5.0 base images by @stonezdj in #23204
• Bump up the go.opentelemetry.io/otel/sdk and github.com/go-jose/go-jose package by @stonezdj in #23215
• (cherry-pick) Fix the issue distribution instance edit without creden… by @chlins in #23220

Full Changelog: v2.14.3...v2.14.4-rc1

What's Changed

Component updates ⬆️

• (cherry-pick) Fix Last Pull time on parent/child artifacts and on creation by @stonezdj in #23022
• (cherry-pick) Add User-Agent to all request by @stonezdj in #23054
• (cherry-pick): fix proxy cache serve local on remote not found by @stonezdj in #23049
• [cherry-pick] Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23096
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23097
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23108
• bump base for v2.15.1 by @wy65701436 in #23120
• [CHERRY-PICK] fix(gc): redact redis_url_reg from GC extra attrs (#23134) by @chlins in #23141
• (cherry-pick) Fix the issue distribution instance edit without credential can not save by @stonezdj in #23166
• Update photon packages to fix CVEs by @stonezdj in #23176
• Revert the previous change in Dockerfile.base and change base image to goharbor/photon:5.0 by @stonezdj in #23180

Bump Component Version 🤖

• bump go to 1.25.9 and refresh base images by @stonezdj in #23150
• Upgrade go deps go-jose and otel sdk by @stonezdj in #23158

Full Changelog: v2.15.0...v2.15.1

What's Changed

Component updates ⬆️

• (cherry-pick) Fix Last Pull time on parent/child artifacts and on creation by @stonezdj in #23022
• (cherry-pick) Add User-Agent to all request by @stonezdj in #23054
• (cherry-pick): fix proxy cache serve local on remote not found by @stonezdj in #23049
• [cherry-pick] Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23096
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23097
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23108
• bump base for v2.15.1 by @wy65701436 in #23120
• [CHERRY-PICK] fix(gc): redact redis_url_reg from GC extra attrs (#23134) by @chlins in #23141
• (cherry-pick) Fix the issue distribution instance edit without credential can not save by @stonezdj in #23166
• Update photon packages to fix CVEs by @stonezdj in #23176
• Revert the previous change in Dockerfile.base and change base image to goharbor/photon:5.0 by @stonezdj in #23180

Bump Component Version 🤖

• bump go to 1.25.9 and refresh base images by @stonezdj in #23150
• Upgrade go deps go-jose and otel sdk by @stonezdj in #23158

Full Changelog: v2.15.0...v2.15.1-rc2

What's Changed

Component updates ⬆️

• (cherry-pick) Fix Last Pull time on parent/child artifacts and on creation by @stonezdj in #23022
• (cherry-pick) Add User-Agent to all request by @stonezdj in #23054
• (cherry-pick): fix proxy cache serve local on remote not found by @stonezdj in #23049
• [cherry-pick] Call /v2/auth/token api to get bearer token for dockerhub adapter by @stonezdj in #23096
• [CHERRY-PICK] feat(session): prevent background polling from renewing session TTL by @chlins in #23097
• (cherry-pick) Fix issue related to scanner API by @stonezdj in #23108
• bump base for v2.15.1 by @wy65701436 in #23120
• [CHERRY-PICK] fix(gc): redact redis_url_reg from GC extra attrs (#23134) by @chlins in #23141
• (cherry-pick) Fix the issue distribution instance edit without credential can not save by @stonezdj in #23166
• Update photon packages to fix CVEs by @stonezdj in #23176
• Revert the previous change in Dockerfile.base and change base image to goharbor/photon:5.0 by @stonezdj in #23180

Bump Component Version 🤖

• bump go to 1.25.9 and refresh base images by @stonezdj in #23150
• Upgrade go deps go-jose and otel sdk by @stonezdj in #23158

Full Changelog: v2.15.0...v2.15.1-rc1

What's Changed

Exciting New Features 🎉

• add tag deletion option for gc by @wy65701436 in #22382
• Add UI for limit upstream registry connection by @stonezdj in #22406
• disable land tag in the backend storage by @wy65701436 in #22507

Enhancement 🚀

• Add max_upstream_conn parameter for each proxy_cache project by @stonezdj in #22348
• add per-endpoint CA certificate support for registry endpoints by @wy65701436 in #22535
• Add oci type support for jfrog registry by @stonezdj in #22589
• add DeleteTag support for both aws and azure cr adapters by @shaiatias in #22227

Component updates ⬆️

• Remove unused SYNC_QUOTA from env.jinja template by @mxab in #22280
• bump base to v2.15.0 by @wy65701436 in #22316
• chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 in /src by @dependabot[bot] in #22304
• chore(deps): bump github.com/aws/aws-sdk-go from 1.55.6 to 1.55.8 in /src by @dependabot[bot] in #22306
• chore(deps): bump github.com/go-ldap/ldap/v3 from 3.4.10 to 3.4.11 in /src by @dependabot[bot] in #22305
• chore(deps): bump golang.org/x/text from 0.27.0 to 0.29.0 in /src by @dependabot[bot] in #22338
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.29 to 1.1.31 in /src by @dependabot[bot] in #22337
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.32 to 1.1.34 in /src by @dependabot[bot] in #22356
• chore(deps): bump golang.org/x/time from 0.12.0 to 0.13.0 in /src by @dependabot[bot] in #22360
• chore(deps): bump k8s.io/client-go from 0.33.3 to 0.34.1 in /src by @dependabot[bot] in #22359
• chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.18.1 to 4.19.0 in /src by @dependabot[bot] in #22358
• chore(deps): bump github.com/coreos/go-oidc/v3 from 3.12.0 to 3.15.0 in /src by @dependabot[bot] in #22357
• chore(deps): bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux from 0.59.0 to 0.63.0 in /src by @dependabot[bot] in #22379
• fix robot issue-21406 by @wy65701436 in #22387
• Update and improve zh-TW Traditional Chinese locale by @PeterDaveHello in #22423
• Allow disable audit log to DB when initialize by @wy65701436 in #22452
• Update zh-TW Traditional Chinese locale by @PeterDaveHello in #22468
• add migraiton sql for skip_audit_log_database by @wy65701436 in #22487
• refactor: use strings.Builder to improve performance by @rocksload in #22453
• refactor: replace Split in loops with more efficient SplitSeq by @rustversion in #22494
• refactor the logic to init skip_audit_log_database by @wy65701436 in #22493
• chore(deps): bump golang.org/x/net from 0.41.0 to 0.46.0 in /src by @dependabot[bot] in #22457
• Remove legacy switch from decodeFilters after UI bug #12579 fix by @intojhanurag in #22510
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.34 to 1.1.44 in /src by @dependabot[bot] in #22519
• fix robot call the users api by @wy65701436 in #22492
• Update Release note template and dependabot labels by @OrlinVasilev in #22528
• refactor: replace HasPrefix+TrimPrefix with CutPrefix by @dulanting in #22520
• fix(registry): correct parameter in upload status query by @chlins in #22574
• fix: support both docker-compose v1 and docker compose v2 by @Coldchen99 in #22581
• ci(workflows): simplify label pattern in label_check by @chlins in #22596
• chore: Remove Unused Lang Translations - Recreate PR (#21893) by @bupd in #22587
• fix(portal): fix typo in ko-kr placeholder and update strings by @g-yunjh in #22617
• fix(ui): Remove unwanted scrollbar from tag-retention by @bupd in #22598
• feat(cosign): Support Cosign v3 Bundle signature format by @Aloui-Ikram in #22628
• feat: bump UI version v2.15.0 by @bupd in #22645
• fix(artifact): correct typo in artifact_type column definition by @chlins in #22656
• fix error related to search user and search groups by @stonezdj in #22606
• refine apitest to adopt proxy environment by @MinerYang in #22706
• Allows OIDC integration to handle the case where a user only has a single group by @lfrancke in #22723
• refactor: use strings.Cut to simplify code by @liuyueyangxmu in #22590
• fix(session): fix invalid data type in SessionRegenerate by @liubin in #22726
• update swagger file for creating tag by @wy65701436 in #22754
• Fix goroutine leak in StopAndWait by buffering errChan by @remo-lab in #22740
• docs/makefile-commands by @intojhanurag in #22605
• Add pprof support by @strigazi in #22005
• fix(exporter): Export Harbor version via Prometheus exporter binary. by @Vad1mo in #22733
• chore(deps): update github.com/Masterminds/semver to v3 by @Juneezee in #22411
• Fix(portal): Restore Missing i18n Translation Keys by @bupd in #22722
• Fix: Hide alert messages irrelevant to users in UI by @bupd in #21972
• feat: Add Style Linters (usestdlibvars, dupl) by @bupd in #22670
• Fix redis sentinel master acl for jobservice by @MinerYang in #22765
• support parse redis acl for registry config by @MinerYang in #22770
• fix(ui): avoid duplicate RUN in build history by @Tusharjamdade in #22685
• fix flaky ut tests involving workers by @Vad1mo in #22768
• Pin distribution src tag to v2.8.3-harbor.1-rc.1 by @MinerYang in #22772
• fix(core): add warning when config admin password is ignored by @thc1006 in #22709
• Fix: Copy Pull Button when tags are undefined by @bupd in #22136
• Replace pull-through cache with proxy cache by @stonezdj in #22766
• add support for configure trivy db repository via harbor.yml by @quent1-fr in #21193
• build: remove unused REGISTRYURL and GCS download path for registry build by @SoumyaRaikwar in #22372
• add prepare migration script for 2.15.0 by @MinerYang in #22788
• fix: correct multiline string in yaml by @Vad1mo in #22809
• fix: mock http server for volcenginecr adapt ut by @hyy0322 in #22810
• chore(deps): bump form-data in /src/portal by @dependabot[bot] in #22523
• fix 22817 by @wy65701436 in #22826
• Swagger Replication Rule invalid JSON by @mlimardo1984 in #22724
• fix the git action publish permission issue by @wy65701436 in #22841
• [cherry-pick] fix: Update Verify Remote Cert tooltip for registry endpoints by @wy65701436 in #22867
• [CHERRY_PICK] fix(session): use correct maxlifetime in SessionRegenerate by @chlins in #22881
• refresh base images for v2.15.0 rc2 by @wy65701436 in #22883
• fix: bump Trivy to v0.69.2 following supply chain incident (#22896) by @wy65701436 in #22911
• refresh base images for v2.15 rc2 by @wy65701436 in #22910
• (cherry-pick) Remove payload from config audit log by @stonezdj in #22917
• bump otel to 1.40.0 by @wy65701436 in #22921
• Bump trivy to 0.69.3 & adapter to v0.35.1-rc.1 on release-2.15.0 by @MinerYang in https://g...

What's Changed

Exciting New Features 🎉

• add tag deletion option for gc by @wy65701436 in #22382
• Add UI for limit upstream registry connection by @stonezdj in #22406
• disable land tag in the backend storage by @wy65701436 in #22507
• Add UI option to enable proxy cache referrer API by @stonezdj in #22767

Enhancement 🚀

• Add max_upstream_conn parameter for each proxy_cache project by @stonezdj in #22348
• add per-endpoint CA certificate support for registry endpoints by @wy65701436 in #22535
• Add oci type support for jfrog registry by @stonezdj in #22589
• add DeleteTag support for both aws and azure cr adapters by @shaiatias in #22227

Component updates ⬆️

• Remove unused SYNC_QUOTA from env.jinja template by @mxab in #22280
• bump base to v2.15.0 by @wy65701436 in #22316
• chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 in /src by @dependabot[bot] in #22304
• chore(deps): bump github.com/aws/aws-sdk-go from 1.55.6 to 1.55.8 in /src by @dependabot[bot] in #22306
• chore(deps): bump github.com/go-ldap/ldap/v3 from 3.4.10 to 3.4.11 in /src by @dependabot[bot] in #22305
• chore(deps): bump golang.org/x/text from 0.27.0 to 0.29.0 in /src by @dependabot[bot] in #22338
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.29 to 1.1.31 in /src by @dependabot[bot] in #22337
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.32 to 1.1.34 in /src by @dependabot[bot] in #22356
• chore(deps): bump golang.org/x/time from 0.12.0 to 0.13.0 in /src by @dependabot[bot] in #22360
• chore(deps): bump k8s.io/client-go from 0.33.3 to 0.34.1 in /src by @dependabot[bot] in #22359
• chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.18.1 to 4.19.0 in /src by @dependabot[bot] in #22358
• chore(deps): bump github.com/coreos/go-oidc/v3 from 3.12.0 to 3.15.0 in /src by @dependabot[bot] in #22357
• chore(deps): bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux from 0.59.0 to 0.63.0 in /src by @dependabot[bot] in #22379
• fix robot issue-21406 by @wy65701436 in #22387
• Update and improve zh-TW Traditional Chinese locale by @PeterDaveHello in #22423
• Allow disable audit log to DB when initialize by @wy65701436 in #22452
• Update zh-TW Traditional Chinese locale by @PeterDaveHello in #22468
• add migraiton sql for skip_audit_log_database by @wy65701436 in #22487
• refactor: use strings.Builder to improve performance by @rocksload in #22453
• refactor: replace Split in loops with more efficient SplitSeq by @rustversion in #22494
• refactor the logic to init skip_audit_log_database by @wy65701436 in #22493
• chore(deps): bump golang.org/x/net from 0.41.0 to 0.46.0 in /src by @dependabot[bot] in #22457
• Remove legacy switch from decodeFilters after UI bug #12579 fix by @intojhanurag in #22510
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.34 to 1.1.44 in /src by @dependabot[bot] in #22519
• fix robot call the users api by @wy65701436 in #22492
• Update Release note template and dependabot labels by @OrlinVasilev in #22528
• refactor: replace HasPrefix+TrimPrefix with CutPrefix by @dulanting in #22520
• fix(registry): correct parameter in upload status query by @chlins in #22574
• fix: support both docker-compose v1 and docker compose v2 by @Coldchen99 in #22581
• ci(workflows): simplify label pattern in label_check by @chlins in #22596
• chore: Remove Unused Lang Translations - Recreate PR (#21893) by @bupd in #22587
• fix(portal): fix typo in ko-kr placeholder and update strings by @g-yunjh in #22617
• fix(ui): Remove unwanted scrollbar from tag-retention by @bupd in #22598
• feat(cosign): Support Cosign v3 Bundle signature format by @Aloui-Ikram in #22628
• feat: bump UI version v2.15.0 by @bupd in #22645
• fix(artifact): correct typo in artifact_type column definition by @chlins in #22656
• fix error related to search user and search groups by @stonezdj in #22606
• refine apitest to adopt proxy environment by @MinerYang in #22706
• Allows OIDC integration to handle the case where a user only has a single group by @lfrancke in #22723
• refactor: use strings.Cut to simplify code by @liuyueyangxmu in #22590
• fix(session): fix invalid data type in SessionRegenerate by @liubin in #22726
• update swagger file for creating tag by @wy65701436 in #22754
• Fix goroutine leak in StopAndWait by buffering errChan by @remo-lab in #22740
• docs/makefile-commands by @intojhanurag in #22605
• Add pprof support by @strigazi in #22005
• fix(exporter): Export Harbor version via Prometheus exporter binary. by @Vad1mo in #22733
• chore(deps): update github.com/Masterminds/semver to v3 by @Juneezee in #22411
• Fix(portal): Restore Missing i18n Translation Keys by @bupd in #22722
• Fix: Hide alert messages irrelevant to users in UI by @bupd in #21972
• feat: Add Style Linters (usestdlibvars, dupl) by @bupd in #22670
• Fix redis sentinel master acl for jobservice by @MinerYang in #22765
• support parse redis acl for registry config by @MinerYang in #22770
• fix(ui): avoid duplicate RUN in build history by @Tusharjamdade in #22685
• fix flaky ut tests involving workers by @Vad1mo in #22768
• Pin distribution src tag to v2.8.3-harbor.1-rc.1 by @MinerYang in #22772
• fix(core): add warning when config admin password is ignored by @thc1006 in #22709
• Fix: Copy Pull Button when tags are undefined by @bupd in #22136
• Replace pull-through cache with proxy cache by @stonezdj in #22766
• add support for configure trivy db repository via harbor.yml by @quent1-fr in #21193
• build: remove unused REGISTRYURL and GCS download path for registry build by @SoumyaRaikwar in #22372
• add prepare migration script for 2.15.0 by @MinerYang in #22788
• fix: correct multiline string in yaml by @Vad1mo in #22809
• fix: mock http server for volcenginecr adapt ut by @hyy0322 in #22810
• chore(deps): bump form-data in /src/portal by @dependabot[bot] in #22523
• fix 22817 by @wy65701436 in #22826
• Swagger Replication Rule invalid JSON by @mlimardo1984 in #22724
• fix the git action publish permission issue by @wy65701436 in #22841
• [cherry-pick] fix: Update Verify Remote Cert tooltip for registry endpoints by @wy65701436 in #22867
• [CHERRY_PICK] fix(session): use correct maxlifetime in SessionRegenerate by @chlins in #22881
• refresh base images for v2.15.0 rc2 by @wy65701436 in #22883
• fix: bump Trivy to v0.69.2 following supply chain incident (#22896) by @wy65701436 in #22911
• refresh base images for v2.15 rc2 by @wy65701436 in #22910
• (cherry-pick) Remove payload from config audit log by @stonezdj in #22917
• bump otel to 1.40.0 by @wy65701436 in #22921
• Bump trivy to 0.69.3 & adapter to v0.35.1-rc.1 on release-2.15....

What's Changed

Exciting New Features 🎉

• add tag deletion option for gc by @wy65701436 in #22382
• Add UI for limit upstream registry connection by @stonezdj in #22406
• disable land tag in the backend storage by @wy65701436 in #22507
• Add UI option to enable proxy cache referrer API by @stonezdj in #22767

Enhancement 🚀

• Add max_upstream_conn parameter for each proxy_cache project by @stonezdj in #22348
• add per-endpoint CA certificate support for registry endpoints by @wy65701436 in #22535
• Add oci type support for jfrog registry by @stonezdj in #22589
• add DeleteTag support for both aws and azure cr adapters by @shaiatias in #22227

Component updates ⬆️

• Remove unused SYNC_QUOTA from env.jinja template by @mxab in #22280
• bump base to v2.15.0 by @wy65701436 in #22316
• chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 in /src by @dependabot[bot] in #22304
• chore(deps): bump github.com/aws/aws-sdk-go from 1.55.6 to 1.55.8 in /src by @dependabot[bot] in #22306
• chore(deps): bump github.com/go-ldap/ldap/v3 from 3.4.10 to 3.4.11 in /src by @dependabot[bot] in #22305
• chore(deps): bump golang.org/x/text from 0.27.0 to 0.29.0 in /src by @dependabot[bot] in #22338
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.29 to 1.1.31 in /src by @dependabot[bot] in #22337
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.32 to 1.1.34 in /src by @dependabot[bot] in #22356
• chore(deps): bump golang.org/x/time from 0.12.0 to 0.13.0 in /src by @dependabot[bot] in #22360
• chore(deps): bump k8s.io/client-go from 0.33.3 to 0.34.1 in /src by @dependabot[bot] in #22359
• chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.18.1 to 4.19.0 in /src by @dependabot[bot] in #22358
• chore(deps): bump github.com/coreos/go-oidc/v3 from 3.12.0 to 3.15.0 in /src by @dependabot[bot] in #22357
• chore(deps): bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux from 0.59.0 to 0.63.0 in /src by @dependabot[bot] in #22379
• fix robot issue-21406 by @wy65701436 in #22387
• Update and improve zh-TW Traditional Chinese locale by @PeterDaveHello in #22423
• Allow disable audit log to DB when initialize by @wy65701436 in #22452
• Update zh-TW Traditional Chinese locale by @PeterDaveHello in #22468
• add migraiton sql for skip_audit_log_database by @wy65701436 in #22487
• refactor: use strings.Builder to improve performance by @rocksload in #22453
• refactor: replace Split in loops with more efficient SplitSeq by @rustversion in #22494
• refactor the logic to init skip_audit_log_database by @wy65701436 in #22493
• chore(deps): bump golang.org/x/net from 0.41.0 to 0.46.0 in /src by @dependabot[bot] in #22457
• Remove legacy switch from decodeFilters after UI bug #12579 fix by @intojhanurag in #22510
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.34 to 1.1.44 in /src by @dependabot[bot] in #22519
• fix robot call the users api by @wy65701436 in #22492
• Update Release note template and dependabot labels by @OrlinVasilev in #22528
• refactor: replace HasPrefix+TrimPrefix with CutPrefix by @dulanting in #22520
• fix(registry): correct parameter in upload status query by @chlins in #22574
• fix: support both docker-compose v1 and docker compose v2 by @Coldchen99 in #22581
• ci(workflows): simplify label pattern in label_check by @chlins in #22596
• chore: Remove Unused Lang Translations - Recreate PR (#21893) by @bupd in #22587
• fix(portal): fix typo in ko-kr placeholder and update strings by @g-yunjh in #22617
• fix(ui): Remove unwanted scrollbar from tag-retention by @bupd in #22598
• feat(cosign): Support Cosign v3 Bundle signature format by @Aloui-Ikram in #22628
• feat: bump UI version v2.15.0 by @bupd in #22645
• fix(artifact): correct typo in artifact_type column definition by @chlins in #22656
• fix error related to search user and search groups by @stonezdj in #22606
• refine apitest to adopt proxy environment by @MinerYang in #22706
• Allows OIDC integration to handle the case where a user only has a single group by @lfrancke in #22723
• refactor: use strings.Cut to simplify code by @liuyueyangxmu in #22590
• fix(session): fix invalid data type in SessionRegenerate by @liubin in #22726
• update swagger file for creating tag by @wy65701436 in #22754
• Fix goroutine leak in StopAndWait by buffering errChan by @remo-lab in #22740
• docs/makefile-commands by @intojhanurag in #22605
• Add pprof support by @strigazi in #22005
• fix(exporter): Export Harbor version via Prometheus exporter binary. by @Vad1mo in #22733
• chore(deps): update github.com/Masterminds/semver to v3 by @Juneezee in #22411
• Fix(portal): Restore Missing i18n Translation Keys by @bupd in #22722
• Fix: Hide alert messages irrelevant to users in UI by @bupd in #21972
• feat: Add Style Linters (usestdlibvars, dupl) by @bupd in #22670
• Fix redis sentinel master acl for jobservice by @MinerYang in #22765
• support parse redis acl for registry config by @MinerYang in #22770
• fix(ui): avoid duplicate RUN in build history by @Tusharjamdade in #22685
• fix flaky ut tests involving workers by @Vad1mo in #22768
• Pin distribution src tag to v2.8.3-harbor.1-rc.1 by @MinerYang in #22772
• fix(core): add warning when config admin password is ignored by @thc1006 in #22709
• Fix: Copy Pull Button when tags are undefined by @bupd in #22136
• Replace pull-through cache with proxy cache by @stonezdj in #22766
• add support for configure trivy db repository via harbor.yml by @quent1-fr in #21193
• build: remove unused REGISTRYURL and GCS download path for registry build by @SoumyaRaikwar in #22372
• add prepare migration script for 2.15.0 by @MinerYang in #22788
• fix: correct multiline string in yaml by @Vad1mo in #22809
• fix: mock http server for volcenginecr adapt ut by @hyy0322 in #22810
• chore(deps): bump form-data in /src/portal by @dependabot[bot] in #22523
• fix 22817 by @wy65701436 in #22826
• Swagger Replication Rule invalid JSON by @mlimardo1984 in #22724
• fix the git action publish permission issue by @wy65701436 in #22841
• [cherry-pick] fix: Update Verify Remote Cert tooltip for registry endpoints by @wy65701436 in #22867
• [CHERRY_PICK] fix(session): use correct maxlifetime in SessionRegenerate by @chlins in #22881
• refresh base images for v2.15.0 rc2 by @wy65701436 in #22883
• fix: bump Trivy to v0.69.2 following supply chain incident (#22896) by @wy65701436 in #22911
• refresh base images for v2.15 rc2 by @wy65701436 in #22910
• (cherry-pick) Remove payload from config audit log by @stonezdj in #22917
• bump otel to 1.40.0 by @wy65701436 in #22921
• Bump trivy to 0.69.3 & adapter to v0.35.1-rc.1 on release-2.15....

What's Changed

Exciting New Features 🎉

• add tag deletion option for gc by @wy65701436 in #22382
• Add UI for limit upstream registry connection by @stonezdj in #22406
• disable land tag in the backend storage by @wy65701436 in #22507
• Add UI option to enable proxy cache referrer API by @stonezdj in #22767

Enhancement 🚀

• Add max_upstream_conn parameter for each proxy_cache project by @stonezdj in #22348
• add per-endpoint CA certificate support for registry endpoints by @wy65701436 in #22535
• Add oci type support for jfrog registry by @stonezdj in #22589
• add DeleteTag support for both aws and azure cr adapters by @shaiatias in #22227

Component updates ⬆️

• Remove unused SYNC_QUOTA from env.jinja template by @mxab in #22280
• bump base to v2.15.0 by @wy65701436 in #22316
• chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 in /src by @dependabot[bot] in #22304
• chore(deps): bump github.com/aws/aws-sdk-go from 1.55.6 to 1.55.8 in /src by @dependabot[bot] in #22306
• chore(deps): bump github.com/go-ldap/ldap/v3 from 3.4.10 to 3.4.11 in /src by @dependabot[bot] in #22305
• chore(deps): bump golang.org/x/text from 0.27.0 to 0.29.0 in /src by @dependabot[bot] in #22338
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.29 to 1.1.31 in /src by @dependabot[bot] in #22337
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.32 to 1.1.34 in /src by @dependabot[bot] in #22356
• chore(deps): bump golang.org/x/time from 0.12.0 to 0.13.0 in /src by @dependabot[bot] in #22360
• chore(deps): bump k8s.io/client-go from 0.33.3 to 0.34.1 in /src by @dependabot[bot] in #22359
• chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.18.1 to 4.19.0 in /src by @dependabot[bot] in #22358
• chore(deps): bump github.com/coreos/go-oidc/v3 from 3.12.0 to 3.15.0 in /src by @dependabot[bot] in #22357
• chore(deps): bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux from 0.59.0 to 0.63.0 in /src by @dependabot[bot] in #22379
• fix robot issue-21406 by @wy65701436 in #22387
• Update and improve zh-TW Traditional Chinese locale by @PeterDaveHello in #22423
• Allow disable audit log to DB when initialize by @wy65701436 in #22452
• Update zh-TW Traditional Chinese locale by @PeterDaveHello in #22468
• add migraiton sql for skip_audit_log_database by @wy65701436 in #22487
• refactor: use strings.Builder to improve performance by @rocksload in #22453
• refactor: replace Split in loops with more efficient SplitSeq by @rustversion in #22494
• refactor the logic to init skip_audit_log_database by @wy65701436 in #22493
• chore(deps): bump golang.org/x/net from 0.41.0 to 0.46.0 in /src by @dependabot[bot] in #22457
• Remove legacy switch from decodeFilters after UI bug #12579 fix by @intojhanurag in #22510
• chore(deps): bump github.com/volcengine/volcengine-go-sdk from 1.1.34 to 1.1.44 in /src by @dependabot[bot] in #22519
• fix robot call the users api by @wy65701436 in #22492
• Update Release note template and dependabot labels by @OrlinVasilev in #22528
• refactor: replace HasPrefix+TrimPrefix with CutPrefix by @dulanting in #22520
• fix(registry): correct parameter in upload status query by @chlins in #22574
• fix: support both docker-compose v1 and docker compose v2 by @Coldchen99 in #22581
• ci(workflows): simplify label pattern in label_check by @chlins in #22596
• chore: Remove Unused Lang Translations - Recreate PR (#21893) by @bupd in #22587
• fix(portal): fix typo in ko-kr placeholder and update strings by @g-yunjh in #22617
• fix(ui): Remove unwanted scrollbar from tag-retention by @bupd in #22598
• feat(cosign): Support Cosign v3 Bundle signature format by @Aloui-Ikram in #22628
• feat: bump UI version v2.15.0 by @bupd in #22645
• fix(artifact): correct typo in artifact_type column definition by @chlins in #22656
• fix error related to search user and search groups by @stonezdj in #22606
• refine apitest to adopt proxy environment by @MinerYang in #22706
• Allows OIDC integration to handle the case where a user only has a single group by @lfrancke in #22723
• refactor: use strings.Cut to simplify code by @liuyueyangxmu in #22590
• fix(session): fix invalid data type in SessionRegenerate by @liubin in #22726
• update swagger file for creating tag by @wy65701436 in #22754
• Fix goroutine leak in StopAndWait by buffering errChan by @remo-lab in #22740
• docs/makefile-commands by @intojhanurag in #22605
• Add pprof support by @strigazi in #22005
• fix(exporter): Export Harbor version via Prometheus exporter binary. by @Vad1mo in #22733
• chore(deps): update github.com/Masterminds/semver to v3 by @Juneezee in #22411
• Fix(portal): Restore Missing i18n Translation Keys by @bupd in #22722
• Fix: Hide alert messages irrelevant to users in UI by @bupd in #21972
• feat: Add Style Linters (usestdlibvars, dupl) by @bupd in #22670
• Fix redis sentinel master acl for jobservice by @MinerYang in #22765
• support parse redis acl for registry config by @MinerYang in #22770
• fix(ui): avoid duplicate RUN in build history by @Tusharjamdade in #22685
• fix flaky ut tests involving workers by @Vad1mo in #22768
• Pin distribution src tag to v2.8.3-harbor.1-rc.1 by @MinerYang in #22772
• fix(core): add warning when config admin password is ignored by @thc1006 in #22709
• Fix: Copy Pull Button when tags are undefined by @bupd in #22136
• Replace pull-through cache with proxy cache by @stonezdj in #22766
• add support for configure trivy db repository via harbor.yml by @quent1-fr in #21193
• build: remove unused REGISTRYURL and GCS download path for registry build by @SoumyaRaikwar in #22372
• add prepare migration script for 2.15.0 by @MinerYang in #22788
• fix: correct multiline string in yaml by @Vad1mo in #22809
• fix: mock http server for volcenginecr adapt ut by @hyy0322 in #22810
• chore(deps): bump form-data in /src/portal by @dependabot[bot] in #22523
• fix 22817 by @wy65701436 in #22826
• Swagger Replication Rule invalid JSON by @mlimardo1984 in #22724
• fix the git action publish permission issue by @wy65701436 in #22841
• [cherry-pick] fix: Update Verify Remote Cert tooltip for registry endpoints by @wy65701436 in #22867
• [CHERRY_PICK] fix(session): use correct maxlifetime in SessionRegenerate by @chlins in #22881
• refresh base images for v2.15.0 rc2 by @wy65701436 in #22883
• fix: bump Trivy to v0.69.2 following supply chain incident (#22896) by @wy65701436 in #22911
• refresh base images for v2.15 rc2 by @wy65701436 in #22910
• (cherry-pick) Remove payload from config audit log by @stonezdj in #22917
• bump otel to 1.40.0 by @wy65701436 in https://github.com/goh...