1
0
mirror of https://github.com/goharbor/harbor.git synced 2026-10-24 21:59:32 +03:00

Commit Graph

  • 5c885152b9 fix(scan): scope scan stop lookup to caller artifact (#23948) stonezdj(Daojun Zhang) 2026-10-13 17:41:33 +08:00
  • 68d2b1af92 fix(contenttrust): allow legacy signer pull by default to avoid regre… (#24132) v2.14.6-rc1 Wang Yan 2026-10-13 10:16:53 +08:00
  • 469dcded1f Cherry pick upload location origin 2.14 (#24114) (#24131) Wang Yan 2026-10-13 10:16:34 +08:00
  • d5c132e697 fix(prepare): expose the legacy signer pull switch in harbor.yml (#24… (#24130) Wang Yan 2026-10-13 10:16:13 +08:00
  • 83b78ff9b0 fix(webhook): allow private network access by default (#24082) (#24129) Wang Yan 2026-10-13 10:15:48 +08:00
  • 23bfa9a110 fix(ui): keep multi-value filters when editing a P2P preheat policy (#24056) Viktor Erpylev 2026-10-12 13:04:29 +03:00
  • 205159bd91 Custom project roles — frontend UI (#23970) Max 2026-10-12 09:21:44 +02:00
  • 2c94d4e213 bump: bump up Go version to v1.27.2 (#24119) stonezdj(Daojun Zhang) 2026-10-12 14:28:24 +08:00
  • ca5e9bacac chore(webhook): drop the deprecated DualStack dialer field (#24100) Prasanth Baskar 2026-10-12 08:20:55 +05:30
  • 29c4cebbf0 fix(http): redact the pagination Link in rejection errors (#24095) Prasanth Baskar 2026-10-10 13:40:41 +05:30
  • 3f2a114add Release 2.14 bump go trivy distribution (#24122) Wang Yan 2026-10-10 16:06:14 +08:00
  • 1c05756352 Regenerate mocks with mockery built against Go 1.27 / latest x/tools copilot/fix-uttest-failure copilot-swe-agent[bot] 2026-10-10 06:19:57 +00:00
  • b0b1997082 Initial plan copilot-swe-agent[bot] 2026-10-10 06:17:06 +00:00
  • 2c66bbe032 Bump trivy adapter to v0.39.1 and distribution to v2.8.3-harbor.2 (#24118) stonezdj(Daojun Zhang) 2026-10-10 11:13:20 +08:00
  • 6370a581ee fix(portal): Add the missing i18n entries for the operate action and the configuration resource (#24104) Prasanth Baskar 2026-10-09 14:45:24 +05:30
  • 4d425b805f bump: bump up Go version to v1.26.9 (#24120) stonezdj(Daojun Zhang) 2026-10-09 16:42:09 +08:00
  • 97aaa4ef18 bump base version for v2.14.6 (#24115) Wang Yan 2026-10-09 16:11:56 +08:00
  • 082773926e chore(deps-dev): bump compression from 1.8.1 to 1.8.2 in /src/portal dependabot[bot] 2026-10-08 06:53:44 +00:00
  • b69cc0087c bump base version for v2.13.7 (#24116) Wang Yan 2026-10-09 15:48:12 +08:00
  • 0a6bf30d54 Bump trivy adapter to v0.39.1 and distribution to v2.8.3-harbor.2 (#24117) v2.15.4 stonezdj(Daojun Zhang) 2026-10-09 10:15:07 +08:00
  • 44d081c195 fix(i18n): translate remaining French UI strings (#24088) Lewis Bertin 2026-10-08 12:39:19 +02:00
  • d884174293 Cherry pick upload location origin 2.15 (#24114) v2.15.4-rc1 Wang Yan 2026-10-08 16:43:32 +08:00
  • c329590590 fix(registry): validate upload Location against the request origin, n… (#24113) Wang Yan 2026-10-08 16:26:47 +08:00
  • 72e54002bb chore(deps): forward-port the release-2.15.0 go module bumps to main (#24093) Prasanth Baskar 2026-10-08 12:21:12 +05:30
  • 8b67a48c4e chore(deps): bump trivy to 0.75.0 and the trivy adapter to 0.39.1-rc2 (#24092) Prasanth Baskar 2026-10-08 11:39:13 +05:30
  • ba53f0bb10 fix(contenttrust): allow legacy signer pull by default to avoid regre… (#24085) Wang Yan 2026-10-08 12:34:08 +08:00
  • 51c6499b00 fix(prepare): expose the legacy signer pull switch in harbor.yml (#24101) Prasanth Baskar 2026-10-08 09:12:03 +05:30
  • 26d328d686 fix(contenttrust): allow legacy signer pull by default to avoid regre… (#24086) Wang Yan 2026-10-08 10:16:30 +08:00
  • f6f5bac8d1 feat(webhook): add webhook egress policy levels and allowlist (#24079) Vadim Bauer 2026-10-08 03:45:15 +02:00
  • b40d66bcfe bump v2.15.4 release (#24087) Wang Yan 2026-10-08 09:22:16 +08:00
  • c983fe4f70 Bump trivy(0.75.0) and trivy adapter(0.39.1-rc2) (#24080) stonezdj(Daojun Zhang) 2026-10-07 23:57:49 +08:00
  • 005367e6b4 fix(webhook): allow private network access by default (#24082) Vadim Bauer 2026-10-07 17:55:34 +02:00
  • 9a37bcf55f fix(webhook): allow private network access by default to avoid regres… (#24078) Wang Yan 2026-10-07 20:04:17 +08:00
  • c83198c6a1 fix: stop release-2.14 builds from overwriting goharbor/photon:5.0 (#24063) v2.14.5 Prasanth Baskar 2026-10-06 20:34:40 +05:30
  • 5d4a83fc6f fix: pin redis 7.2.11 instead of 7.2.6 in the redis base image (#24065) Prasanth Baskar 2026-10-06 20:34:32 +05:30
  • 4efe985802 fix: pin redis 7.2.11 instead of 7.2.6 in the redis base image (#24066) v2.13.6 Prasanth Baskar 2026-10-06 20:34:22 +05:30
  • 533a910e72 chore: bump version to v2.14.5 Vadim Bauer 2026-10-06 16:02:32 +02:00
  • c4b30b49cf chore: bump version to v2.13.6 Vadim Bauer 2026-10-06 16:02:32 +02:00
  • 6db6763382 build: install pinned redis from unpinned snapshot Vadim Bauer 2026-10-06 16:02:32 +02:00
  • a80fcc2eff build: install pinned redis 7.2.6 for redis base Vadim Bauer 2026-10-06 16:02:32 +02:00
  • eba2c4a5fd build: build registry with Go 1.25, keep Go 1.24 Vadim Bauer 2026-10-06 16:02:32 +02:00
  • 7429a3d15a build: pin registry source tag and bump Go to 1.25.9 Vadim Bauer 2026-10-06 15:15:15 +02:00
  • 6289f5beaa build: pin registry source tag and fix pg14 install Vadim Bauer 2026-10-06 15:15:14 +02:00
  • a673089019 [cherry-pick] fix(webhook): block SSRF to private-network targets and stop reflecting response bodies (GHSA-mxjq-7hr5-pq2q) Vadim Bauer 2026-10-06 14:04:35 +02:00
  • 413139336c [cherry-pick] fix(policy): stop User-Agent from bypassing content-trust and vulnerability policies (GHSA-wrw5-gmvj-gf23) Vadim Bauer 2026-10-06 14:03:35 +02:00
  • 261edf59ee [cherry-pick] fix(registry): validate chunk-upload Location against the registry origin (GHSA-wjpm-hv5w-gxr6) Vadim Bauer 2026-10-06 14:02:35 +02:00
  • 9541fc7934 [cherry-pick] fix(common/http): constrain pagination Link next URL to the request origin (GHSA-xgp2-5vxg-rgh2) Vadim Bauer 2026-10-06 14:01:35 +02:00
  • 89be7fc3a0 [cherry-pick] fix(webhook): block SSRF to private-network targets and stop reflecting response bodies (GHSA-mxjq-7hr5-pq2q) Vadim Bauer 2026-10-06 14:04:35 +02:00
  • 882d06c14b [cherry-pick] fix(policy): stop User-Agent from bypassing content-trust and vulnerability policies (GHSA-wrw5-gmvj-gf23) Vadim Bauer 2026-10-06 14:03:35 +02:00
  • e3cc29d8c4 [cherry-pick] fix(registry): validate chunk-upload Location against the registry origin (GHSA-wjpm-hv5w-gxr6) Vadim Bauer 2026-10-06 14:02:35 +02:00
  • 1e8281bd1f [cherry-pick] fix(common/http): constrain pagination Link next URL to the request origin (GHSA-xgp2-5vxg-rgh2) Vadim Bauer 2026-10-06 14:01:35 +02:00
  • fb476e10c9 [cherry-pick] fix(webhook): block SSRF to private-network targets and stop reflecting response bodies (GHSA-mxjq-7hr5-pq2q) v2.15.3 Vadim Bauer 2026-10-06 14:04:35 +02:00
  • 9d255ebe1a [cherry-pick] fix(policy): stop User-Agent from bypassing content-trust and vulnerability policies (GHSA-wrw5-gmvj-gf23) Vadim Bauer 2026-10-06 14:03:35 +02:00
  • 401e734296 [cherry-pick] fix(registry): validate chunk-upload Location against the registry origin (GHSA-wjpm-hv5w-gxr6) Vadim Bauer 2026-10-06 14:02:35 +02:00
  • a01e0c6c56 [cherry-pick] fix(common/http): constrain pagination Link next URL to the request origin (GHSA-xgp2-5vxg-rgh2) Vadim Bauer 2026-10-06 14:01:35 +02:00
  • bfd319a928 [cherry-pick] fix(security): fail closed when auth mode lookup fails (GHSA-3x7c-wf86-mjx6) Vadim Bauer 2026-10-06 14:00:35 +02:00
  • 13e5a1b979 [cherry-pick] fix(authproxy): clear leaked local sysadmin flag in http_auth /v2 context (GHSA-xvh7-74g6-29xw) Vadim Bauer 2026-10-06 13:59:35 +02:00
  • 08c58f3c76 [cherry-pick] fix(immutable): evaluate all repository and tag selectors (GHSA-27f2-qg57-2gwg) Vadim Bauer 2026-10-06 13:58:35 +02:00
  • eb1a6fb642 [cherry-pick] fix(scan): verify TLS and bound body on scanner bearer token request (GHSA-884q-mjcg-86x4) Vadim Bauer 2026-10-06 13:57:35 +02:00
  • d2e2312f57 [cherry-pick] fix(scanner): stop access_cred ORM filter oracle (GHSA-vwvv-675v-p6rr) Vadim Bauer 2026-10-06 13:56:35 +02:00
  • 7331b58d59 [cherry-pick] fix(rbac): stop cover-all robot scope from reaching sub-resources (GHSA-xq2m-cj8w-56v5) Vadim Bauer 2026-10-06 13:55:35 +02:00
  • 8896be0aed [cherry-pick] fix(users): require sysadmin identity for grants (GHSA-w5fq-xrhj-j7g2) Vadim Bauer 2026-10-06 13:54:30 +02:00
  • a82c5528f1 [cherry-pick] fix(registry): reject dot segments in /v2/ distribution paths (GHSA-qj39-pjf2-wmrc) Vadim Bauer 2026-10-06 13:53:09 +02:00
  • 04ca408bcd [cherry-pick] fix(security): fail closed when auth mode lookup fails (GHSA-3x7c-wf86-mjx6) Vadim Bauer 2026-10-06 14:00:35 +02:00
  • 2da7fb849e [cherry-pick] fix(authproxy): clear leaked local sysadmin flag in http_auth /v2 context (GHSA-xvh7-74g6-29xw) Vadim Bauer 2026-10-06 13:59:35 +02:00
  • 2eae492801 [cherry-pick] fix(immutable): evaluate all repository and tag selectors (GHSA-27f2-qg57-2gwg) Vadim Bauer 2026-10-06 13:58:35 +02:00
  • 1f7a5e13e5 [cherry-pick] fix(scan): verify TLS and bound body on scanner bearer token request (GHSA-884q-mjcg-86x4) Vadim Bauer 2026-10-06 13:57:35 +02:00
  • 344562e7e3 [cherry-pick] fix(scanner): stop access_cred ORM filter oracle (GHSA-vwvv-675v-p6rr) Vadim Bauer 2026-10-06 13:56:35 +02:00
  • 2d281bb881 [cherry-pick] fix(rbac): stop cover-all robot scope from reaching sub-resources (GHSA-xq2m-cj8w-56v5) Vadim Bauer 2026-10-06 13:55:35 +02:00
  • f8024c1fe2 [cherry-pick] fix(users): require sysadmin identity for grants (GHSA-w5fq-xrhj-j7g2) Vadim Bauer 2026-10-06 13:54:30 +02:00
  • b7ed9e73b6 [cherry-pick] fix(registry): reject dot segments in /v2/ distribution paths (GHSA-qj39-pjf2-wmrc) Vadim Bauer 2026-10-06 13:53:09 +02:00
  • a8ae8cef81 [cherry-pick] fix(security): fail closed when auth mode lookup fails (GHSA-3x7c-wf86-mjx6) Vadim Bauer 2026-10-06 14:00:35 +02:00
  • c1223fe7d0 [cherry-pick] fix(authproxy): clear leaked local sysadmin flag in http_auth /v2 context (GHSA-xvh7-74g6-29xw) Vadim Bauer 2026-10-06 13:59:35 +02:00
  • f4071e7cf9 [cherry-pick] fix(immutable): evaluate all repository and tag selectors (GHSA-27f2-qg57-2gwg) Vadim Bauer 2026-10-06 13:58:35 +02:00
  • 49c58b6c58 [cherry-pick] fix(scan): verify TLS and bound body on scanner bearer token request (GHSA-884q-mjcg-86x4) Vadim Bauer 2026-10-06 13:57:35 +02:00
  • f400b5459f [cherry-pick] fix(scanner): stop access_cred ORM filter oracle (GHSA-vwvv-675v-p6rr) Vadim Bauer 2026-10-06 13:56:35 +02:00
  • ce7a28738b [cherry-pick] fix(rbac): stop cover-all robot scope from reaching sub-resources (GHSA-xq2m-cj8w-56v5) Vadim Bauer 2026-10-06 13:55:35 +02:00
  • 3329f7f391 [cherry-pick] fix(users): require sysadmin identity for grants (GHSA-w5fq-xrhj-j7g2) Vadim Bauer 2026-10-06 13:54:30 +02:00
  • f64ff7ec6f [cherry-pick] fix(registry): reject dot segments in /v2/ distribution paths (GHSA-qj39-pjf2-wmrc) Vadim Bauer 2026-10-06 13:53:09 +02:00
  • b323c0c8ec Merge commit from fork Vadim Bauer 2026-10-06 14:04:35 +02:00
  • f234c0cb68 Merge commit from fork Vadim Bauer 2026-10-06 14:03:35 +02:00
  • 0a9e68e6d5 Merge commit from fork Vadim Bauer 2026-10-06 14:02:35 +02:00
  • c38a9eb5d8 Merge commit from fork Vadim Bauer 2026-10-06 14:01:35 +02:00
  • 8d59dd5bba Merge commit from fork Vadim Bauer 2026-10-06 14:00:35 +02:00
  • d80de5b309 Merge commit from fork Vadim Bauer 2026-10-06 13:59:35 +02:00
  • d8a18f71b4 Merge commit from fork Vadim Bauer 2026-10-06 13:58:35 +02:00
  • 7894b309c3 Merge commit from fork Vadim Bauer 2026-10-06 13:57:35 +02:00
  • f5c89c7355 Merge commit from fork Vadim Bauer 2026-10-06 13:56:35 +02:00
  • 1ab096098a Merge commit from fork Vadim Bauer 2026-10-06 13:55:35 +02:00
  • 5d0c95721e Merge commit from fork Vadim Bauer 2026-10-06 13:54:30 +02:00
  • d57831f1df Merge commit from fork Vadim Bauer 2026-10-06 13:53:09 +02:00
  • 0629171560 chore(deps): bump js-yaml in /src/portal dependabot[bot] 2026-10-05 00:41:56 +00:00
  • 721c6d48d9 chore(deps-dev): bump stylelint from 14.16.1 to 17.15.0 in /src/portal (#23957) dependabot[bot] 2026-10-05 00:39:25 +00:00
  • 1f54a55a2b chore(deps): bump marked from 18.0.12 to 18.0.13 in /src/portal in the patch-updates group across 1 directory (#23952) dependabot[bot] 2026-10-04 21:54:46 +00:00
  • 3f56f04403 chore(deps-dev): bump https-proxy-agent from 5.0.1 to 9.1.0 in /src/portal (#23954) dependabot[bot] 2026-10-04 19:49:17 +00:00
  • 650a41e54f chore(deps): bump js-yaml from 4.3.1 to 5.4.2 in /src/portal dependabot/npm_and_yarn/src/portal/js-yaml-5.2.3 dependabot[bot] 2026-10-04 19:08:08 +00:00
  • 0ec73e0017 chore(deps): bump @angular/common from 21.2.13 to 21.2.25 in /src/portal dependabot/npm_and_yarn/src/portal/release-2.15.0/angular/common-22.1.1 dependabot[bot] 2026-10-04 19:06:10 +00:00
  • 35b6869bb6 Merge branch 'main' into dependabot/github_actions/docker/setup-buildx-action-4.4.1 Prasanth Baskar 2026-10-05 00:26:26 +05:30
  • e6bf68acc9 Merge branch 'release-2.15.0' into dependabot/npm_and_yarn/src/portal/release-2.15.0/clr/ui-18.3.0 dependabot/npm_and_yarn/src/portal/release-2.15.0/clr/ui-18.3.0 Prasanth Baskar 2026-10-05 00:23:33 +05:30
  • f25e9dafbf fix(gc): Use the current registry Redis URL for scheduled runs (#24037) Vadim Bauer 2026-10-01 08:14:38 +02:00