Artifact Registry Release Notes

The release notes describe recent changes to Harness Artifact Registry.

📌 Release Deployment Status by Cluster​

Progressive deployment: Harness deploys changes to Harness SaaS clusters on a progressive basis. This means that the features described in these release notes may not be immediately available in your cluster. To identify the cluster that hosts your account, go to your Account Overview page in Harness. In the new UI, go to Account Settings, Account Details, General, Account Details, and then Platform Service Versions.

July 2026​

2026.7.v2​

New Features​

Debian Registry Support

Harness Artifact Registry now supports Debian packages for Debian and Ubuntu systems. Host private .deb packages, configure upstream proxies against external Debian mirrors, and install packages with standard APT workflows.

Go to the Debian quickstart to create a Debian registry and publish your first package.

Raw File artifacts for WinRM CD deployments

Harness Continuous Delivery now supports Raw File artifacts from Harness Artifact Registry as a service artifact source for WinRM deployments. Deploy .zip packages and other files stored in a Raw File registry to Windows targets without a third-party artifact connector.

Go to Use artifacts from Harness Artifact Registry to configure a Raw File artifact source, or go to the WinRM tutorial for a full deployment walkthrough.

Enhancements & Fixes​

Dependency Firewall audit from manifest files

The Harness CLI hc registry fw audit command now supports auditing dependencies from package.json without a lock file in source control. Pass package.json to evaluate direct dependencies only, or generate a lock file in CI for a full transitive audit with package-lock.json, yarn.lock, or pnpm-lock.yaml.

Go to Audit dependencies with Dependency Firewall for input file scope and examples.

Webhooks for RPM registries

Artifact Creation and Artifact Deletion webhook events now fire for RPM registries. Webhooks are supported for all Artifact Registry package types other than Raw.

Go to Webhooks to configure triggers.

2026.7.v1​

New Features​

Helm HTTP registry type

Host and consume Helm charts with the classic helm repo add / helm pull workflow with a new Helm HTTP registry type. Unlike the existing Helm OCI registry, Helm HTTP uses the HTTP-based Helm chart repository protocol (index.yaml + .tgz archives) and supports upstream proxy pull-through for public Helm repositories.

Go to Helm HTTP quickstart to create your first Helm HTTP registry.

Native Harness Artifact Registry for CD Run steps in Containerized Step Groups

CD Run steps inside a Step Group with container based execution enabled can now reference container images from Harness Artifact Registry natively, without a Docker connector. In the Run step, set Registry Type to Artifact Registry, select your registry in Container Registry, and enter the image reference in Image. To pull from an external Docker registry through a Harness Docker connector instead, choose Third-Party Artifact Registry.

Go to Add a Run step inside a Containerized Step Group to walk through the setup.

June 2026​

2026.6.v1​

New Features​

Lifecycle Rules (Cleanup and Retention)

Lifecycle rules bring policy-based artifact management to Harness Artifact Registry. Define rules that automatically identify and soft-delete stale artifact versions on a recurring schedule, so your registries stay lean without manual cleanup.

Key capabilities:

• Cleanup rules: Soft-delete versions that match your criteria (age, version count, or name pattern). Deleted artifacts remain recoverable during the configured recovery period.
• Retention rules: Protect matching artifacts from all deletion, including cleanup rules, manual soft delete, and manual hard delete. Retention rules are always evaluated first, overriding any deletion attempt.
• Hierarchical scoping: Create rules at the account, organization, or project level and attach them to one or more registries.
• Dry-run mode: Preview which versions a rule would affect before you enable it, so you can validate criteria safely.
• Execution history: Track every run with detailed logs showing which versions were deleted and which were retained.
• Notification integration: Fire centralised notification events when a cleanup rule or dry run finishes executing.

Go to Lifecycle Rules to understand how rules work. To start creating rules, go to Create a cleanup rule or Create a retention rule.

Centralised Notifications for Artifact Registry

Centralised Notifications now support Artifact Registry events. Configure notification rules at the organization level that apply to every project under the organizations you select, with no per-registry setup required.

Available events: Dependency Firewall Exemption Requested, Dependency Firewall Exemption Status Changed, Lifecycle Policy Execution Completed, and Lifecycle Policy Dry Run Execution Completed.

Go to Centralised Notification to configure notification rules for Artifact Registry events.

Puppet Registry Support

Harness Artifact Registry now supports Puppet modules with full Puppet Forge compatibility. Publish with the Puppet CLI or r10k, host private modules inside your Harness account, and cache modules from external Puppet Forge sources through an upstream proxy.

Go to the Puppet Registry Quickstart to set up a Puppet registry and publish your first module.

May 2026​

2026.5.v1​

New Features​

Dependency Firewall Exemptions

Request temporary access to blocked package versions through an approval workflow. A developer files a request with a business justification, an approver reviews it, and on approval the version becomes usable for a fixed duration. After expiry, the original policy verdict applies again. Centralized notification rules are available for exemption events.

Go to Dependency Exemptions to set up the workflow.

Quarantine artifacts on Warning verdict

A new checkbox on the upstream proxy configuration quarantines artifacts whose policy verdict is Warning (in addition to Blocked). Warning artifacts are cached but blocked until an administrator releases them from quarantine using the quarantine management UI. Exemptions do not apply to quarantined packages.

Go to Enable Dependency Firewall to configure this option.

OSS Risk Level and Malicious Package policy templates

Two new built-in Dependency Firewall policy templates:

• OSS Risk Level: Blocks artifacts that exceed a configured open-source risk threshold, factoring in maintenance status, known vulnerabilities, and community health.
• Malicious Package: Blocks any artifact version flagged as malicious in threat intelligence databases.

These join the existing CVSS Threshold, License Policy, and Package Age templates. Go to Configure Policies and Policy Sets to use them.

Enhancements & Fixes​

CLI bulk artifact deletion

The Harness CLI now supports bulk deletion with wildcard patterns (for example, 1.0.*) and dry-run preview. Supported for Generic, Maven, npm, Python, NuGet, Go, Conda, Composer, Swift, and Dart registries. Go to Delete Artifacts to use bulk delete.

Webhooks for upstream proxy registries

Artifact Creation and Artifact Deletion webhook events now fire for upstream proxy registries. When a package is cached from an external source, the creation event fires. Supported for Docker, Maven, npm, Python, and NuGet upstream proxies. Cosign signature (.sig) and attestation (.att) artifacts are automatically filtered out. [AH-3516, AH-3943]

Go to Webhooks to configure triggers.

April 2026​

2026.4.v1​

New Features​

Swift Registry Support

Harness Artifact Registry now supports Swift packages with full Swift Package Manager (SwiftPM) compatibility. Use the registry URL with swift package-registry for authentication, publishing, and dependency resolution. Your existing SwiftPM workflows keep working with Harness as the source of truth.

Key benefits:

• Native SwiftPM workflow: Compatible with swift package-registry commands (login, publish, resolve) on Swift 5.9 or later.
• Private package hosting: Host proprietary Swift packages securely inside your Harness account.
• Upstream proxy support: Cache packages from external Swift sources to accelerate builds and reduce external dependencies.

Go to the Swift Registry Quickstart to set up a Swift registry and publish your first package.

Raw File Registry Support

The new Raw File registry lets you store and retrieve arbitrary files by path: archives, reports, configuration files, or anything else that does not belong to a package manager ecosystem. You upload, download, inspect, and delete files using HTTP requests and curl, with no specialized client required.

Key benefits:

• Path-based storage: Address files directly by their path, ideal for build artifacts, reports, and shared configs.
• HTTP-native workflow: Push and pull files with curl or any HTTP client; no custom CLI plugin required.
• Upstream proxy support: Optionally cache files from an external HTTP source through Harness.

Go to the Raw File Registry Quickstart to create a Raw File registry and upload your first file.

Copy Version between Registries

You can now copy a specific package version from one Harness registry to another directly from the UI, with no need to re-push from your machine when promoting a version into another project or organization.

Open the package, switch to the Versions tab, open the row menu (⋮) on the version you want, and select Copy Version. Pick the target organization, project, and registry in the dialog, then run the copy. Permissions: read on the source registry, write on the target. The same operation is available from the CLI for automation.

Go to Copy a version to use the UI flow, or Copy artifacts in the Harness CLI to run the same operation from the command line.

Soft Delete for Artifacts and Versions

Deleting a package or a version is now soft by default. Deleted items move to a Deleted view where they remain recoverable until the retention window allows them to be purged. You can also opt in to a permanent delete from the same dialog when that is what you intend.

Key capabilities:

• Recoverable deletes: Restore a package or version from the Deleted tab or the row menu, including content from a soft-deleted registry.
• Cascade on registry delete: Soft-deleting a registry soft-deletes all packages, images, and versions inside it; restoring a child can restore the parent registry.
• Configurable retention: Account administrators set the retention window in Default Settings → Artifact Registry; the value applies across the account, organization, or project.
• Permanent delete still available: Select Permanently delete in the confirmation dialog when you want immediate, non-recoverable removal.

Go to Delete Artifacts to learn the soft-delete and restore flow, and Delete a Registry to understand the cascade behavior.

Artifact Registry Audit Dashboard

The new Artifact Registry Audit Dashboard is an out-of-the-box dashboard in Harness Dashboards that records every artifact upload and download across your Harness Artifact Registries. It is provisioned and maintained by Harness, so it appears automatically for accounts that have Artifact Registry enabled — no setup, no widgets to build.

Key capabilities:

• Built for security and compliance: Identify which users or service accounts pulled a specific package version after a CVE or zero-day disclosure, and audit upload activity on a registry over a chosen time window.
• Filter by scope and artifact: Narrow results by Time Range, Organization Identifier, Project Identifier, Registry Name, Package Name, and Version Name. Every widget on the page reacts to the filter set.
• Four widgets out of the box: Download Artifact Data and Upload Artifact Data event tables (Action, Registry, Package, Version, Username, Client IP, Timestamp Hour), an Upload And Download Activity time series, and an Upload/Download Aggregation donut.
• Read-only and clone-friendly: The original is owned by Harness and stays read-only so it keeps receiving updates. To customize widgets or filters, open the row menu and choose Clone; the clone belongs to your account and is fully editable.

Go to Artifact Registry audit dashboard to open the dashboard and walk through the upload-and-download workflows.

Enhancements & Fixes​

Webhook support extended to Python, Maven, and NuGet

Artifact Registry webhooks now cover additional package types so more teams can drive CI/CD, security, and notification workflows from artifact events. The supported list now includes Maven, NuGet, and Python (PyPI).

Go to Webhooks to view the full support table and to wire webhooks to triggers.

March 2026​

2026.3.v1​

New Features​

Maven plugin for Artifact Registry

The Harness Maven plugin (io.harness.maven:harness-maven-plugin) lets you publish JARs, WARs, POMs, and related artifacts from your Maven build—no one-off scripts or manual uploads. It fits the standard Maven lifecycle, supports parallel-friendly deployments for multi-module projects, and can enforce dependency resolution through Harness upstream proxies so builds pull through the registries you govern.

• Deploy from Maven: Bind the deploy goal and push artifacts to Harness using the same coordinates and repositories your teams already use.
• Credentials via environment variables: Keep tokens out of pom.xml by configuring Harness registry URL and identity token through environment variables in CI and local workflows.

Learn more in the Build plugins overview; open the Maven Plugin tab there for installation and configuration.

Gradle plugin for Artifact Registry

The Harness Gradle plugin (io.harness.gradle) hooks into ./gradlew publish: Harness uploads artifacts to Artifact Registry in parallel for faster multi-module builds and reads registry URL and credentials from environment variables so secrets stay out of Gradle scripts and source control.

• Drop-in Gradle workflow: Apply the plugin in the root or subprojects and keep using your existing publish tasks.
• Built for CI: Matches how Gradle projects already inject registry configuration in pipelines.

Learn more in the Build plugins overview; open the Gradle Plugin tab there for installation and configuration.

February 2026​

2026.2.v1​

New Features​

Dependency Firewall

We're excited to ship Dependency Firewall in Harness Artifact Registry—a major step forward for software supply chain security. Until now, risky or non-compliant packages could flow into your organization through upstream proxies with little gatekeeping at the registry boundary. Dependency Firewall changes that: it evaluates every artifact version pulled from an external source before it is cached in your upstream proxy registry, using the same Policy as Code and OPA-style policies you already trust elsewhere in Harness.

• Policy at the front door: CVSS thresholds, license rules, package age, and custom Rego policies can allow, warn on, or block versions automatically—so violations are caught when dependencies are first fetched, not after they have spread across builds.
• Clear outcomes: Each evaluation is Passed, Warning, or Blocked. In Block mode, non-compliant versions are never cached and cannot be downloaded or used; Warn mode helps you roll out policies safely while you refine rules.
• Built for operators: Enable the firewall on your upstream proxy, attach policy sets, pick Block or Warn, and track everything from the Dependency Firewall tab—no separate toolchain required.

Learn more in the Dependency Firewall overview, enable Dependency Firewall in registry configuration, configure policies and policy sets, and the tutorial Implement Dependency Firewall with OPA policies.

Python registry: Poetry and uv

Harness Python registries now document first-class workflows for Poetry and uv—including publishing, installing, and authenticating with identity tokens—alongside existing pip instructions. Use the same pkg.harness.io endpoints and tokens as for pip; Poetry and uv integrate through explicit sources, pyproject.toml, and lockfiles your teams may already use.

Follow the poetry and uv tabs in the embedded guide on Get started with Artifact Registry (select Python in the format selector) for copy-ready commands.

Enhancements & Fixes​

Harness CLI: Dependency Firewall audit, explain, and npm client configuration

The Harness CLI (hc) streamlines Artifact Registry operations for security and local client setup:

• hc registry fw audit (alias hc registry firewall audit): Parse lock and manifest files and evaluate dependencies in bulk against Dependency Firewall policies. Supported inputs include NPM, Java (Maven and Gradle), and Python files such as requirements.txt, pyproject.toml, Pipfile.lock, and poetry.lock.
• hc registry fw explain: Return firewall scan status (Passed, BLOCKED, or WARN) and details for a specific package version already present in a registry.
• hc registry configure npm: Write Harness registry URLs and authentication into .npmrc for default, scoped, global, or project-level npm configuration.

Learn more in Manage artifacts and registries with the CLI: Audit dependencies from lock files, Get firewall status for an artifact version, and Configure npm client.

January 2026​

2026.1.v1​

New Features​

Artifact Download from UI

Harness Artifact Registry now supports downloading artifacts directly from the UI. You can download all versions of an artifact, specific versions, or individual files. The system prepares your download as a compressed archive and displays a status indicator at the bottom center of the page. Once ready, downloads remain available for 24 hours.

This feature works seamlessly with Docker digests and all supported artifact types, making it easy to retrieve artifacts for offline use, backup, or distribution.

Learn more about downloading artifacts from the UI.

Native CI Integration for Artifact Upload

We've introduced a new native Upload Artifact to Harness Artifact Registry step in Harness CI pipelines, making it easier than ever to publish build artifacts directly to Harness Artifact Registry without custom scripts or third-party plugins.

What's new:

• Built-in CI step: New "Upload Artifacts to Harness Artifact Registry" step available in all CI pipelines
• Multi-format (non-OCI) support: Upload artifacts in formats such as Maven JARs, npm packages, Python wheels, Conda packages, Generic artifacts, and more

This native integration streamlines your CI/CD workflows by eliminating the need for custom scripts and manual authentication setup. Simply add the step to your pipeline, configure your target registry, and let Harness handle the rest.

Learn more about the native CI integration for Artifact Registry.

Enhancements & Fixes​

Enhanced CLI Capabilities for Artifact Registry

The Harness CLI (hc) now includes expanded functionality for managing artifacts and registries:

• Metadata Management: Set, get, and delete custom metadata on registries, packages, and specific versions. Use metadata for tagging environments, tracking ownership, managing approval workflows, and maintaining compliance information.

• Artifact Copy: Copy specific versions of artifacts between registries within your Harness Artifact Registry, with support for artifact type specification (e.g., model, dataset).

• Artifact Version Delete: Delete specific versions of artifacts or all versions of an artifact. This provides granular control over artifact lifecycle management.

• Registry Delete: Remove entire registries from your projects through the CLI.

• Python and NuGet Support: Manage Python (PyPI) and NuGet packages directly from the command line.

These enhancements provide a consistent CLI experience across all supported registry types, making it easier for development teams to integrate Harness Artifact Registry into their existing workflows and automation pipelines.

Learn more about managing artifacts and registries with the CLI.

December 2025​

2025.12.v1​

New Features​

PHP Composer Registry Support

Harness Artifact Registry now supports PHP Composer packages, providing a secure, private registry for your PHP dependencies. You can store, manage, and distribute Composer packages directly within Harness with full compatibility with the Composer package manager.

Key benefits:

• Private package hosting: Host your proprietary PHP libraries and internal packages securely
• Upstream proxy support: Cache packages from Packagist and other public repositories to accelerate builds and reduce external dependencies
• Version management: Full support for semantic versioning and package constraints

To learn more about how to use Harness Artifact Registry with PHP Composer, check out our Composer Registry documentation.

Enhancements & Fixes​

Python PyPI Upstream Proxy Enhancements

Python PyPI upstream proxy configuration now supports specifying a custom registry suffix for non-standard PyPI endpoints. This allows platform teams to integrate private PyPI repositories and enterprise artifact managers such as Artifactory, Nexus, or self-hosted PyPI mirrors that do not expose packages under the default /simple/ path.

You can configure a remote registry URL, optionally define a custom registry suffix, and choose the appropriate authentication method. Harness transparently proxies Python packages from these upstream registries while handling authentication and package resolution.

November 2025​

2025.11.v2​

New Features​

Metadata Support for Artifacts and Registries

Now enhance your artifact management with custom metadata! You can now attach key-value pairs to registries, artifacts, and packages, enabling better organization, searchability, and governance across your artifact ecosystem.

Key capabilities:

• Multi-level metadata: Add metadata at registry, artifact, and package (version) levels
• Flexible filtering: Search and filter artifacts using custom metadata attributes
• Custom attributes: Track ownership, environment tags, build information, security classifications, and more
• Enhanced governance: Maintain audit trails and compliance information with version-specific metadata

To learn more about how to use Harness Artifact Registry to store and manage artifacts with custom metadata, check out our Metadata Support for Artifacts and Registries

Dart Registry Support

Harness Artifact Registry now supports Dart packages with full pub.dev compatibility. You can store, manage, and distribute Dart packages directly within Harness, with complete support for versions, metadata, and immutable release behaviour.

Key benefits:

• Secure, private Dart registry: Provides a dedicated, secure registry for all your teams' Dart packages
• Immutable versions: Ensures immutable package versions matching pub.dev behaviour for safe, predictable builds
• Accelerated CI/CD: Speeds up builds by caching remote dependencies via upstream proxy, reducing external dependencies and improving reliability

To learn more about how to use Harness Artifact Registry to store and manage Dart packages, check out our Dart Registry Quickstart guide.

Enhancements & Fixes​

Download Button for Non-OCI Artifacts

You can now directly download any non-OCI artifact (Maven, npm, PyPI, Generic, Conda, Helm charts, etc.) from the Artifact Registry UI with a single click. Until now, retrieving individual files or packages required using CLI commands or configuring a package manager client. For many workflows: debugging, validation, quick inspections, and offline analysis, users simply want to grab the file instantly.

2025.11.v1​

New Features​

Artifact Registry management via CLI

We're thrilled to introduce comprehensive CLI support for Artifact Registry management through the new Harness CLI v1.0.0 (hc)! This powerful addition brings the full capabilities of Artifact Registry directly to your terminal, enabling seamless automation and developer-friendly workflows.

What's new:

• Registry Management: List, view, and manage your registries with intuitive commands like hc registry list and hc registry get
• Artifact Operations: Push, pull, and list artifacts across all your registries using hc artifact commands
• Developer-Friendly Aliases: Save time with short commands - use hc reg instead of hc registry and hc art instead of hc artifact
• Flexible Output Formats: Get results in JSON, YAML, or table format for easy parsing in scripts and automation pipelines
• Cross-Project Support: Work seamlessly across multiple projects with global flags like --project and --org

Install the new Harness CLI v1.0.0 (hc) and authenticate to your account to start managing your registries and artifacts from the command line. Check out our CLI documentation for detailed examples and best practices.

Conda Registry Support

We have added a new registry type, Conda Registry support, for Python and R package management.

Key capabilities:

• Native Conda client support: Works with conda and mamba out of the box
• Bioconda upstream proxy: Automatically configured to fall back to Bioconda's public repository, giving you access to thousands of packages
• Hybrid package management: Host your private packages while proxying public ones from Bioconda
• Channel organization: Organize packages into channels for better version control and distribution

Configure your Conda client to point to your Harness registry, and you're ready to go - private packages are served directly while public packages are fetched from Bioconda automatically (If some custom source is not configured).

Do refer to Conda Registry Quickstart for more details.

Enhancements & Fixes​

Upstream Proxy to aggregate multiple Artifact Registries

We have enhanced our Artifact Registry experience by allowing it to be configured as an upstream proxy, enabling you to aggregate multiple registries into a single, unified access point. Use any Harness Artifact Registry as an upstream proxy for their respective registry.

When adding an Artifact Registry as an upstream proxy, ensure that registry doesn't have its own upstream proxies configured to avoid circular dependencies.

To know more about Set Proxy for Registry

October 2025​

2025.10.v1​

Enhancements and Fixes​

Public Registry

Users can now define the visibility of an artifact registry as Private or Public. This enhancement allows better control over access to registry contents and image pulls.

By default, all registries are created as Private.

• Public registries make the registry contents and images accessible to all users external to your organization.
• Private registries restrict both visibility and image pulls to authorized users or service accounts with valid permissions or tokens.

Check out our documentation to know more about Creating an Artifact Registry

September 2025​

2025.09.v2​

New Features​

Artifact Quarantine

Protect your software supply chain with Artifact Quarantine! You can now quarantine artifacts to prevent them from being used in pipelines or pulled by users. This powerful security feature works hand-in-hand with built-in container scanning and policy enforcement.

Key Capabilities:

• Manual Quarantine: Quarantine any artifact with a documented reason via the 3-dot menu
• Automated Quarantine: When integrated with Harness Supply Chain Security, artifacts are automatically scanned using AquaTrivy, and Security Tests policy sets can automatically quarantine artifacts based on vulnerability severity
• Easy Management: Remove artifacts from quarantine when they're safe to use again

This feature is available for Docker and Helm registries and provides an essential layer of protection to ensure only secure, compliant artifacts make it into your production environments.

Learn more: Artifact Quarantine

Digest Viewing / Image Referencing

Harness Artifact Registry now provides complete visibility into all your container images with digest-based viewing and flexible tag selection, giving you more control over how you reference and manage images.

Untagged Images Made Visible: Images without tags now appear clearly in the UI with an “N/A” label next to their digest. They remain fully pullable via their digest, so even untagged or cleaned-up images are easy to track and verify. Multi-architecture Docker and OCI images are also grouped neatly by platform, making navigation effortless.

Flexible Tag and Digest Selection: You can now select a tag or version for all artifact types directly from the header selector. For Docker and OCI images, you can also select by digest to reference an immutable version.

• Use Tags to browse familiar labels such as latest or 1.25.2.
• Use Digests to pinpoint a specific, unchanging image for verification or debugging.

Deployment details appear only when a tag is selected.

This enhancement offers a clearer, more dependable way to browse, reference, and inspect your images—whether tagged, untagged, or multi-architecture.

Learn more: Selecting by Tag | Image Referencing

Enhancements and Fixes​

NuGet Visual Studio Integration

We're excited to provide Visual Studio integration for NuGet package management! .NET developers can now configure Harness Artifact Registry as a package source directly within Visual Studio, enabling native IDE integration with secure token-based authentication.

Configure your registry in Visual Studio and start pulling packages from Harness registries with ease.

Learn more: Install and Use NuGet Packages

2025.09.v1​

Enhancements and Fixes​

• Delete Version API: Improved error handling for invalid non-OCI versions. Instead of returning a confusing 500 Internal Server Error, the API now responds with a clear 404 Not Found. This makes debugging easier and ensures a more consistent developer experience. [AH-1302]

• List Versions API: Fixed an issue where requests for unavailable images incorrectly triggered a 500 Internal Server Error. The API now returns a proper 404 Not Found, giving developers accurate feedback and reducing troubleshooting time. [AH-1829]