Harbor Scanner Adapter Release Notes - Version 1.5.4

Harbor Scanner Adapter v1.5.4

This release changes how the adapter’s container image is published: release images are now tagged with a v prefix, are built for both amd64 and arm64, and are based on a distroless image rather than Alpine. Existing deployments need their image reference updated to pick the release up.

Announcements

Behavior Changes

Action required - update the adapter image reference in your deployment.

Change the image from anchore/harbor-scanner-adapter:1.5.3 to anchore/harbor-scanner-adapter:v1.5.4. A bare 1.5.4 tag is not published, so a deployment that keeps the old naming will not find the new release and stays on the version it is running.
The image no longer contains a shell, curl, or a package manager. Replace any exec health probe or troubleshooting step that shells into the adapter container with an HTTP request to the adapter’s listen address.

Release image tags now mirror the Git tag exactly:

Release	Image tag
1.5.3 and earlier	`anchore/harbor-scanner-adapter:1.5.3`
1.5.4 and later	`anchore/harbor-scanner-adapter:v1.5.4`

This brings the adapter in line with the tagging used by the other Anchore integrations. Previously published tags are unchanged and remain pullable, so a deployment pinned to an older version keeps working until you move it.

New Features

Multi-Architecture Release Images

Release images are now published as a multi-architecture manifest covering linux/amd64 and linux/arm64. Pulling the release tag on an arm64 node, such as an AWS Graviton instance, now retrieves a native arm64 image instead of an amd64 image that has to run under emulation. The same tag serves both architectures, so no configuration change is needed beyond the tag update described above.

Improvements

The adapter image is now built on a distroless static base instead of Alpine. It ships only the adapter binary and the CA certificates the binary needs, which removes curl, bash, and the package manager along with the vulnerability findings those packages carried. See Behavior Changes above if you currently exec into the container.

Fixes

Addresses security advisories reported against the adapter image by updating golang.org/x/net from v0.38.0 to v0.56.0 and the Go toolchain to 1.26.8. These clear denial-of-service and parsing defects in the networking libraries the adapter depends on.
Various AWS SDK and supporting package updates to improve security and performance.

Changelog

https://github.com/anchore/harbor-scanner-adapter/releases/tag/v1.5.4

Last modified September 14, 2026