1 - Harbor Scanner Adapter Release Notes - Version 1.5.4
Harbor Scanner Adapter v1.5.4
This release changes how the adapter’s container image is published: release images are now tagged with a v prefix,
are built for both amd64 and arm64, and are based on a distroless image rather than Alpine. Existing deployments
need their image reference updated to pick the release up.
Announcements
Behavior Changes
Action required - update the adapter image reference in your deployment.
- Change the image from
anchore/harbor-scanner-adapter:1.5.3toanchore/harbor-scanner-adapter:v1.5.4. A bare1.5.4tag is not published, so a deployment that keeps the old naming will not find the new release and stays on the version it is running. - The image no longer contains a shell,
curl, or a package manager. Replace anyexechealth probe or troubleshooting step that shells into the adapter container with an HTTP request to the adapter’s listen address.
Release image tags now mirror the Git tag exactly:
| Release | Image tag |
|---|---|
| 1.5.3 and earlier | anchore/harbor-scanner-adapter:1.5.3 |
| 1.5.4 and later | anchore/harbor-scanner-adapter:v1.5.4 |
This brings the adapter in line with the tagging used by the other Anchore integrations. Previously published tags are unchanged and remain pullable, so a deployment pinned to an older version keeps working until you move it.
New Features
Multi-Architecture Release Images
Release images are now published as a multi-architecture manifest covering linux/amd64 and linux/arm64. Pulling
the release tag on an arm64 node, such as an AWS Graviton instance, now retrieves a native arm64 image instead of an
amd64 image that has to run under emulation. The same tag serves both architectures, so no configuration change is
needed beyond the tag update described above.
Improvements
- The adapter image is now built on a distroless static base instead of Alpine. It ships only the adapter binary and
the CA certificates the binary needs, which removes
curl,bash, and the package manager along with the vulnerability findings those packages carried. See Behavior Changes above if you currently exec into the container.
Fixes
- Addresses security advisories reported against the adapter image by updating
golang.org/x/netfrom v0.38.0 to v0.56.0 and the Go toolchain to 1.26.8. These clear denial-of-service and parsing defects in the networking libraries the adapter depends on. - Various AWS SDK and supporting package updates to improve security and performance.
Changelog
https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.5.4
2 - Harbor Scanner Adapter Release Notes - Version 1.5.3
Harbor Scanner Adapter v1.5.3
Fixes
- Various package updates to improve security and performance.
Changelog
https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.5.3
3 - Harbor Scanner Adapter Release Notes - Version 1.5.2
Harbor Scanner Adapter v1.5.2
Fixes
- Various package updates to improve security and performance.
Changelog
https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.5.2
4 - Harbor Scanner Adapter Release Notes - Version 1.5.1
Harbor Scanner Adapter v1.5.1
Fixes
- Various package updates to improve security and performance.
Changelog
https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.5.1
5 - Harbor Scanner Adapter Release Notes - Version 1.5.0
Harbor Scanner Adapter v1.5.0
Fixes
- Improved the error response time when the image analysis fails because the image is not able to be pulled by Anchore Enterprise.
- Various package updates to improve security and performance.
Changelog
https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.5.0
6 - Harbor Scanner Adapter Release Notes - Version 1.4.2
Harbor Scanner Adapter v1.4.2
Fixes
- Various package updates to improve security and performance.
Changelog
https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.4.2
7 - Harbor Scanner Adapter Release Notes - Version 1.4.1
Harbor Scanner Adapter v1.4.1
Fixes
The “Fixed in Version” field for vulnerabilities is no longer empty. The scanner adapter v1.4.1 now provides the information so that Harbor can display it.
Further details regarding the “Fixed in version” field of vulnerabilities in Harbor and what can be expected from the bug fix in v1.4.1:
When an image is scanned for vulnerabilities, Harbor stores the detected vulnerabilities in a database table. Bindings between the image and its vulnerabilities are stored in another database table.
If another scanned image has some vulnerability that already exists in the database, that image is also bound to that existing vulnerability. Even if the new scan provides some updated information (like fixed in version)about the vulnerability, the vulnerability info in the Harbor database is not updated.
This has the consequence that the “fixed in version” field may still be unpopulated even if harbor-scanner-adapter v1.4.1 provides that value.
Example:
Image A has vulnerabilities X and Y and is scanned in a deployment with harbor-scanner-adapter v1.4.0 (or earlier).
Result: Image A’s vulnerabilities X and Y will have an empty “fixed in version” value in Harbor.The same deployment is later updated to use harbor-scanner-adapter v.1.4.1. Image A is rescanned.
Result: Image A’s vulnerabilities X and Y will still have an empty “fixed in version” value in Harbor.
Image B, which has vulnerabilities X and Z, and is next scanned in Harbor.
Result: Image B’s vulnerability X will have an empty “fixed in version” value. Image B’s vulnerability Z will have “fixed in version” populated (if it had a non-empty value).
Changelog
https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.4.1