Lots of errors after upgrading to Proget 2025.3 (Build 9)

v.makkenze_6348

Hi,

We upgraded to Proget 2025.3 (Build 9) and switched to the internal Postgres database.
But now our builds are starting to fail, in the diagnostic center I see a few different errors.

Unhandled exception processing https://packages.vicrea.nl/api/sca/import
System.InvalidOperationException: Nullable object must have a value.
Connector error: The operation has timed out.
System.Net.WebException: The operation has timed out.
An error occurred processing a POST request to https://packages.vicrea.nl/npm/VicreaNpmJs/-/npm/v1/security/advisories/bulk: The operation has timed out.

We also had to switch from IIS to the integrated web server.
Here are the details of the errors

An error occurred processing a POST request to https://packages.vicrea.nl/npm/VicreaNpmJs/-/npm/v1/security/advisories/bulk: The operation has timed out.

System.Net.WebException: The operation has timed out.
   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location ---
   at System.Net.WebRequest.GetResponseAsync()
   at Inedo.ProGet.Feeds.Npm.NpmConnector.ProxyRequestAsync(AhHttpContext context, String relativeUrl)
   at Inedo.ProGet.WebApplication.FeedEndpoints.Npm.NpmAuditHandler.TryProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, NpmFeed feed, String relativeUrl)
   at Inedo.ProGet.WebApplication.FeedEndpoints.Npm.NpmHandler.ProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, NpmFeed feed, String relativeUrl)
   at Inedo.ProGet.WebApplication.FeedEndpoints.FeedEndpointHandler.FeedRequestHandler.ProcessRequestAsync(AhHttpContext context)

::Web Error on 7/7/2025 2:37:47 PM::

Connector error: The operation has timed out.

System.Net.WebException: The operation has timed out.
   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location ---
   at System.Net.WebRequest.GetResponseAsync()
   at Inedo.ProGet.GlobalExtensions.GetResponseAsync(HttpWebRequest request, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Connector.GetDirectResponseAsync(String url, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Connector.GetCachedResponseAsync(String url, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Npm.NpmConnector.GetCachedResponseWith404Async(String url, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Npm.NpmConnector.GetPackagesAsync(PackageNameId name, String version, CancellationToken cancellationToken)+MoveNext()
   at Inedo.ProGet.Feeds.Npm.NpmConnector.GetPackagesAsync(PackageNameId name, String version, CancellationToken cancellationToken)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()
   at Inedo.ProGet.GlobalExtensions.ExceptionHandlingAsyncEnumerable`1.ExceptionHandlingAsyncEnumerator.MoveNextAsync()

::Feed Error on 7/7/2025 2:39:07 PM::

Unhandled exception processing https://packages.vicrea.nl/api/sca/import

System.InvalidOperationException: Nullable object must have a value.
   at System.Nullable`1.get_Value()
   at Inedo.ProGet.Projects.BomUtil.ImportBuild(Bom bom, Byte[] originalSbomBytes, String originalFormatCode)
   at Inedo.ProGet.Projects.BomUtil.ImportXmlAsync(Stream source)
   at Inedo.ProGet.WebApplication.SimpleHandlers.Api.Bom.ScaApiHandler.ProcessRequestAsync(AhHttpContext context, LoggedResponseStream output, WebApiContext apiContext)
   at Inedo.ProGet.WebApplication.SimpleHandlers.Api.ProGetApiKeySecuredHandler.ProcessRequestInternalAsync(AhHttpContext context, LoggedResponseStream output, WrappedApiKey apiKey)
   at Inedo.Web.Handlers.Api.ApiKeySecuredHandler.ProcessRequestInternalAsync(AhHttpContext context)
   at Inedo.Web.Handlers.Api.StandardApiHandler.ProcessRequestAsync(AhHttpContext context)

:: Error on 7/7/2025 3:17:01 PM::

Failed to fetch package tags for path-to-regexp from registry.npmjs.org.



::Feed Warning on 7/7/2025 2:49:23 PM::

stevedennis

Hi @v-makkenze_6348 ,

The SCA Import "Nullable object must have a value" is likely coming from data in your SBOM XML. It's likely unrelated to Postgres, and more related to the library upgrades. Can you share with us the SBOM document you are uploading?

The Connect errors are unrelated to your switch. Based on the stack trace, it looks like you have a no-longer-supported setting called auding proxying enabled, and npmjs.org is timing out while making that request. You should disable that by navigating to the npm feed's "Manage Feed" page and configuring npm audit setting to Enabled or Disabled.

Thanks,
Steve

v.makkenze_6348

@stevedennis we switched back to latest 2024 version and SQL server and the builds are working again. I can't include the SBOM in the post as its to large, can I mail it or upload it somewhere?

I switched the nps feed audit to enabled (use ProGet's vulnerabilities and assessments)

stevedennis

@v-makkenze_6348 can you email it to support at inedo dot com with [QA-2775] in the subject, and let us know when you sent it? We can find it then

Thanks

v.makkenze_6348

@stevedennis I sent the SBOM to support

stevedennis

@v-makkenze_6348 thanks, unfortunately I wasn't able to reproduce it

Can you try a manual import by going to Reporting & SCA > Projects & Builds > Import SBOM > paste in your SBOM?

If that gives an error, can you also try to edit application name/version in the XML before pasting? Fox example, change it to:

    <component type="application">
      <name>MyTestProject</name>
      <version>25.3.85.1</version>
    </component>

That will create it as a new project/build.

Just trying to figure where the issue might be.

Thanks,
Steve

v.makkenze_6348

@stevedennis we went back to an older version that doesn't break our builds and accepts this SBOM

I tried to reproduce it in a docker image but then i need a license key and the latest docker image version isn't build 9 but 6

stevedennis

Hi @v-makkenze_6348 ,

You can use a ProGet Trial Key or if this is just a quick temporary instance, just use your existing license key to try it out.

Thanks,
Steve

v.makkenze_6348

@stevedennis I tried in a docker image but also could not reproduce it reading SBOM from the UI. We have a major release ahead perhaps i can try after the release, but failing builds scares people me included.