Conversation
* bump golang to v1.26.7 Signed-off-by: stonezdj <stone.zhang@broadcom.com> * update .buildbaselog Signed-off-by: stonezdj <stone.zhang@broadcom.com> --------- Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Upgraded golang.org/x/net, golang.org/x/text, google.golang.org/grpc, and github.com/google/go-containerregistry to address High/Critical CVEs. Kept github.com/distribution/distribution unchanged. Signed-off-by: stonezdj <stone.zhang@broadcom.com>
…bor#23817) fix: system_cve testcase failing at end of month (cherry picked from commit 8f1af5a) Signed-off-by: Yannick Müller <mail@ynnk.dev> Co-authored-by: Yannick Müller <mail@ynnk.dev>
chore(deps): bump golang.org/x/crypto to v0.55.0 Upgraded golang.org/x/crypto to v0.55.0 and updated other transitively required golang.org/x dependencies (net, sync, sys, term, text) to resolve security vulnerabilities and align with upstream recommendations. Signed-off-by: stonezdj <stone.zhang@broadcom.com>
…rbor#23739) Bumps [express](https://github.com/expressjs/express) and [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express). These dependencies needed to be updated together. Updates `express` from 4.22.2 to 5.2.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@v4.22.2...v5.2.1) Updates `@types/express` from 4.17.25 to 5.0.6 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express) --- updated-dependencies: - dependency-name: "@types/express" dependency-version: 5.0.6 dependency-type: direct:development update-type: version-update:semver-major - dependency-name: express dependency-version: 5.2.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ages (goharbor#23822) fix: correct grammar and typos in user-facing error messages Fix misspellings, grammatical errors, and formatting defects in user-facing strings across API error responses and the portal English i18n. Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
…logs (goharbor#23865) Remove hardcoded credentials and prevernt passwords in logs (goharbor#23835) Remove hardcoded credentials and prevent passwords in logs Fixes goharbor#23834 Signed-off-by: jUDASmILE <judasmile@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
) fix: make hostname comparisons case-insensitive - Support case-insensitive host comparisons in registry auth, adapter, and v2auth middleware. - Parse and downcase the host part of URLs when verifying local Harbor instances. - Add comprehensive unit tests for isLocalHarbor. (cherry picked from commit 3d948a1) Signed-off-by: stonezdj <stone.zhang@broadcom.com>
bump REGISTRY_SRC_TAG to v2.8.3-harbor.2-rc.3 Signed-off-by: stonezdj <stone.zhang@broadcom.com>
…goharbor#23876) refactor(p2p): improve HTTP client request logging and credential string formatting (goharbor#23873) * refactor(p2p): improve HTTP client request logging and credential string formatting * Potential fix for pull request finding --------- Signed-off-by: jUDASmILE <judasmile@gmail.com> Signed-off-by: jUDASmILE <36983889+jUDASmILE@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Upgrade google.golang.org/grpc to v1.83.2 to address CVE-2026-84304 and CVE-2026-84445, and update golang.org/x/net and OpenTelemetry dependencies. Signed-off-by: stonezdj <stonezdj@gmail.com>
…e error messa… (goharbor#23886) refactor: sanitize connection details in logs and enhance error message formatting (goharbor#23878) * continue enhance log sanitation * continue enhance log sanitation --------- Signed-off-by: jUDASmILE <judasmile@gmail.com> Signed-off-by: jUDASmILE <36983889+jUDASmILE@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>
…t can update Go modules (release-2.15.0) (goharbor#23841) ci: Make go mod tidy work without generated swagger code so Dependabot can update Go modules Every Dependabot gomod job on main and on release-2.15.0 fails with "Dependabot can't resolve your Go dependency files". Dependabot runs `go mod tidy` on a plain checkout, and on a plain checkout the packages under src/server/v2.0/{models,restapi} do not exist yet: they are go-swagger output and are git-ignored. `go mod tidy` then reports, for `models`, `restapi` and each of the 38 `restapi/operations/<tag>` packages that src/server/v2.0/handler imports: go: github.com/goharbor/harbor/src/server/v2.0/handler imports github.com/goharbor/harbor/src/server/v2.0/restapi: module github.com/goharbor/harbor@latest found (v2.15.2+incompatible, replaced by ../), but does not contain package ... Dependabot turns that into a fatal, unrecoverable resolution error, so no Go module can be bumped at all. The tidy run cannot be skipped: today dependabot-core always runs `go mod tidy` for gomod updates, without the `-e` tolerance it used to pass, and the `replace github.com/goharbor/harbor => ../` directive is not stubbed out because the stubber only replaces relative paths that resolve outside the repository. There is no dependabot.yml option to disable it. Commit one placeholder file per generated package so the packages resolve before code generation has run: * src/server/v2.0/{models,restapi,...}/zz_generated_placeholder.go carries only the package clause and a comment. go-swagger never emits a file of that name, so generation leaves them alone. * The placeholder in `restapi` additionally blank-imports the nine external packages the generated code uses. Without that anchor a tidy run on a fresh checkout demotes go-openapi/{loads,spec,validate} to `// indirect` and prunes go.sum entries, because only generated code imports them directly. * .gitignore keeps ignoring the generated output, but level by level, because git cannot re-include a file whose parent directory is excluded. * The swagger_generate_server macro no longer wipes the two output directories wholesale. It fails with an explicit message if code generation produces a package that has no committed placeholder, or if a placeholder is left behind for a package go-swagger no longer generates. * `make go_check` gains a tidy_check step that runs `go mod tidy -diff` before gen_apis, on a tree that still has no generated code. A future change to the import set of the generated code therefore cannot silently stale the blank imports in the anchor file. * .golangci.yaml stops flagging the underscores in the scan_all, scan_data_export, system_cve_allowlist and project_metadata package names. Those names come from the swagger tags; the generated files are skipped as generated code, the placeholders are not. Verified that `go mod tidy` and `go list ./...` now succeed on a fresh checkout and leave go.mod and go.sum untouched, that a simulated Dependabot bump on a fresh checkout produces a correct minimal diff, that with generated code present `go build ./...`, `go vet ./...` and `golangci-lint run ./...` are unchanged, and that both new guards fail as intended when a placeholder is missing, orphaned, or out of date. The same problem exists on release-2.15.0 and needs a cherry-pick there for its Dependabot gomod entry to work. (cherry picked from commit d89036a) Signed-off-by: Vadim Bauer <vb@container-registry.com>
bump REGISTRY_SRC_TAG to v2.8.3-harbor.2-rc.5 Signed-off-by: stonezdj <stone.zhang@broadcom.com> Signed-off-by: stonezdj <stonezdj@gmail.com>
…oharbor#23887) fix: make endpoint handling and validation case-insensitive - Normalize host to lowercase in NormalizeAndValidateHTTPURL per RFC 1035 - Downcase host in ParseEndpoint for webhook targets and health checks - Downcase webhook target address host and rename validation to normalizeAndValidateTargets - Validate and normalize preheat endpoint prior to duplicate check - Add equalEndpoint utility for case-insensitive host matching in Angular UI - Support case-insensitive endpoint comparison in scanner and distribution forms - Add unit tests for endpoint normalization and mixed-case URL handling Signed-off-by: stonezdj <stonezdj@gmail.com> Co-authored-by: Wang Yan <wangyan_0219@hotmail.com>
…03174932-29230038a667 to 1.5.8 in /src (goharbor#23905) chore(deps): bump github.com/go-asn1-ber/asn1-ber in /src Bumps [github.com/go-asn1-ber/asn1-ber](https://github.com/go-asn1-ber/asn1-ber) from 1.5.8-0.20250403174932-29230038a667 to 1.5.8. - [Release notes](https://github.com/go-asn1-ber/asn1-ber/releases) - [Commits](https://github.com/go-asn1-ber/asn1-ber/commits/v1.5.8) --- updated-dependencies: - dependency-name: github.com/go-asn1-ber/asn1-ber dependency-version: 1.5.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… in /src (goharbor#23909) Signed-off-by: dependabot[bot] <support@github.com>
… patch-updates group across 1 directory (goharbor#23852) chore(deps): bump marked Bumps the patch-updates group with 1 update in the /src/portal directory: [marked](https://github.com/markedjs/marked). Updates `marked` from 18.0.9 to 18.0.12 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.0.9...v18.0.12) --- updated-dependencies: - dependency-name: marked dependency-version: 18.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…19 to 1.20.3 in /src (goharbor#23908) chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials in /src Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.19.19 to 1.20.3. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@credentials/v1.19.19...v1.20.3) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.20.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…harbor#23904) Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.22.0 to 0.23.0. - [Commits](golang/sync@v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…rc (goharbor#23902) Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.10.0 to 5.11.0. - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.10.0...v5.11.0) --- updated-dependencies: - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…pdates (goharbor#23844) Bumps the patch-updates group with 2 updates in the /src/portal/app-swagger-ui directory: [swagger-ui](https://github.com/swagger-api/swagger-ui) and [html-webpack-plugin](https://github.com/jantimon/html-webpack-plugin). Updates `swagger-ui` from 5.32.6 to 5.32.15 - [Release notes](https://github.com/swagger-api/swagger-ui/releases) - [Commits](swagger-api/swagger-ui@v5.32.6...v5.32.15) Updates `html-webpack-plugin` from 5.6.7 to 5.6.8 - [Release notes](https://github.com/jantimon/html-webpack-plugin/releases) - [Changelog](https://github.com/jantimon/html-webpack-plugin/blob/main/CHANGELOG.md) - [Commits](jantimon/html-webpack-plugin@v5.6.7...v5.6.8) --- updated-dependencies: - dependency-name: html-webpack-plugin dependency-version: 5.6.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: swagger-ui dependency-version: 5.32.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…rc/portal (goharbor#23740) * chore(deps-dev): bump karma-chrome-launcher in /src/portal Bumps [karma-chrome-launcher](https://github.com/karma-runner/karma-chrome-launcher) from 3.1.1 to 3.2.0. - [Release notes](https://github.com/karma-runner/karma-chrome-launcher/releases) - [Changelog](https://github.com/karma-runner/karma-chrome-launcher/blob/master/CHANGELOG.md) - [Commits](karma-runner/karma-chrome-launcher@v3.1.1...v3.2.0) --- updated-dependencies: - dependency-name: karma-chrome-launcher dependency-version: 3.2.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): restore yaml lockfile entry Signed-off-by: stonezdj <stonezdj@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: stonezdj <stonezdj@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: stonezdj <stonezdj@gmail.com>
…tes (goharbor#23898) Bumps the kubernetes group with 2 updates in the /src directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) and [k8s.io/client-go](https://github.com/kubernetes/client-go). Updates `k8s.io/apimachinery` from 0.36.1 to 0.37.0 - [Commits](kubernetes/apimachinery@v0.36.1...v0.37.0) Updates `k8s.io/client-go` from 0.36.1 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.1...v0.37.0) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: kubernetes ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prasanth Baskar <prasanth@8gears.com>
…app-swagger-ui (goharbor#23849) chore(deps-dev): bump webpack in /src/portal/app-swagger-ui Bumps [webpack](https://github.com/webpack/webpack) from 5.107.2 to 5.110.3. - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.107.2...v5.110.3) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.110.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Prasanth Baskar <prasanth@8gears.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thank you for contributing to Harbor!
Comprehensive Summary of your change
Issue being fixed
Fixes #(issue)
Please indicate you've done the following: