chore: release 2.16.0

[github-actions]

This PR prepares the next release based on conventional commits. On main, .release-please-manifest.json tracks the release version and VERSION is advanced to the following minor development target before the PR is merged.

2.16.0 (2026-07-24)

Features

• ci: Add Zero CVE Pipeline (#359) (d77262f)
• lint: Add Go Quality Linters (#325) (199d38d)

Bug Fixes

• Address upstream sync review feedback (63b3ab4)
• Address Upstream Sync Review Feedback (f071003)
• Address Upstream Sync Review Feedback (a01fa1f)
• Bound Proxy-Cache Background Goroutines To Prevent Leak (#257) (928b074)
• build: Stamp version metadata into trivy-adapter and Trivy binaries (#459) (044468c)
• Cache the Scannability Lookups Per Artifact-List Request (#212) (a88c02f)
• cache: Defer Cache Eviction Until After Commit And Make Retry Context-Aware (#300) (9094bc1)
• cache: replace keyMutex with singleflight and avoid canceling cache Save (upstream #23336) (#277) (aabfa40)
• constrain /registries/ping to saved registry settings (#398) (3e1cfb0)
• core: Prevent Core FD/Goroutine Leak When Registry Is Unresponsive (#254) (bc4d880)
• core: Reduce auth-failure log noise and skip basic auth for non-admin in OIDC/LDAP/UAA (#313) (3cbf0d1)
• Correct Committed Key Comment Grammar (#505) (ac924d9)
• Correct grammar and capitalization inconsistencies across Go source files and docs (9783d50)
• deps: Bump Harbor Scanner Trivy To v0.38.1 (#415) (825dc8c)
• deps: Remediate zero CVE findings (#467) (871bef7)
• deps: Resolve Non-UI CVEs (#374) (abef6af)
• Install gh CLI in release workflow (d5f0674)
• Invalid UTF-8 Input Should not Cause HTTP 500 Errors (#321) (a608686)
• ldap: Use custom orm.ReadOrCreate to prevent LDAP login failure (#323) (c5bc120)
• max_upstream_conn validation bugs (10d4e9d)
• nil deref in StopScanArtifact scan type param (a84d6a6)
• Point More Info Link to 8GCR (#293) (b5b0f16)
• Preserve categorized release notes (#215) (c0a8e97)
• propagate CSV marshal error in scan data export (02a70ac)
• Push Trivy Adapter Images Without Harbor Prefix (#227) (c2be7b7)
• release: Track Next Development Version On Main (#360) (ddeb4b7)
• Resolve Upstream Sync Review Inconsistencies (9765e4e)
• Restore 0171 Migration For Upstream 2.14.x Upgrade Path (#292) (6cb2c2d)
• Restore Buildable Trivy Adapter Pin (a5101ec)
• Restore Dev Up With Rootless Podman (#401) (715249d)
• Return 404 For Missing Repository Artifacts (#322) (57a480e)
• scan: Keep SBOM accessory push on the local registry when CORE_URL has no port (#465) (bf895ae)
• security: avoid audit event panic on nil user data (#402) (41a3cb8)
• ui: remove hardcoded SBOM permission override (4c512b5), closes #23218
• Update release-please-config-maintenance.json (aee4893)

Performance Improvements

• core: Avoid eager structured-logger build on demoted auth-failure logs (#317) (75efe4a)

Upstream

• 【fix issue 22865】TCR provider adaptor can't parse intertional secret ID (4793ab2)
• Add a size limit for manifest uploads (goharbor/harbor#23500) (#440) (481151b)
• Add ListReferrers API to registry client and update parseScopes (0ca3e92)
• Add UI option to enable proxy cache referrer API (b06a216)
• bump Go version from 1.25.7 to 1.26.3 (0815a33)
• Bump trivy to v0.71.1 and trivy adapter to v0.37.1-rc.1 (d2598a8)
• Call /v2/auth/token api to get bearer token for dockerhub adapter (ea94b88)
• chore: update Trivy adapter version to v0.37.1 (7f30d4b)
• feat(acr): add artifact to supported resource types (fc16df9)
• feat(audit): add member create/update/delete audit events (goharbor/harbor#23228) (#445) (ea6e8c6)
• feat(gc): use human-readable sizes in GC log messages (f0d055c)
• feat(session): prevent background polling from renewing session TTL (50ec668)
• Fix issue related to scanner API (c797f4b)
• fix: Add i18n keys and missing translations (09448d0)
• fix: add registry component to proxy configuration support (goharbor/harbor#23437) (#472) (f8c7c65)
• fix: address unsafe type assertions causing potential panics across packages (goharbor/harbor#23571) (#475) (c4e39be)
• fix: Bump repository update_time on tag and artifact changes (7038733)
• fix: correct max_upstream_conn validation and disabled bindings (10d4e9d)
• fix: Disallow Empty robot_name_prefix to prevent OIDC CLI login from being blocked (9ffb23b)
• fix: duplicated "by" in beego ORM TableName comments (2d8aa62)
• fix: enable chunked blob upload for Azure ACR replication (9df3210)
• fix: Fix potentional SQLi (edab6f8)
• fix: Fix theoretical timing vulnerability (goharbor/harbor#23433) (#378) (5a98797)
• fix: guard against division by zero when merging scan report summaries (goharbor/harbor#23572) (#476) (bb57ab7)
• fix: increase access_key column length to 4096 (759e29a)
• fix: propagate CSV marshal errors in scan data export (02a70ac)
• fix: skip corrupted encrypted config values on decryption failure (ffc35ca)
• fix: use validated scan type in StopScanArtifact (#367) (a84d6a6)
• fix(auditext): add nil guard in manager Create (ce27031)
• fix(cache): replace keyMutex with singleflight and avoid canceling cache (goharbor/harbor#23336) (#377) (90bab7a)
• fix(cnai-parser): enforce actual byte limit to prevent decompression (goharbor/harbor#23497) (#503) (3c47b6e)
• fix(dao): use context-aware methods for database operations in MetaDAO (cd6ddfe)
• fix(distribution): allow editing instance without credentials (d69e45e)
• fix(ecr): use amazonaws.com.cn domain for AWS China region endpoints (e3783d5)
• fix(gc): redact redis_url_reg from GC extra attrs (2bb39fc)
• fix(i18n): localize max upstream connection placeholder (d3de48e)
• fix(portal): remove temporary SBOM permission override (4c512b5)
• fix(replication): fix incorrect error propagation in getAccessoryArts (goharbor/harbor#23569) (#473) (2b876bc)
• fix(retention): avoid stripping repository path twice (goharbor/harbor#23546) (#470) (8a8a309)
• fix(scan): use created time from annotations in accessory art (eb98ccb)
• fix(security): validate blob-mount source project and reject tokens missing iat (728c685)
• fix(ui): Update bindings in Project Policy Config (c862a28)
• fix(ui): use selected tag for pull command copy (5613c0f)
• Fix/api completeness (goharbor/harbor#23476) (#432) (e912279)
• Harden crypto usage and drop unused SMTP package (069c28d)
• perf(blob): fix full table scan in unassociation check (6334975)
• perf(replication): filter event policies in query (63b7b89)
• refactor(config): centralize registry HTTP client timeout (4a0f675)
• refactor(task): use Redis SET with SPOP for outdate execution status … (594c228)
• Replace gopkg.in/yaml.v2 with github.com/goccy/go-yaml (62f6d94)
• Set blob response headers before streaming the body (goharbor/harbor#23374) (#498) (878d3bf)
• Update and improve zh-TW Traditional Chinese locale (1bed488)
• Update artifact_accessory to add source column to identify accessory (ac3a351)
• update ECR adapter to allow for ecr-public to be mirored (a3a52a7)
• Upgrade harbor go.mod OSS packages (efca784)

Code Refactoring

• task: use Redis SET with SPOP for outdate execution status refresh (594c228)

Documentation

• Adopt GitHub Private Vulnerability Reporting Workflow (#477) (90c135c)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Preview images for this PR are available in 8gears.container-registry.com/8gcr-pr with tag pr-268.

• 8gears.container-registry.com/8gcr-pr/harbor-core:pr-268
• 8gears.container-registry.com/8gcr-pr/harbor-jobservice:pr-268
• 8gears.container-registry.com/8gcr-pr/harbor-registryctl:pr-268
• 8gears.container-registry.com/8gcr-pr/harbor-exporter:pr-268
• 8gears.container-registry.com/8gcr-pr/harbor-portal:pr-268
• 8gears.container-registry.com/8gcr-pr/harbor-registry:pr-268
• 8gears.container-registry.com/8gcr-pr/trivy-adapter:pr-268

Verify a preview image:

cosign verify \
  --certificate-identity-regexp="https://github.com/container-registry/harbor-next/.github/workflows/pr-ci.yml@.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr-pr/harbor-core:pr-268

Verify SBOM attestation:

cosign verify-attestation \
  --certificate-identity-regexp="https://github.com/container-registry/harbor-next/.github/workflows/pr-ci.yml@.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr-pr/harbor-core:pr-268