Project Quay Release Notes

PROJQUAY-6016. Previously, no error notification was displayed in the UI when an invalid robot account description was entered. With this update, proper validation and error feedback are now shown when the robot account description input is invalid.

PROJQUAY-6125. Previously, the Project Quay UI did not validate tag names when a new tag was created, allowing invalid tag names to be submitted without warning. With this update, tag name input is validated in the UI and users receive feedback when an invalid tag name is entered.

PROJQUAY-7098. Previously, using an email address when creating a repository notification for the first time caused an unexpected error alert in the UI. With this update, the UI correctly handles email-based notification creation without displaying spurious error messages.

PROJQUAY-8202. Previously, authorizing OAuth applications through the CLI no longer functioned correctly. With this update, CLI-based OAuth application authorization works as expected.

PROJQUAY-8272. Previously, nested indexes in the Project Quay database could cause query performance issues. With this update, nested indexes are corrected to improve database query performance.

PROJQUAY-9038. Previously, the notification bell badge in the Project Quay UI displayed a maximum count of 5, even when more unread notifications were present. With this update, the badge count correctly reflects the actual number of unread notifications.

PROJQUAY-9330. Previously, when a tag name was the same as the repository name, the repository name was missing from the breadcrumb navigation in the UI. With this update, the breadcrumb correctly displays the repository name in all cases.

PROJQUAY-9692. Previously, deleting an organization from the superuser admin panel did not generate an audit event. With this update, organization deletions are properly recorded in the audit log.

PROJQUAY-11177. Previously, changing an organization quota limit using the v2 UI returned a quota update error, Unauthorized error even when the user had the necessary permissions. With this update, quota limit changes via the v2 UI succeed for users with appropriate permissions.

PROJQUAY-11202. Previously, a routing bug in the v2 UI caused malformed API requests when an organization name contained the word organization. With this update, organization names containing organization are handled correctly in the UI routing layer.

PROJQUAY-11278. Previously, when RadosGWStorage was configured with a region_name, the value was not validated at startup, which could result in silent misconfiguration. With this update, RadosGWStorage validates region_name at startup and reports configuration errors immediately.

PROJQUAY-12113. Previously, the Project Quay UI did not display the cosign shield icon for images that had been signed with cosign. With this update, the shield icon is correctly displayed for cosign-signed images.

PROJQUAY-12190. Previously, repository mirroring did not work when both the source and destination registries were the same Project Quay instance. With this update, repository mirroring functions correctly when the source and destination registries are the same.

PROJQUAY-12223. Previously, the referrers cache was not invalidated when a manifest was pushed, causing stale referrers to be returned. With this update, the referrers cache is properly invalidated on manifest push, ensuring accurate referrers lists.

PROJQUAY-12269. Previously, using the /search function in the new UI caused the interface to break. With this update, the search function works correctly in the v2 UI.

PROJQUAY-12311. Previously, the proxy cache failed for large blobs due to an asynchronous download issue. With this update, the proxy cache correctly handles large blobs by resolving the asynchronous download race condition.

PROJQUAY-12443. Previously, the /v1/bootstrap/renew endpoint for the programmatic OAuth token provisioning feature did not properly sanitize input. With this update, the endpoint correctly sanitizes input to prevent unexpected behavior.

PROJQUAY-12447. Previously, Project Quay returned stale caching results on Operator-based deployments. With this update, caching is correctly invalidated on Operator-based deployments, ensuring fresh results are returned.

PROJQUAY-12456. Previously, the Project Quay new UI help dropdown did not display build version information. With this update, the help dropdown shows current build and version information.

PROJQUAY-12538. Previously, the tags/list cache was not invalidated when a manifest was deleted, causing stale tag listings to be returned. With this update, the tags/list cache is properly invalidated on manifest deletion.

PROJQUAY-12557. Previously, orphaned multipart uploads were not cleaned up during blob cleanup, leading to storage accumulation over time. With this update, orphaned multipart uploads are removed as part of the blob cleanup process.

PROJQUAY-12773. Previously, Project Quay generated excessive DNS query bursts that could saturate local DNS resolvers. With this update, DNS query behavior is optimized to prevent resolver saturation.

PROJQUAY-12833. Previously, the repository mirroring Server-Side Request Forgery (SSRF) mitigation required pod-local DNS resolution, which broke mirroring in disconnected environments that route traffic through an HTTPS_PROXY. With this update, repository mirroring works correctly in disconnected environments that use an HTTPS_PROXY.

PROJQUAY-13363. Previously, Project Quay ran expensive quota checks even when quota was not configured or required, adding unnecessary overhead to registry operations. With this update, quota checks are skipped when not needed, improving overall registry performance.

PROJQUAY-13364. Previously, the expiry time for blob and temporary tags was too short, causing premature cleanup of objects still in use. With this update, the blob and temporary tag expiry time is increased to prevent premature deletion.

PROJQUAY-13371. Previously, registry blob commits blocked for 25–60 seconds due to a double blocking lock acquisition in with_blob_lock_or_fallback, causing significant latency during concurrent push operations. With this update, the locking behavior is corrected to eliminate the contention and reduce blob commit latency.

PROJQUAY-13405. Previously, retrieving archived build logs stored in Google Cloud Storage (GCS) returned a 500 error due to a zlib incorrect header check error when GCS served an already-decoded object. With this update, archived build logs are retrieved correctly from GCS storage.

PROJQUAY-13429. Previously, authentication timeouts occurred with the OIDC backend in large environments due to inefficient token validation. With this update, OIDC authentication is optimized to prevent timeouts in large-scale deployments.

PROJQUAY-13519. Previously, blob GET requests through the storage proxy (FEATURE_PROXY_STORAGE) were gzip-encoded by nginx, which removed the Content-Length header and caused client compatibility issues. With this update, blob responses through the storage proxy are returned with the correct encoding and Content-Length header.

PROJQUAY-13543. Previously, Project Quay application and mirror pods did not roll out when the AWS STS ROLEARN was changed in the configuration. With this update, changing ROLEARN in the AWS STS configuration triggers the expected pod rollout.

PROJQUAY-13715. Previously, the Project Quay 5.0 Operator displayed the upstream community project logo instead of the Red Hat downstream logo. With this update, the Operator correctly displays the Red Hat Project Quay branding.

PROJQUAY-13716. Previously, the header search box in the Project Quay 5.0 UI overlapped the Project Quay logo. With this update, the header layout is corrected so the search box and logo do not overlap.

PROJQUAY-13780. Previously, the Project Quay 5.0 Change Log page displayed v3.11.0 release notes instead of v5.0.0 release notes. With this update, the Change Log page correctly displays the v5.0.0 release notes.

PROJQUAY-13783. Previously, the Project Quay 5.0 robot API token name field lacked input validation for length and character restrictions. With this update, robot API token names are validated to enforce length and character restrictions.

PROJQUAY-13784. Previously, Project Quay 5.0 robot API tokens did not generate per-token audit trail entries for security-relevant operations. With this update, security-relevant operations performed with robot API tokens are recorded in the audit log.

PROJQUAY-13785. Previously, the last_accessed field for robot accounts showed Never even when the robot account was actively used via API tokens. With this update, last_accessed is correctly updated when a robot account is accessed via API tokens.

PROJQUAY-13786. Previously, robot API token GET endpoints did not grant read access to global readonly superusers, preventing them from inspecting token metadata. With this update, global readonly superusers can access robot API token GET endpoints as expected.

PROJQUAY-13787. Previously, the Robot API Tokens tab in the Project Quay 5.0 UI displayed tokens as a flat text list instead of a structured table layout. With this update, the Robot API Tokens tab uses a structured table layout for improved readability.

PROJQUAY-13788. Previously, a security regression in Project Quay 5.0 caused robot API tokens to bypass the ROBOTS_DISALLOW configuration policy. With this update, the ROBOTS_DISALLOW policy is correctly enforced for robot API tokens.

PROJQUAY-13930. Previously, the Superuser Usage Logs table in the Project Quay 5.0 UI had a truncated date column and was missing additional columns. With this update, the Superuser Usage Logs table displays all columns correctly.

PROJQUAY-13942. Previously, the Project Quay 5.0 UI Create Team wizard Review step incorrectly marked optional fields as required. With this update, the Create Team wizard correctly distinguishes between required and optional fields.

PROJQUAY-13943. Previously, users with GLOBAL_READONLY_SUPER_USERS permissions could not create repositories or generate OAuth tokens in their own namespace or organization. With this update, GLOBAL_READONLY_SUPER_USERS can create repositories and generate OAuth tokens in their own namespaces and organizations as expected.

PROJQUAY-13991. Previously, the Robot API Tokens tab in the Project Quay 5.0 UI showed mutation controls (such as create, delete, and revoke) to global readonly superusers, who should only have read access. With this update, mutation controls are hidden from global readonly superusers on the Robot API Tokens tab.

PROJQUAY-14041. Previously, the Project Quay 5.0 Quay Bridge Operator displayed an incorrect logo and icon in OperatorHub. With this update, the Quay Bridge Operator displays the correct branding in OperatorHub.