Hi all, I have a followup question regarding the assessments. Am I only able to assess vulnerabilities that are already present in my products? What if a new vulnerability is found which does not affect any of my products yet but I want to avoid future products to use affected packages? In ProGet 2025 we were using a manual assessment called "Manually Blocked" which was assigned to a new vulnerability, made all packages noncompliant and blocked the download. This way we were able to prevent vulnerabilities in our products before they could happen. Thanks Caterina

@stevedennis sounds perfect, thanks Steve! :)

Hi @amy.j , If the package is already cached in ProGet, then the publish date is already set. So, i would make sure to delete the package and try it again. Otherwise, can you share more specifics? That way we can create a reproduction case. Thanks, Alana

Hi @Nils-Nilsson , That message appears to be coming from SetCommand.cs#L91... is it possible you're not on the latest pgutil (i.e. 2.4.2)? That would be my guess... -- Dean

@dean-houston Interestingly, this issue is not happening now. After the update to the latest version it was happening, but then I restarted the server BuildMaster is on (unrelated, needed Windows Updates), it has seemingly resolved itself. So I guess this can be closed?

Hi @bobmaurer , We recommend to import those packages into ProGet and publish to ProGet going forward. That keeps ProGet as the source of truth for your artifacts, reduces a lot of network traffic, makes it easier for developers to not worry about multiple sources, and eliminates a lot of possible headaches later with configuration/outages/authentication./etc. Much simpler this way. Best, Alana

Hi @rhessinger, I have now tested 26.0.9-ci.1 in a test instance and I can confirm it is working exactly as expected. Thanks for the quick response again! Joris

Hi @dean-houston, I think there might be a little bit of a misunderstanding. I'm not really evaluating the product. I'm selling the product. I've been using BuildMaster for over 10 years (I'm thinking 14 or 15) and most of which as a paying customer. I started a new job last year and I'm once again I've decided to try to sell your product to my employer. Previously I've just had to do a presentation on the product to get the company on board. Here, unfortunately, I need to do a little more show-n-tell rather than talk about the product. Not only that but this is the first place I've worked at that has a workflow quite like it does so it has brought up questions I didn't have to deal with, but I've never had any doubt I could/would accomplish what I needed. Since I know how hard of a sell this will be I'm trying to put extra effort in to coming up with the best demo possible and is leading to some of the questions. Thankfully I think I'm near the end of building what I need to build so hopefully will not be doing too many more posts on the forum. I really do appreciate all the time you and others have given to respond to my posts but I do feel a bit bad for how many and how complex my posts of been. Unfortunately I do not really know when I'll finally do the demo/presentation to my superiors, and I am kind of hoping I can wait until 2026 comes out before I do. I hate to sell a product and the version my pitch is based on is no longer the newest :-). Thank you, Brandon

Thanks @sigurd.hansen_7559 ! All right, I'm convinced.... this makes a lot more sense now to do now! I didn't quite realize that Microsoft does not allow non-VSCode clients to connect to their Marketplace, nor did I realize there were so many VSCode forks. The current plan is to create a new feed type called "Open VSIX" or something that will support connectors. It should also be able to handle the "multi-file packages" (i.e. how the same extension can have multiple .vsix files but different architectures). We should be able to just reverse engineer the VSIX API as well. That's clearly Open VSIX did; it's not all that complex I think. I've just now updated the other feed types; we don't have a date just yet, but it should e in the coming months. We'll keep this thread up to date.

Hi @jimbobmcgee , Long story short, "we're not entirely sure anymore." You've picked up on the original intent: these are intended to provide UI-based inputs around script parameters. And they do "mostly" show up in the use case you identify (i.e. when creating a Job Template for the first time)... but they are overall a glitchy feature. They were also intended to allow for Param()-like support to other scripting languages, so you'd simply need to add that header to the script and it would just "work" in OtterScript and job templates. From an engineering standpoint, we had planned to improve all of these after Otter 2022 (when they were first released), but our R&D priorities suddenly shifted. So we haven't had time to revisit them (or other Otter features we wanted to do), and they're basically in that same glitchy state Personally I thought they were a pretty neat idea, and it's just unfortunate we weren't able to take them further. But, so it goes with development priorities... -- Dean

@brandon_owensby_2976 fantastic!! Thanks much; I'll let our technical writing team review/accept it, They should within a day or so -- Dean

Hello @atripp , I've now had a chance to try out the new version of PGUtil and the changes are working great. Thank you for your assistance :) Best Regards Nils Nilsson

I've had a chance to test the new version of pgutil now and it works perfectly, thank you. Best regards Nils Nilsson

Hi @dean-houston . Thank you for your response, it makes sense that you wouldn't prioritize this, as I assume my organization is quite an outlier where we need to have one policy for every application that utilizes ProGet. Best Regards Nils Nilsson

Hi @cyril , Thanks for checking; that would be fine. Note you'll have to enter a license key in your scripts (free is fine), as ProGet will not automatically create a license key. Aside from various features missing from Free edition, one restriction is that ProGet Free can't connect to other instances of ProGet. The software will generally enforce this as well. -- Dean

Hi @daniel.pardo_5658, This behavior is somewhat expected. I'm not really a Debian expert or anything... but when it comes to a Debian repository index, all is actually the name of a component. When we look the index files, we can see: ubuntu-jammy has all components ubuntu-jammy-updates has no all components ubuntu-jammy-security has no all components ubuntu-noble has all components ubuntu-noble-security has all components ubuntu-noble-updates has all components I would have thought that any means "any component", but apparently it doesn't. So I guess you have to specify that list if you want it to work. -- Dean

Hi @brad.zinser , This is somewhat expected, although the error could be improved. You're sending a Content-Type: application/json or similar header, which will attempt to read the content body -- but since it's a GET request, there's no body. And at some point, that error occurs. -- Dean