@rhessinger, Thanks for the quick turnaround, Rich. Tested it — unfortunately it doesn't fix the issue against Samba 4. What I did: Pulled InedoCore-4.0.6-rc.1 from the pre-release extensions feed and confirmed the manifest (version: 4.0.6-RC.1, built 2026-09-23 against ProGet 26.0.11). Swapped it in for the stock 4.0.5 extension on our POC instance and restarted ProGet. Confirmed the new build actually loaded (not a stale/failed load) — the extension cache picked up new dependencies that weren't present before (Novell.Directory.Ldap.NETStandard.dll, System.DirectoryServices.Protocols.dll). Result: re-ran the same real package-client request (aduser1 against our nuget-proxy feed) that's failed every time before. Still 401, with the identical signature in the log: Begin LDAP Get Search Results LdapReferralException LdapReferralException LdapReferralException End LDAP Get Search Results No change in behavior at all versus the stock 4.0.5 build. I've reverted our instance back to stock 4.0.5 for now. Happy to gather anything else that'd help you narrow it down — e.g. a packet capture / verbose LDAP trace from our side, or trying a specific config tweak if you have a theory about what's different in our Samba 4 setup versus whatever you tested referral-following against.

Hi @forbzie22_0253, Unfortunately, this is still required. By default on Windows, HTTP.sys reserves all ports below port 1024. The netsh http add urlacl url=https://*:443/ user="NETWORK SERVICE" tells HTTP.sys that NETWORK SERVICE can register port 443 and listen to all traffic on it bypassing HTTP.sys. If you specified a domain, https://my-domain.com:443 instead of https:://*:443, then HTTP.sys will handle all traffic but will allow NETWORK SERVICE to subscribe at that domain. HTTP.sys will still handle all traffic though. That will then cause the integrated web server (IWS) to use HTTP.sys instead of Kestrel, which is why we recommend the port binding method. This is all outside of IIS. That reason is also we added documentation on how to Use IIS as a reverse proxy. Hope this helps! Thanks, Rich

Apologies for opening this up again, would really appreciate any guidance on the below, thanks! In our external Maven feed, org.springframework:spring-webflux 6.2.19 shows as non-compliant due to the recently published policy. The module, sources.jar, and javadoc.jar show as published back in June (which is correct and therefore shouldn't be blocked). However, a publish date is not set for the pom file. Once the package is actually pulled into ProGet, the pom file publish date is set to the promoted date and is therefore blocked in the external feed. Also noticed a similar issue with some NuGet packages, displaying the publish date as 01/01/1900 00:00:00. Not sure if there's a bug if the publish date metadata cannot be retrieved? For some packages, the pom file just doesn't show when you look at the external feed. If you promote, it promotes without the pom file. If you explicitly download the pom file, it then appears in the external feed and can be promoted.

Hi @atripp, Thanks for your help, sorry for the delayed response, managed to get: file=charset_normalizer-3.5.1-cp315-cp315t-win_amd64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:31.8174663Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp315-cp315t-win_arm64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:32.3274737Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp315-cp315-win32.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:32.8039388Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp315-cp315-win_amd64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:33.3390871Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp315-cp315-win_arm64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:33.8613088Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-macosx_10_9_universal2.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:34.3671821Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:34.9172626Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:35.558689Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:36.2341244Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:36.8417108Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:37.4494827Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:37.9961457Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-musllinux_1_2_aarch64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:38.5043753Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-musllinux_1_2_armv7l.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:39.0233996Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-musllinux_1_2_ppc64le.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:39.4674686Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-musllinux_1_2_riscv64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:39.9063576Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-musllinux_1_2_s390x.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:40.3134429Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-musllinux_1_2_x86_64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:40.9705816Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-win32.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:41.6727141Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-win_amd64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:42.3853947Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp37-abi3-win_arm64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:42.9522367Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-macosx_10_9_universal2.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:43.4929845Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:43.9617852Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:44.4997797Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:44.9827533Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:45.4912838Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:45.9489875Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:46.5309503Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-musllinux_1_2_aarch64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:47.172294Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-musllinux_1_2_armv7l.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:47.7787538Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-musllinux_1_2_ppc64le.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:48.4112918Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-musllinux_1_2_riscv64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:49.0068696Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-musllinux_1_2_s390x.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:49.5011965Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-musllinux_1_2_x86_64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:50.1126332Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-win32.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:50.6986029Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-win_amd64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:51.2062978Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-cp39-cp39-win_arm64.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:51.7196177Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1-py3-none-any.whl {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:52.333452Z', 'detail': 'No license detected', 'statusText': 'Warn'} file=charset_normalizer-3.5.1.tar.gz {'resultCode': 'W', 'analysisDate': '2026-09-23T12:56:52.8264461Z', 'detail': 'No license detected', 'statusText': 'Warn'}

Hi @jw , Can you share us a copy of your database bacakup or export? I created a ticket that will allow you to upload this: EDO-13159 Once we have that, wecan investigate this further. Thanks, Alana

Hi @joris.guex, Sorry for the delay - I've been out of the office for a bit. I've logged this as PG-3379, scheduled for the next release of ProGet 2026.12 on Oct 2. I haven't looked at the code yet, but it should be another trivial fix to bring this fully up to spec. Thanks! -Greg

Hi @sai.pabbareddy, Glad to hear it all works as expected! Thanks, Rich

Hi @sai.pabbareddy, My apologies. Looks like I typoed the date on that other post. I had the day of Friday correct, but the date should have been Sept 18, 2026. It will be releasing later today (normally in the evening in EST). I updated that response also to have the correct date. Thanks, Rich

@rhessinger Thanks.

@atripp , Thanks for the info.

@atripp, Went back through your docs and our own notes trying to pin down a specific page, and honestly — we can't find one. The closest we got was a page showing how to create a Specified License Rule (e.g., setting GPL-3.0 to noncompliant), but every example there is clearly a user-configured policy, not a factory default. We think our original impression was a general one from early research rather than something we can point to a specific article for, so no need to go hunting on our end — sounds like it was just an assumption on our part rather than something your docs actually claimed. Good to have it confirmed either way: no default license rule ships out of the box, and creating one (GPL or otherwise) is expected as part of setting up a feed. We'll document it that way. Thanks, Sai

Hi @seanl_4808 , Like SAML, OIDC is not intended for developer/CLI tools, but desktop-based applications. I'm not aware of any client-tooling that supports or plans to support OIDC, so there's no sense in having a sever-based tool supported OIDC. API keys are considered the modern/secure solution. The reason that WIA/OIDC is considered less secure comes down to reducing the attack surface. A rouge user or process would be able to do very little with a limited-access ProGet API key, compared with domain credentials. Thanks, Alana

Hi @sai.pabbareddy , A 500 is an system error and would be logged under Admin > Diagnostic Center. It's possible there was system overload, network issues, who knows. I wouldn't worry about it. A 403 is a permission error that would be caused by configuration. It sounds like you resolved it by changing/modifying configuration, waiting for a cache to clear, etc. Thanks, Alana

Hi @sai.pabbareddy, [1] Here is some more information on PVRS vs CVSS: https://guides.inedo.com/vulnerability-management/cvss-pvrs/ Long story short, PVRS is designed for OSS dependencies and analyzes risk differently, in particular taking into account the custom risk profile you enter in ProGet (under Policies). [2] The NU1902 advisory comes from a vulnerability.base.json file that is cached both on the client end and ProGet end; you need to clear the http caches on NuGet (which you did), and ProGet will invalidate it about once an hour. You can force invalidation by restarting the service (Admin > Service) or manually assessing vulnerabilities (Admin > Vulnerabilities > Reassess), but that should only appear for test purposes. In a normal workflow the client will aggressively cache this file, and there's no real harm in having outdated information when following our recommended workflows. On that note.... we do NOT recommend you block downloads. It will actually lower your organization's security posture, not improve it. Please review this to learn how to "contain" properly: https://guides.inedo.com/vulnerability-management/containment/ Thank you, Alana

Crazy ... and this issue is still open https://gitlab.com/gitlab-org/gitlab/-/work_items/588736 That way the combination is not usable... I really wonder how the build in dotnet nuget tooling is working with the group feed.

Hey there, very nice to see this topic discussed here. Just my two cents: I'm running Grafana Alloy as a sidecar container, exporting the ProGet console output and the Nginx logs to a central Grafana instance. This gives me some visibility into how the application is running. Exporting the Logs from the database table via OpenTelemetry to some SIEM would be very nice too.

@atripp award for fastest forum response goes to you yep that seems to have solved it :) simple enough ;) Thanks! Maybe it would be an idea to highlight or add a little orange "stalled" badge on the ones in the list that causes the warning? Just a nice to have. Cheers Carl

Hi @certificatemanager_4002 , The API is a bit harder to use than just pgutil, so I'd suggest to use pgutil instead and it's easy to make a simple mistake like encoding something incorrectly. Without studying your code and having direct access to your ProGet instance, I cannot tell you what the issue is. But, since pgutil works we know the API is fine; here is the code that pgutil uses to delete the user: https://github.com/Inedo/pgutil/blob/thousand/Inedo.ProGet/ProGetClient.cs#L744 would suggest to use a local proxy tool like fiddler classic, proxyamn, postman, etc., that can capture and analyze local HTTP traffic so you can see the difference between what your code is doing and what pgutil is doing. Thanks, Alana

Hi @rob , When using the the subject name, the X509NameType.SimpleName is extracted and compared. Here's the specific logic: x509Store.Certificates.Where(c => c.GetNameInfo(X509NameType.SimpleName, false).Equals(config.Subject, StringComparison.OrdinalIgnoreCase)).OrderByDescending(c => c.NotAfter).FirstOrDefault() So if the "wrong" Server1 is being selected, I'm guessing it shares the same simple name. In scenarios like this, we recommend renaming the certificate (e.g. ProGetSsl), using a file, or the thumbprint. Thanks, Alana