> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/release-notes/artifact-registry.md).

# Artifact Registry release notes

The release notes describe recent changes to Harness Artifact Registry.

{% hint style="info" %}
**ABOUT HARNESS RELEASE NOTES**

* **Security advisories:** Harness publishes security advisories for every release. Go to the [Harness Trust Center](https://trust.harness.io/?itemUid=c41ff7d5-98e7-4d79-9594-fd8ef93a2838\&source=documents_card) to request access to the security advisories.
* **More release notes:** Go to [Harness Release Notes](/release-notes/readme.md) to explore all Harness release notes, including module, delegate, and Self-Managed Enterprise Edition release notes.
  {% endhint %}

### 📌 Release Deployment Status by Cluster <a href="#release-deployment-status-by-cluster" id="release-deployment-status-by-cluster"></a>

**Progressive deployment:** Harness deploys changes to Harness SaaS clusters on a progressive basis. This means that the features described in these release notes may not be immediately available in your cluster. To identify the cluster that hosts your account, go to your **Account Overview** page in Harness. In the new UI, go to **Account Settings**, **Account Details**, **General**, **Account Details**, and then **Platform Service Versions**.

### August 2026 <a href="#august-2026" id="august-2026"></a>

#### 2026.8.v1 <a href="#id-20268v1" id="id-20268v1"></a>

**New Features**

**Terraform Registry Support**

Harness Artifact Registry now supports Terraform modules and providers that are compatible with the Terraform Registry Protocol. Host private modules and providers inside your Harness account and reference them directly from your Terraform configurations.

Go to the [Terraform Registry Quickstart](https://developer.harness.io/artifact-registry/new-to-artifact-registry/quickstart/terraform-quickstart) to set up a Terraform registry and publish your first module or provider.

**RubyGems Registry Support**

Harness Artifact Registry now supports RubyGems and is compatible with the gem CLI and Bundler. Host private Ruby gems inside your Harness account and install them with standard gem and bundle workflows.

Go to the [RubyGems Registry Quickstart](https://developer.harness.io/artifact-registry/new-to-artifact-registry/quickstart/rubygems-quickstart) to set up a RubyGems registry and publish your first gem.

**R (CRAN) Registry Support**

Harness Artifact Registry now supports R packages in the CRAN repository format. Host private R packages inside your Harness account and install them with standard R package tools.

Go to the [R (CRAN) Registry Quickstart](https://developer.harness.io/artifact-registry/new-to-artifact-registry/quickstart/r-cran-quickstart) to set up an R (CRAN) registry and publish your first package.

**Enhancements & Fixes**

**Explicit architecture indexing for Debian registries**

The Debian registry configuration UI now gives you direct control over architecture indexing. Choose which CPU architectures (for example, amd64, arm64) to index, rather than indexing every available architecture by default.

**Support for Artifact Storage in GCS in addition to Cloudflare R2**

Harness Artifact Registry now stores all artifact data with multiple object storage backends for additional reliability and resiliency improvements. Customers may need to whitelist an additional endpoint to allow artifact pulls from GCS.

***

### July 2026 <a href="#july-2026" id="july-2026"></a>

#### 2026.7.v2 <a href="#id-20267v2" id="id-20267v2"></a>

**New Features**

**Debian Registry Support**

Harness Artifact Registry now supports **Debian packages** for Debian and Ubuntu systems. Host private `.deb` packages, configure upstream proxies against external Debian mirrors, and install packages with standard APT workflows.

Go to the [Debian quickstart](/artifact-registry/new-to-artifact-registry/quickstart/debian-quickstart.md) to create a Debian registry and publish your first package.

**Raw File artifacts for WinRM CD deployments**

Harness Continuous Delivery now supports **Raw File** artifacts from Harness Artifact Registry as a service artifact source for **WinRM** deployments. Deploy `.zip` packages and other files stored in a Raw File registry to Windows targets without a third-party artifact connector.

Go to [Use artifacts from Harness Artifact Registry](/continuous-delivery/use-continuous-delivery/cd-building-blocks/services/artifact-sources.md#harness-artifact-registry) to configure a Raw File artifact source, or go to the [WinRM tutorial](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/traditional/win-rm-tutorial.md) for a full deployment walkthrough.

**Enhancements & Fixes**

**Dependency Firewall audit from manifest files**

The Harness CLI `hc registry fw audit` command now supports auditing dependencies from `package.json` without a lock file in source control. Pass `package.json` to evaluate direct dependencies only, or generate a lock file in CI for a full transitive audit with `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`.

Go to [Audit dependencies with Dependency Firewall](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md#audit-dependencies-with-dependency-firewall) for input file scope and examples.

**Webhooks for RPM registries**

Artifact Creation and Artifact Deletion webhook events now fire for **RPM** registries. Webhooks are supported for all Artifact Registry package types other than **Raw**.

Go to [Webhooks](/artifact-registry/use-artifact-registry/manage-registries/ar-webhooks.md) to configure triggers.

#### 2026.7.v1 <a href="#id-20267v1" id="id-20267v1"></a>

**New Features**

**Helm HTTP registry type**

Host and consume Helm charts with the classic `helm repo add` / `helm pull` workflow with a new **Helm HTTP** registry type. Unlike the existing Helm OCI registry, Helm HTTP uses the HTTP-based Helm chart repository protocol (`index.yaml` + `.tgz` archives) and supports upstream proxy pull-through for public Helm repositories.

Go to [Helm HTTP quickstart](/artifact-registry/new-to-artifact-registry/quickstart/helm-http-quickstart.md) to create your first Helm HTTP registry.

**Native Harness Artifact Registry for CD Run steps in Containerized Step Groups**

CD Run steps inside a Step Group with **container based execution** enabled can now reference container images from Harness Artifact Registry natively, without a Docker connector. In the Run step, set **Registry Type** to **Artifact Registry**, select your registry in **Container Registry**, and enter the image reference in **Image**. To pull from an external Docker registry through a Harness Docker connector instead, choose **Third-Party Artifact Registry**.

Go to [Add a Run step inside a Containerized Step Group](/artifact-registry/use-artifact-registry/platform-integrations/cd-ar-integrations.md#add-a-run-step-inside-a-containerized-step-group) to walk through the setup.

***

### June 2026 <a href="#june-2026" id="june-2026"></a>

#### 2026.6.v1 <a href="#id-20266v1" id="id-20266v1"></a>

**New Features**

**Lifecycle Rules (Cleanup and Retention)**

{% hint style="info" %}
**FEATURE FLAG**

This feature is behind the feature flag `HAR_ARTIFACT_LIFECYCLE_POLICY`. Contact [Harness Support](mailto:support@harness.io) to enable it.
{% endhint %}

Lifecycle rules bring policy-based artifact management to Harness Artifact Registry. Define rules that automatically identify and soft-delete stale artifact versions on a recurring schedule, so your registries stay lean without manual cleanup.

<figure><img src="/files/00BOchQK7hQQuPbHfuY2" alt="Lifecycle Rules list view showing cleanup and retention rules with status, scope, and attached registries"><figcaption><p>Lifecycle Rules: manage cleanup and retention policies from a single view</p></figcaption></figure>

**Key capabilities:**

* **Cleanup rules:** Soft-delete versions that match your criteria (age, version count, or name pattern). Deleted artifacts remain recoverable during the configured recovery period.
* **Retention rules:** Protect matching artifacts from all deletion, including cleanup rules, manual soft delete, and manual hard delete. Retention rules are always evaluated first, overriding any deletion attempt.
* **Hierarchical scoping:** Create rules at the account, organization, or project level and attach them to one or more registries.
* **Dry-run mode:** Preview which versions a rule would affect before you enable it, so you can validate criteria safely.
* **Execution history:** Track every run with detailed logs showing which versions were deleted and which were retained.
* **Notification integration:** Fire centralised notification events when a cleanup rule or dry run finishes executing.

Go to [Lifecycle Rules](/artifact-registry/use-artifact-registry/lifecycle-rules.md) to understand how rules work. To start creating rules, go to [Create a cleanup rule](/artifact-registry/use-artifact-registry/lifecycle-rules/create-cleanup-rule.md) or [Create a retention rule](/artifact-registry/use-artifact-registry/lifecycle-rules/create-retention-rule.md).

**Centralised Notifications for Artifact Registry**

Centralised Notifications now support Artifact Registry events. Configure notification rules at the organization level that apply to every project under the organizations you select, with no per-registry setup required.

Available events: Dependency Firewall Exemption Requested, Dependency Firewall Exemption Status Changed, Lifecycle Policy Execution Completed, and Lifecycle Policy Dry Run Execution Completed.

Go to [Centralised Notification](/harness-ai/use-harness-platform/notifications-alerts-and-banners/notifications/centralised-notification.md#artifact-registry-notifications) to configure notification rules for Artifact Registry events.

**Puppet Registry Support**

Harness Artifact Registry now supports **Puppet modules** with full Puppet Forge compatibility. Publish with the Puppet CLI or `r10k`, host private modules inside your Harness account, and cache modules from external Puppet Forge sources through an upstream proxy.

Go to the [Puppet Registry Quickstart](/artifact-registry/new-to-artifact-registry/quickstart.md#puppet) to set up a Puppet registry and publish your first module.

***

### May 2026 <a href="#may-2026" id="may-2026"></a>

#### 2026.5.v1 <a href="#id-20265v1" id="id-20265v1"></a>

**New Features**

**Dependency Firewall Exemptions**

Request temporary access to blocked package versions through an approval workflow. A developer files a request with a business justification, an approver reviews it, and on approval the version becomes usable for a fixed duration. After expiry, the original policy verdict applies again. Centralized notification rules are available for exemption events.

Go to [Dependency Exemptions](/artifact-registry/use-artifact-registry/dependency-firewall/exemptions.md) to set up the workflow.

**Quarantine artifacts on Warning verdict**

A new checkbox on the upstream proxy configuration quarantines artifacts whose policy verdict is Warning (in addition to Blocked). Warning artifacts are cached but blocked until an administrator releases them from quarantine using the quarantine management UI. Exemptions do not apply to quarantined packages.

Go to [Enable Dependency Firewall](/artifact-registry/use-artifact-registry/manage-registries/configure-registry.md#enable-dependency-firewall) to configure this option.

**OSS Risk Level and Malicious Package policy templates**

Two new built-in Dependency Firewall policy templates:

* **OSS Risk Level:** Blocks artifacts that exceed a configured open-source risk threshold, factoring in maintenance status, known vulnerabilities, and community health.
* **Malicious Package:** Blocks any artifact version flagged as malicious in threat intelligence databases.

These join the existing CVSS Threshold, License Policy, and Package Age templates. Go to [Configure Policies and Policy Sets](/artifact-registry/use-artifact-registry/dependency-firewall/configure-policies.md) to use them.

**Enhancements & Fixes**

**CLI bulk artifact deletion**

The Harness CLI now supports bulk deletion with wildcard patterns (for example, `1.0.*`) and dry-run preview. Supported for Generic, Maven, npm, Python, NuGet, Go, Conda, Composer, Swift, and Dart registries. Go to [Delete Artifacts](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md#delete-artifacts) to use bulk delete.

**Webhooks for upstream proxy registries**

Artifact Creation and Artifact Deletion webhook events now fire for upstream proxy registries. When a package is cached from an external source, the creation event fires. Supported for Docker, Maven, npm, Python, and NuGet upstream proxies. Cosign signature (`.sig`) and attestation (`.att`) artifacts are automatically filtered out. *\[AH-3516, AH-3943]*

Go to [Webhooks](/artifact-registry/use-artifact-registry/manage-registries/ar-webhooks.md) to configure triggers.

***

### April 2026 <a href="#april-2026" id="april-2026"></a>

#### 2026.4.v1 <a href="#id-20264v1" id="id-20264v1"></a>

**New Features**

**Swift Registry Support**

Harness Artifact Registry now supports **Swift packages** with full Swift Package Manager (SwiftPM) compatibility. Use the registry URL with `swift package-registry` for authentication, publishing, and dependency resolution. Your existing SwiftPM workflows keep working with Harness as the source of truth.

**Key benefits:**

* **Native SwiftPM workflow:** Compatible with `swift package-registry` commands (login, publish, resolve) on Swift 5.9 or later.
* **Private package hosting:** Host proprietary Swift packages securely inside your Harness account.
* **Upstream proxy support:** Cache packages from external Swift sources to accelerate builds and reduce external dependencies.

Go to the [Swift Registry Quickstart](/artifact-registry/new-to-artifact-registry/quickstart.md#swift) to set up a Swift registry and publish your first package.

**Raw File Registry Support**

The new **Raw File registry** lets you store and retrieve arbitrary files by path: archives, reports, configuration files, or anything else that does not belong to a package manager ecosystem. You upload, download, inspect, and delete files using HTTP requests and `curl`, with no specialized client required.

**Key benefits:**

* **Path-based storage:** Address files directly by their path, ideal for build artifacts, reports, and shared configs.
* **HTTP-native workflow:** Push and pull files with `curl` or any HTTP client; no custom CLI plugin required.
* **Upstream proxy support:** Optionally cache files from an external HTTP source through Harness.

Go to the [Raw File Registry Quickstart](/artifact-registry/new-to-artifact-registry/quickstart.md#raw-file) to create a Raw File registry and upload your first file.

**Copy Version between Registries**

You can now copy a specific package version from one Harness registry to another directly from the UI, with no need to re-push from your machine when promoting a version into another project or organization.

<figure><img src="/files/TEu3S4OwLmd9CcVB3g6l" alt="npm package Versions tab with the row menu open showing Copy Version among the actions"><figcaption><p>Versions tab: use the row menu and select Copy Version</p></figcaption></figure>

Open the package, switch to the **Versions** tab, open the row menu (**⋮**) on the version you want, and select **Copy Version**. Pick the target organization, project, and registry in the dialog, then run the copy. Permissions: read on the source registry, write on the target. The same operation is available from the CLI for automation.

Go to [Copy a version](/artifact-registry/use-artifact-registry/manage-artifacts/artifact-management.md#copy-a-version) to use the UI flow, or [Copy artifacts in the Harness CLI](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md#copy-artifacts) to run the same operation from the command line.

**Soft Delete for Artifacts and Versions**

{% hint style="info" %}
**FEATURE FLAG**

This feature is behind the feature flag `HAR_SOFT_DELETE_SUPPORT`. Contact [Harness Support](mailto:support@harness.io) to enable it.
{% endhint %}

Deleting a package or a version is now **soft by default**. Deleted items move to a **Deleted** view where they remain recoverable until the retention window allows them to be purged. You can also opt in to a permanent delete from the same dialog when that is what you intend.

<figure><img src="/files/Q8WAXg4NXvM2XBOOZy3n" alt="Artifacts page Deleted tab listing soft-deleted packages, versions, and related rows"><figcaption><p>Artifacts → Deleted tab: soft-deleted items remain recoverable</p></figcaption></figure>

**Key capabilities:**

* **Recoverable deletes:** Restore a package or version from the **Deleted** tab or the row menu, including content from a soft-deleted registry.
* **Cascade on registry delete:** Soft-deleting a registry soft-deletes all packages, images, and versions inside it; restoring a child can restore the parent registry.
* **Configurable retention:** Account administrators set the retention window in **Default Settings → Artifact Registry**; the value applies across the account, organization, or project.
* **Permanent delete still available:** Select **Permanently delete** in the confirmation dialog when you want immediate, non-recoverable removal.

Go to [Delete Artifacts](/artifact-registry/use-artifact-registry/manage-artifacts/soft-delete.md) to learn the soft-delete and restore flow, and [Delete a Registry](/artifact-registry/use-artifact-registry/manage-registries/delete-registry.md) to understand the cascade behavior.

**Artifact Registry Audit Dashboard**

The new **Artifact Registry Audit Dashboard** is an out-of-the-box dashboard in Harness Dashboards that records every artifact **upload** and **download** across your Harness Artifact Registries. It is provisioned and maintained by Harness, so it appears automatically for accounts that have Artifact Registry enabled — no setup, no widgets to build.

<figure><img src="/files/SvOmZZWDXDb914cKGI0b" alt="Artifact Registry Audit Dashboard with Time Range and identifier filters at the top, two event tables for downloads and uploads, an upload-and-download activity line chart, and an Upload/Download Aggregation donut"><figcaption><p>Artifact Registry Audit Dashboard</p></figcaption></figure>

**Key capabilities:**

* **Built for security and compliance:** Identify which users or service accounts pulled a specific package version after a CVE or zero-day disclosure, and audit upload activity on a registry over a chosen time window.
* **Filter by scope and artifact:** Narrow results by **Time Range**, **Organization Identifier**, **Project Identifier**, **Registry Name**, **Package Name**, and **Version Name**. Every widget on the page reacts to the filter set.
* **Four widgets out of the box:** **Download Artifact Data** and **Upload Artifact Data** event tables (Action, Registry, Package, Version, Username, Client IP, Timestamp Hour), an **Upload And Download Activity** time series, and an **Upload/Download Aggregation** donut.
* **Read-only and clone-friendly:** The original is owned by Harness and stays read-only so it keeps receiving updates. To customize widgets or filters, open the row menu and choose **Clone**; the clone belongs to your account and is fully editable.

Go to [Artifact Registry audit dashboard](/artifact-registry/use-artifact-registry/manage-artifacts/audit-dashboard.md) to open the dashboard and walk through the upload-and-download workflows.

**Enhancements & Fixes**

**Webhook support extended to Python, Maven, and NuGet**

Artifact Registry **webhooks** now cover additional package types so more teams can drive CI/CD, security, and notification workflows from artifact events. The supported list now includes **Maven, NuGet, and Python (PyPI)**.

Go to [Webhooks](/artifact-registry/use-artifact-registry/manage-registries/ar-webhooks.md) to view the full support table and to wire webhooks to triggers.

### March 2026 <a href="#march-2026" id="march-2026"></a>

#### 2026.3.v1 <a href="#id-20263v1" id="id-20263v1"></a>

**New Features**

**Maven plugin for Artifact Registry**

The **Harness Maven plugin** (`io.harness.maven:harness-maven-plugin`) lets you publish JARs, WARs, POMs, and related artifacts from your Maven build—no one-off scripts or manual uploads. It fits the standard Maven lifecycle, supports **parallel-friendly deployments** for multi-module projects, and can **enforce dependency resolution through Harness upstream proxies** so builds pull through the registries you govern.

* **Deploy from Maven**: Bind the `deploy` goal and push artifacts to Harness using the same coordinates and repositories your teams already use.
* **Credentials via environment variables**: Keep tokens out of `pom.xml` by configuring Harness registry URL and identity token through environment variables in CI and local workflows.

Learn more in the [Build plugins overview](/artifact-registry/use-artifact-registry/overview.md); open the **Maven Plugin** tab there for installation and configuration.

**Gradle plugin for Artifact Registry**

The **Harness Gradle plugin** (`io.harness.gradle`) hooks into `./gradlew publish`: Harness uploads artifacts to Artifact Registry in **parallel** for faster multi-module builds and reads **registry URL and credentials from environment variables** so secrets stay out of Gradle scripts and source control.

* **Drop-in Gradle workflow**: Apply the plugin in the root or subprojects and keep using your existing publish tasks.
* **Built for CI**: Matches how Gradle projects already inject registry configuration in pipelines.

Learn more in the [Build plugins overview](/artifact-registry/use-artifact-registry/overview.md); open the **Gradle Plugin** tab there for installation and configuration.

### February 2026 <a href="#february-2026" id="february-2026"></a>

#### 2026.2.v1 <a href="#id-20262v1" id="id-20262v1"></a>

**New Features**

**Dependency Firewall**

We're excited to ship **Dependency Firewall** in Harness Artifact Registry—a major step forward for software supply chain security. Until now, risky or non-compliant packages could flow into your organization through upstream proxies with little gatekeeping at the registry boundary. Dependency Firewall changes that: it evaluates **every** artifact version pulled from an external source **before** it is cached in your upstream proxy registry, using the same [Policy as Code](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md) and OPA-style policies you already trust elsewhere in Harness.

* **Policy at the front door:** CVSS thresholds, license rules, package age, and custom Rego policies can allow, warn on, or block versions automatically—so violations are caught when dependencies are first fetched, not after they have spread across builds.
* **Clear outcomes:** Each evaluation is **Passed**, **Warning**, or **Blocked**. In **Block** mode, non-compliant versions are never cached and cannot be downloaded or used; **Warn** mode helps you roll out policies safely while you refine rules.
* **Built for operators:** Enable the firewall on your upstream proxy, attach policy sets, pick **Block** or **Warn**, and track everything from the **Dependency Firewall** tab—no separate toolchain required.

![Dependency Firewall tab: dashboard summaries and evaluated package list](/files/4q7mlvokHQbzvYLlAz5O)

{% hint style="info" %}
**FEATURE FLAG**

Dependency Firewall is behind the feature flag `HAR_DEPENDENCY_FIREWALL`. Contact [Harness Support](mailto:support@harness.io) to enable it.
{% endhint %}

Learn more in the [Dependency Firewall overview](/artifact-registry/use-artifact-registry/dependency-firewall.md), [enable Dependency Firewall](/artifact-registry/use-artifact-registry/manage-registries/configure-registry.md#enable-dependency-firewall) in registry configuration, [configure policies and policy sets](/artifact-registry/use-artifact-registry/dependency-firewall/configure-policies.md), and the tutorial [Implement Dependency Firewall with OPA policies](/artifact-registry/troubleshooting-and-resources/tutorials/dependency-firewall-opa-policies.md).

**Python registry: Poetry and uv**

Harness Python registries now document first-class workflows for [**Poetry**](https://python-poetry.org/) and [**uv**](https://docs.astral.sh/uv/)—including publishing, installing, and authenticating with identity tokens—alongside existing **pip** instructions. Use the same `pkg.harness.io` endpoints and tokens as for pip; Poetry and uv integrate through explicit sources, `pyproject.toml`, and lockfiles your teams may already use.

Follow the **poetry** and **uv** tabs in the embedded guide on [Get started with Artifact Registry](/artifact-registry/new-to-artifact-registry/quickstart.md) (select **Python** in the format selector) for copy-ready commands.

**Enhancements & Fixes**

**Harness CLI: Dependency Firewall audit, explain, and npm client configuration**

The Harness CLI (`hc`) streamlines Artifact Registry operations for security and local client setup:

* **`hc registry fw audit`** (alias `hc registry firewall audit`): Parse lock and manifest files and evaluate dependencies in bulk against Dependency Firewall policies. Supported inputs include NPM, Java (Maven and Gradle), and **Python** files such as `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, and **`poetry.lock`**.
* **`hc registry fw explain`**: Return firewall scan status (**Passed**, **BLOCKED**, or **WARN**) and details for a specific package version already present in a registry.
* **`hc registry configure npm`**: Write Harness registry URLs and authentication into `.npmrc` for default, scoped, global, or project-level npm configuration.

Learn more in [Manage artifacts and registries with the CLI](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md): [Audit dependencies from lock files](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md#audit-dependencies-from-lock-files), [Get firewall status for an artifact version](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md#get-firewall-status-for-an-artifact-version), and [Configure npm client](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md#configure-npm-client).

### January 2026 <a href="#january-2026" id="january-2026"></a>

#### 2026.1.v1 <a href="#id-20261v1" id="id-20261v1"></a>

**New Features**

**Artifact Download from UI**

Harness Artifact Registry now supports downloading artifacts directly from the UI. You can download all versions of an artifact, specific versions, or individual files. The system prepares your download as a compressed archive and displays a status indicator at the bottom center of the page. Once ready, downloads remain available for 24 hours.

![](/files/KeuygJZivei4PCCRT28D)

This feature works seamlessly with Docker digests and all supported artifact types, making it easy to retrieve artifacts for offline use, backup, or distribution.

Learn more about [downloading artifacts from the UI](/artifact-registry/use-artifact-registry/manage-artifacts/artifact-management.md#download-an-artifact).

**Native CI Integration for Artifact Upload**

We've introduced a new **native Upload Artifact to Harness Artifact Registry step** in Harness CI pipelines, making it easier than ever to publish build artifacts directly to Harness Artifact Registry without custom scripts or third-party plugins.

**What's new:**

* **Built-in CI step**: New "Upload Artifacts to Harness Artifact Registry" step available in all CI pipelines
* **Multi-format (non-OCI) support**: Upload artifacts in formats such as Maven JARs, npm packages, Python wheels, Conda packages, Generic artifacts, and more

This native integration streamlines your CI/CD workflows by eliminating the need for custom scripts and manual authentication setup. Simply add the step to your pipeline, configure your target registry, and let Harness handle the rest.

Learn more about the [native CI integration for Artifact Registry](/artifact-registry/use-artifact-registry/platform-integrations/ci-ar-integrations.md).

**Enhancements & Fixes**

**Enhanced CLI Capabilities for Artifact Registry**

The Harness CLI (`hc`) now includes expanded functionality for managing artifacts and registries:

* **Metadata Management**: Set, get, and delete custom metadata on registries, packages, and specific versions. Use metadata for tagging environments, tracking ownership, managing approval workflows, and maintaining compliance information.
* **Artifact Copy**: Copy specific versions of artifacts between registries within your Harness Artifact Registry, with support for artifact type specification (e.g., model, dataset).
* **Artifact Version Delete**: Delete specific versions of artifacts or all versions of an artifact. This provides granular control over artifact lifecycle management.
* **Registry Delete**: Remove entire registries from your projects through the CLI.
* **Python and NuGet Support**: Manage Python (PyPI) and NuGet packages directly from the command line.

These enhancements provide a consistent CLI experience across all supported registry types, making it easier for development teams to integrate Harness Artifact Registry into their existing workflows and automation pipelines.

Learn more about [managing artifacts and registries with the CLI](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md).

### December 2025 <a href="#december-2025" id="december-2025"></a>

#### 2025.12.v1 <a href="#id-202512v1" id="id-202512v1"></a>

**New Features**

**PHP Composer Registry Support**

Harness Artifact Registry now supports PHP Composer packages, providing a secure, private registry for your PHP dependencies. You can store, manage, and distribute Composer packages directly within Harness with full compatibility with the Composer package manager.

**Key benefits:**

* **Private package hosting**: Host your proprietary PHP libraries and internal packages securely
* **Upstream proxy support**: Cache packages from Packagist and other public repositories to accelerate builds and reduce external dependencies
* **Version management**: Full support for semantic versioning and package constraints

To learn more about how to use Harness Artifact Registry with PHP Composer, check out our [Composer Registry documentation](/artifact-registry/new-to-artifact-registry/quickstart.md#composer).

**Enhancements & Fixes**

**Python PyPI Upstream Proxy Enhancements**

Python PyPI upstream proxy configuration now supports specifying a custom registry suffix for non-standard PyPI endpoints. This allows platform teams to integrate private PyPI repositories and enterprise artifact managers such as Artifactory, Nexus, or self-hosted PyPI mirrors that do not expose packages under the default `/simple/` path.

You can configure a remote registry URL, optionally define a custom registry suffix, and choose the appropriate authentication method. Harness transparently proxies Python packages from these upstream registries while handling authentication and package resolution.

### November 2025 <a href="#november-2025" id="november-2025"></a>

#### 2025.11.v2 <a href="#id-202511v2" id="id-202511v2"></a>

**New Features**

**Metadata Support for Artifacts and Registries**

Now enhance your artifact management with custom metadata! You can now attach key-value pairs to registries, artifacts, and packages, enabling better organization, searchability, and governance across your artifact ecosystem.

**Key capabilities:**

* **Multi-level metadata**: Add metadata at registry, artifact, and package (version) levels
* **Flexible filtering**: Search and filter artifacts using custom metadata attributes
* **Custom attributes**: Track ownership, environment tags, build information, security classifications, and more
* **Enhanced governance**: Maintain audit trails and compliance information with version-specific metadata

{% hint style="info" %}
This feature is currently behind the feature flag `HAR_CUSTOM_METADATA_ENABLED`. Contact Harness Support to enable it.
{% endhint %}

To learn more about how to use Harness Artifact Registry to store and manage artifacts with custom metadata, check out our [Metadata Support for Artifacts and Registries](/artifact-registry/use-artifact-registry/metadate-registry.md)

**Dart Registry Support**

Harness Artifact Registry now supports Dart packages with full pub.dev compatibility. You can store, manage, and distribute Dart packages directly within Harness, with complete support for versions, metadata, and immutable release behaviour.

**Key benefits:**

* **Secure, private Dart registry**: Provides a dedicated, secure registry for all your teams' Dart packages
* **Immutable versions**: Ensures immutable package versions matching pub.dev behaviour for safe, predictable builds
* **Accelerated CI/CD**: Speeds up builds by caching remote dependencies via upstream proxy, reducing external dependencies and improving reliability

To learn more about how to use Harness Artifact Registry to store and manage Dart packages, check out our [Dart Registry Quickstart guide](/artifact-registry/new-to-artifact-registry/quickstart.md#dart).

**Enhancements & Fixes**

**Download Button for Non-OCI Artifacts**

You can now directly download any non-OCI artifact (Maven, npm, PyPI, Generic, Conda, Helm charts, etc.) from the Artifact Registry UI with a single click. Until now, retrieving individual files or packages required using CLI commands or configuring a package manager client. For many workflows: debugging, validation, quick inspections, and offline analysis, users simply want to grab the file instantly.

#### 2025.11.v1 <a href="#id-202511v1" id="id-202511v1"></a>

**New Features**

**Artifact Registry management via CLI**

We're thrilled to introduce comprehensive CLI support for Artifact Registry management through the new Harness CLI v1.0.0 (`hc`)! This powerful addition brings the full capabilities of Artifact Registry directly to your terminal, enabling seamless automation and developer-friendly workflows.

<figure><img src="/files/YcSSNP6rqgbwj7kaxBaG" alt="Registry List"><figcaption><p>Click to view full size image</p></figcaption></figure>

**What's new:**

* **Registry Management**: List, view, and manage your registries with intuitive commands like `hc registry list` and `hc registry get`
* **Artifact Operations**: Push, pull, and list artifacts across all your registries using `hc artifact` commands
* **Developer-Friendly Aliases**: Save time with short commands - use `hc reg` instead of `hc registry` and `hc art` instead of `hc artifact`
* **Flexible Output Formats**: Get results in JSON, YAML, or table format for easy parsing in scripts and automation pipelines
* **Cross-Project Support**: Work seamlessly across multiple projects with global flags like `--project` and `--org`

Install the new Harness CLI v1.0.0 (`hc`) and authenticate to your account to start managing your registries and artifacts from the command line. Check out our [CLI documentation](/artifact-registry/use-artifact-registry/artifact-registry-cli/manage-artifacts-registries.md) for detailed examples and best practices.

**Conda Registry Support**

We have added a new registry type, Conda Registry support, for Python and R package management.

**Key capabilities:**

* **Native Conda client support**: Works with `conda` and `mamba` out of the box
* **Bioconda upstream proxy**: Automatically configured to fall back to Bioconda's public repository, giving you access to thousands of packages
* **Hybrid package management**: Host your private packages while proxying public ones from Bioconda
* **Channel organization**: Organize packages into channels for better version control and distribution

Configure your Conda client to point to your Harness registry, and you're ready to go - private packages are served directly while public packages are fetched from Bioconda automatically (If some custom source is not configured).

Do refer to [Conda Registry Quickstart](/artifact-registry/new-to-artifact-registry/quickstart.md#conda) for more details.

**Enhancements & Fixes**

**Upstream Proxy to aggregate multiple Artifact Registries**

We have enhanced our Artifact Registry experience by allowing it to be configured as an upstream proxy, enabling you to aggregate multiple registries into a single, unified access point. Use any Harness Artifact Registry as an upstream proxy for their respective registry.

When adding an Artifact Registry as an upstream proxy, ensure that registry doesn't have its own upstream proxies configured to avoid circular dependencies.

{% hint style="info" %}
This feature is currently behind the feature flag `HAR_SUPPORT_LOCAL_REGISTRY_AS_UPSTREAM_PROXY`. Contact Harness Support to enable it.
{% endhint %}

To know more about [Set Proxy for Registry](/artifact-registry/use-artifact-registry/manage-registries/configure-registry.md#set-proxy-for-registry)

### October 2025 <a href="#october-2025" id="october-2025"></a>

#### 2025.10.v1 <a href="#id-202510v1" id="id-202510v1"></a>

**Enhancements and Fixes**

**Public Registry**

Users can now define the visibility of an artifact registry as **Private** or **Public**. This enhancement allows better control over access to registry contents and image pulls.

> By default, all registries are created as **Private**.

* **Public registries** make the registry contents and images accessible to all users external to your organization.
* **Private registries** restrict both visibility and image pulls to authorized users or service accounts with valid permissions or tokens.

{% hint style="info" %}
To enable public artifact registries, the feature flag **`PL_ALLOW_TO_SET_PUBLIC_ACCESS`** must be activated. Contact **Harness Support** to enable it. After activation, navigate to **Account Settings > Authentication** and enable **Allow public resources** to make your registry publicly accessible.
{% endhint %}

<figure><img src="/files/M7vePiOERtNpBmXojXE1" alt="Public Registry"><figcaption><p>Click to view full size image</p></figcaption></figure>

Check out our documentation to know more about [Creating an Artifact Registry](/artifact-registry/use-artifact-registry/manage-registries/create-registry.md)

### September 2025 <a href="#september-2025" id="september-2025"></a>

#### 2025.09.v2 <a href="#id-202509v2" id="id-202509v2"></a>

**New Features**

**Artifact Quarantine**

Protect your software supply chain with **Artifact Quarantine**! You can now quarantine artifacts to prevent them from being used in pipelines or pulled by users. This powerful security feature works hand-in-hand with built-in container scanning and policy enforcement.

<figure><img src="/files/W9CzXSifZLSFsQRft31o" alt="Artifact Quarantine"><figcaption><p>Click to view full size image</p></figcaption></figure>

**Key Capabilities:**

* **Manual Quarantine**: Quarantine any artifact with a documented reason via the 3-dot menu
* **Automated Quarantine**: When integrated with Harness Supply Chain Security, artifacts are automatically scanned using AquaTrivy, and Security Tests policy sets can automatically quarantine artifacts based on vulnerability severity
* **Easy Management**: Remove artifacts from quarantine when they're safe to use again

This feature is available for Docker and Helm registries and provides an essential layer of protection to ensure only secure, compliant artifacts make it into your production environments.

{% hint style="info" %}
This feature requires the feature flag **`HAR_ARTIFACT_QUARANTINE_ENABLED`**. Contact Harness Support to enable it.
{% endhint %}

Learn more: [Artifact Quarantine](/artifact-registry/use-artifact-registry/manage-artifacts/artifact-management.md#quarantine-an-artifact)

**Digest Viewing / Image Referencing**

Harness Artifact Registry now provides complete visibility into all your container images with **digest-based viewing** and flexible **tag selection**, giving you more control over how you reference and manage images.

<figure><img src="/files/l55lGQvvIB6M5V2vTZlN" alt="Untagged Images"><figcaption><p>Click to view full size image</p></figcaption></figure>

**Untagged Images Made Visible**: Images without tags now appear clearly in the UI with an **“N/A”** label next to their digest. They remain fully pullable via their digest, so even untagged or cleaned-up images are easy to track and verify. Multi-architecture Docker and OCI images are also grouped neatly by platform, making navigation effortless.

**Flexible Tag and Digest Selection**: You can now select a **tag or version** for all artifact types directly from the header selector. For Docker and OCI images, you can also select by **digest** to reference an immutable version.

* **Use Tags** to browse familiar labels such as `latest` or `1.25.2`.
* **Use Digests** to pinpoint a specific, unchanging image for verification or debugging.

> Deployment details appear only when a tag is selected.

This enhancement offers a clearer, more dependable way to browse, reference, and inspect your images—whether tagged, untagged, or multi-architecture.

Learn more: [Selecting by Tag](/artifact-registry/use-artifact-registry/manage-artifacts/artifact-details.md#selecting-by-tag) | [Image Referencing](/artifact-registry/use-artifact-registry/manage-artifacts/find-artifacts.md#image-referencing)

**Enhancements and Fixes**

**NuGet Visual Studio Integration**

We're excited to provide **Visual Studio integration** for NuGet package management! .NET developers can now configure Harness Artifact Registry as a package source directly within Visual Studio, enabling native IDE integration with secure token-based authentication.

Configure your registry in Visual Studio and start pulling packages from Harness registries with ease.

Learn more: [Install and Use NuGet Packages](/artifact-registry/new-to-artifact-registry/quickstart.md#nuget--install-and-use-nuget-packages)

#### 2025.09.v1 <a href="#id-202509v1" id="id-202509v1"></a>

**Enhancements and Fixes**

* **Delete Version API**: Improved error handling for invalid non-OCI versions. Instead of returning a confusing **500 Internal Server Error**, the API now responds with a clear **404 Not Found**. This makes debugging easier and ensures a more consistent developer experience. *\[AH-1302]*
* **List Versions API**: Fixed an issue where requests for unavailable images incorrectly triggered a **500 Internal Server Error**. The API now returns a proper **404 Not Found**, giving developers accurate feedback and reducing troubleshooting time. *\[AH-1829]*