Hello @atripp , I've now had a chance to try out the new version of PGUtil and the changes are working great. Thank you for your assistance :) Best Regards Nils Nilsson

I've had a chance to test the new version of pgutil now and it works perfectly, thank you. Best regards Nils Nilsson

Hi @dean-houston . Thank you for your response, it makes sense that you wouldn't prioritize this, as I assume my organization is quite an outlier where we need to have one policy for every application that utilizes ProGet. Best Regards Nils Nilsson

Hi @dean-houston Thank you for the detailed response. I'll dive into the properties set and retention create commands to see if the current implementations already cover our automation usecase. Fair point about the API, then I'll continue to default to using PGUtil so that you at least have one less user depending on the API in case you want to supercede/deprecate it in the future :) Best Regards Nils Nilsson

Hi @rhessinger, We have now upgraded to 26.0.8 and are still facing a very similar error. I can confirm the month field is now correct but comparing the pubtime value to crates.io think the end of the field is incorrect. From https://doc.rust-lang.org/cargo/reference/registry-index.html: The format is a subset of ISO8601: - `yyyy-mm-ddThh:mm:ssZ` - no fractional seconds - always `Z` for UTC timezone, no timezone offsets supported - fields are 0-padded Example: 2025-11-12T19:30:12Z For reference proget is returning: 2026-06-30T19:34:05.265596Z (note the fractional seconds). Thanks, Joris

I think its popular, not just because it's the default gallery for VSCodium, but also for a bunch of other VS Code forks (Cursor, VSCode-based IDEs and other forks) that can’t or won’t rely on Microsoft’s marketplace. We also looking for an air-gapped lightweight offline marketplace. Perhaps the reverse-engineering work OpenVSX has already done could be reused to expand ProGet's functionality? Apidocs, Swagger, Github -Sigurd

@brandon_owensby_2976 I definitely do not recommend it, but if you are intent on creating something that automatically promotes feature branch builds to a "rejected" stage, you could code a custom PromotionRequirements. You'd be much better doing something on the GitHub side that promotes a build using the API, however.

Hi @cyril , Thanks for checking; that would be fine. Note you'll have to enter a license key in your scripts (free is fine), as ProGet will not automatically create a license key. Aside from various features missing from Free edition, one restriction is that ProGet Free can't connect to other instances of ProGet. The software will generally enforce this as well. -- Dean

Hi @daniel.pardo_5658, This behavior is somewhat expected. I'm not really a Debian expert or anything... but when it comes to a Debian repository index, all is actually the name of a component. When we look the index files, we can see: ubuntu-jammy has all components ubuntu-jammy-updates has no all components ubuntu-jammy-security has no all components ubuntu-noble has all components ubuntu-noble-security has all components ubuntu-noble-updates has all components I would have thought that any means "any component", but apparently it doesn't. So I guess you have to specify that list if you want it to work. -- Dean

Hi @brandon_owensby_2976 I'm afraid we have no plans to touch the (current) retention policies code. It's very sensitive -- and it has quite a few quirks -- but it does work fine once you know how to use it. At some point, we would like to just rebuild the feature from the ground-up and introduce it as a side-by-side feature. But that's quite an effort and it's not our roadmap at this time I'm afraid. --Dean

Hi @brad.zinser , This is somewhat expected, although the error could be improved. You're sending a Content-Type: application/json or similar header, which will attempt to read the content body -- but since it's a GET request, there's no body. And at some point, that error occurs. -- Dean

Hi @brad.zinser , I'm having a bit of a hard time reproducing this or figuring out how this might be possible. What kind of CI do you have set-up? Did you configure anything via the API? If so, would you be able to share the XML used for the underlying Secure Resource (it's in the SecureResources table if you're poking around in the Database)? You can also go to Admin > Secure Resources to get a more "raw" view of this. As an FYI, here's the code where it's failing: [image: 1786126801171-38a275e7-8e5f-4062-992c-61405d435dee-image.jpeg] However, that property (project.LastSync) is set in exactly one place (project.LastSync = DateTime.UtcNow;), so it doesn't make a lot of sense to me. Let us know what you find! -- Dean

Hi @brad.zinser , This is expected behavior across our products... both the Diagnostic Center and Native API require system/admin-level access, so it's not exposing any information administrators can't already easily see. Note that, you can also see the API key exposed in standard HTTP access logs as well if you pass via the query string, so the X-ApiKey header may be better anyway. Thanks, Alana

Hi @caterina , Glad this is working now! I have no idea what it could have been.... maybe there was some kind of platform/library regression. We didn't make any WIA/AD/LDAP changes -- just went from .NET8 to .NET10. This stuff is a bit fragile, as you're noticing Anyway, all good for now! THanks for letting us know -- Dean

Thank you @stevedennis, really appreciated!

Hi @Ashley, It wouldn't make sense to try removing "vulnerable packages" from storage -- in fact, even download blocking doesn't make sense in most cases, as it tends to lower the organization's security posture and leads to other problems. Even the package with the "world's most severe vulnerability" (i.e. the infamous log4shell) is harmless unless it's incorporated in an application in a certain way and the application is exposed in a certain manner that would allow a malicious actor to exploit it. Trying to block access or remove these harmless library files from the network will substantially lower the organization's security posture, for a number of reasons. I'd encourage you to check out our best practices guide: Vulnerability Management Done Right with ProGet. In particular: Preparing for a Category 5 Vulnerability to learn how to handle the "next" severe vulnerability Blocking & Containing Vulnerable Packages for general best practices in addressing them in pipelines I think the Preparing for a Category 5 article will help you create that template process for what to do when that high vulnerability package is is identified. Hope that helps -- Dean

Hi @a.sieger , I would push back on that "hard requirement" because it doesn't make any technical or business sense, and will only lead to support headaches just like this. There is something wrong with your PostgreSQL server configuration, perhaps permission related, that's causing the database to not be created. The error cannot be logged in the database because it doesn't exist. I would delete the database and start again, but verify you've created the database exactly as specified using the exact version supported: https://docs.inedo.com/docs/installation/postgresql#external-postgres Things like improper locales will cause errors. Then, don't run ProGet detached (i.e. ommit -d) so you can get the console logs. That's where you will see database errors. You can also run the upgradedb command instead: https://docs.inedo.com/docs/installation/linux/installation-upgrading-docker-containers#upgrading-the-database-only-optional Please let us know what you find! Hope that helps, Alana

@atripp thanks