Chapter 1. Red Hat Quay release notes

With this release, the v2, React-based UI is now the default UI. Procedures throughout this documentation have been updated to reflect these changes.

Previously, determining whether an image tag was safe to delete was difficult because usage data was not easily accessible. Although pull events were recorded in audit logs, analyzing that information was often inefficient or impractical.

With this release, Red Hat Quay introduces image pull activity tracking in the v2 UI. This feature provides clear visibility into how often and when image tags are pulled, giving users valuable insight into image usage and popularity across repositories. It can be enabled by setting FEATURE_IMAGE_PULL_STATS: true in your config.yaml file.

For more information, see Managing auto-pruning policies using the Red Hat Quay UI.

With this update, a new Superuser panel is available on the Red Hat Quay v2 UI. When you are logged in to the v2 UI as a superuser, this panel is available in the navigation pane.

The following information can be viewed from the Superuser panel:

This panel is nearly equivalent to the Superuser Admin Panel on the v1 UI with one exception: Red Hat Quay superusers now create new users from the Organizations page of the v2 UI.

Previously, Red Hat Quay could not authenticate with Proof Key for Code Exchange (PKCE) providers, such as Azure AD or Okta. This led to a loss of service for affected customers.

With this release, PKCE is now supported for OpenID Connect (OIDC) authentication. Red Hat Quay administrators can enable PKCE on a per-OIDC provider basis in their config.yaml file.

For more information, see Configuring OIDC for Red Hat Quay.

With this release, global read-only superusers that are configured through the GLOBAL_READONLY_SUPER_USERS field can now view the following information within the registry:

This update provides the option to specify a custom storageClassName for the managed Postgres and ClairPostgres Persistent Volume Claims (PVCs). It also enhances the Operator’s resilience by adding dedicated PVC health monitoring and event tracking, ensuring faster detection and reporting of storage provisioning failures. Lastly, it streamlines internal component health checks for improved maintainability.

The following example YAML shows you how to set the storageClassName field in your QuayRegistry CR:

# ...
    - kind: postgres
      managed: true
      overrides:
        storageClassName: "local-path"
# ...
    - kind: clairpostgres
      managed: true
      overrides:
        storageClassName: "local-path"
# ...

# ...
    - kind: postgres
      managed: true
      overrides:
        storageClassName: "local-path"
# ...
    - kind: clairpostgres
      managed: true
      overrides:
        storageClassName: "local-path"
# ...

For more information about configuring resource requests for the QuayRegistry CR, see Configuring QuayRegistry CR resources.

The following configuration options have been added to track image activities. When enabled, clear visibility into how often and when image tags are pulled are provided in the UI.

A new parameter, timeout, has been added to the splunk_config object for when you configure Splunk HTTP Event Collector (HEC) for Red Hat Quay

For more information, see Configuring action log storage for Splunk.

The Red Hat Quay v2 UI is now the default UI. Users can toggle between the v1/legacy UI and the v2 UI by clicking their username and the Legacy UI / Current UI toggle when FEATURE_UI_V2: true is set in their config.yaml file.

The following configuration fields are available to completely disable the legacy UI, or to set it as the default UI. However, users and administrators should remain aware that the v1 legacy UI is deprecated and planned for removal in a future version of Red Hat Quay.

With this release, Proof Key for Code Exchange (PKCE) is now supported for OpenID Connect (OIDC) authentication. Red Hat Quay administrators can enable PKCE with the following configuration fields.

For more information, see Configuring OIDC for Red Hat Quay.

New tag API parameters, getTagPullStatistics and getManifestPullStatistics, have been added to the Red Hat Quay API. With these fields, users can return image pull statistics for tags and manifests. Statistics include the last date that the tag or manifest was pulled, and how many times the tag or manifest has been pulled.

See Chapter 22. tag for more information, including example commands.

A new API parameter, listAllAppTokens, has been added to the Red Hat Quay API. This endpoint enables superusers to manage and audit application-specific tokens.

See Chapter 22. superuser for more information, including example commands.

Nginx version 1.22 went end-of-life (EOL) in November, 2025. With this update, Nginx references have been upgraded to version 1.24.

With this release, the Red Hat Quay v1 UI (legacy UI or angular UI) is deprecated.

Deprecation serves as an official notice that the v1 UI will be removed in a future release. Customers should begin planning their transition to the v2 UI. The exact version in which the v1 UI will be completely removed has not yet been determined, but it will be after version 3.16.

The new v2 react-based UI is now the default UI. We encourage customers to explore the updated interfaces and workflows in preparation for this transition.

The Container Security Operator has been deprecated and is planned for removal in a future release of Red Hat Quay and OpenShift Container Platform. The official replacement product of the Container Security Operator is Red Hat Advanced Cluster Security for Kubernetes.

After an image is built successfully when using the Red Hat Quay v2 UI, users are unable to download the build logs. Attempting to click the Download button on the v2 UI results in the following error: 404 Not Found.

As a temporary work around, you can download build logs by using the v1 UI.