ProGet 2025 issues

petter.jacobsen_7171

Hi!

We’re currently evaluating ProGet and have encountered several issues with version 2025.0 (Build 27) (+ MSSQL), primarily while testing the Debian feed. We did not have the same issues with 2024.38 (Build 1), everything worked as expected.

Issues encountered:

1. License Management – Unable to remove assigned license
Once a license is assigned to a package with "Unknown licensing", there doesn’t appear to be any way to remove it. Is this expected behavior?

2. "Set Package Status" Causes a 500 error
Clicking Set Package Status results in a 500 Internal Server Error:

An error occurred in the web application: Object reference not set to an instance of an object.
URL: http://proget.example.com/packages/status?feedId=5&packageName=netcat-traditional&version=1.10-48
Referrer: https://proget.example.com/feeds/petter-ubuntu/netcat-traditional/1.10-48/metadata
User: Admin
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Stack trace:    at Inedo.ProGet.WebApplication.Pages.Packages.SetPackageStatusPage.CreateChildControlsAsync() in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E565156\Src\src\ProGet\WebApplication\Pages\Packages\SetPackageStatusPage.cs:line 38
   at Inedo.ProGet.WebApplication.Pages.ProGetSimplePage.InitializeAsync() in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E565156\Src\src\ProGet\WebApplication\Pages\ProGetSimplePage.cs:line 69
   at Inedo.Web.PageFree.SimplePageBase.ExecutePageLifeCycleAsync()
   at Inedo.Web.PageFree.SimplePageBase.ProcessRequestAsync(AhHttpContext context)
   at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
::Web Error on 06/18/2025 12:13:27::

3. Unable to block specific packages manually
We couldn’t find a way to manually block specific packages. Is this supported?

4. Feed/Global Policies not enforcing blocking as expected
Packages marked as Noncompliant are still downloadable, despite both feed-level and global policies set to deny such downloads. This also includes filtered packages via connectors.

5. Deleting "Local Packages" fails
Attempting to delete local packages appears ineffective — they reappear immediately after deletion. Is there a proper method to permanently remove them?

6. Inconsistent feed policy messaging
The UI sometimes shows contradictory messages — e.g., the title says “Blocked” while the accompanying text says “not prevented from being downloaded.” We’ve observed this inconsistency across both the Debian and npm feeds.

7. npm Packages not blocked despite being Noncompliant
Example: We are able to download an npm package that is marked as Non-compliant, even though our policies should block it.

8. Rollback to 2024 failed
https://docs.inedo.com/docs/proget-upgrade-2025 says
"However, if you need to rollback to ProGet 2024, you can do so without restoring the database by simply using the Inedo Hub. While there are database schema changes, they are all backwards-compatible with ProGet 2024, which means you can safely rollback your ProGet installation if there's a showstopper bug, and then upgrade later."

When we tried to roll back to 2024 we got database issues with missing procedures like:

Unhandled exception: Could not find stored procedure 'PackageContainerScanners_GetScanners'.

Note that we did a fresh install of 2025 on a clean database. Then we rolled back to 2024. Maybe it would have worked if we installed 2024 first, then upgraded to 2025 and then rolled back to 2024.

Thanks,
Petter

rhessinger

Hi @petter-jacobsen_7171,

Thanks for submitting all this detail. I just wanted to let you know we are currently reviewing these items and will have an update later today.

I did want to make not that rollback is only supported when you upgrade from 2024 to 2025, then you will be able to downgrade back to 2024. With that said, that connector error may go away by simply restarting the ProGet services. If not, you can also try to uninstall 2024 and then reinstall it again and point to the existing database. That will force the schema update to rerun and should add back that missing stored proceedure.

rhessinger

Hi @petter-jacobsen_7171,

I took a look through these and I have some more answers for you:

Looks like you added the package string to the license. You will need to navigate to Reporting & SCA -> Licenses -> manager license types & rules, then find that license, edit it, and remove the package string under the PUrls tab.
This looks to have been fixed in ProGet 2025.1 that released last night.
You can block a specific package on the Set Package Status page.
There does look to be an issue in policies, but I will need to dig into this further to determine exactly what the issue is. I will be looking into this more tomorrow.
I was unable to recreate this issue. It may have been fixed in 2025.1 or it may have been related to something else. Please note that if the package is in a connector, then the package will show in your feed once you delete it as a remote package.
This may be related to the issue in 4, I will update on this once i have dug in further.
Again, this looks to be related to an issue in policies.
I addressed this in my previous comment, but just wanted to call it out for completeness sake.

I should have an update tomorrow for you with more specifics around the blocking issues. Please let me know if you have any questions regarding my responses!

Thanks,
Rich

rhessinger

Hi @petter-jacobsen_7171,

Just an update. It looks like I have found some issues with our policies. I have created tickets PG-3015 and PG-3016 to track the fix. These are expected to be released in ProGet 2025.2 at the end of the week.

Thanks,
Rich

petter.jacobsen_7171

Hi, @rhessinger!

Thank you for looking into this. I will do some retesting as soon as the 2025.2 is released.

Thanks,
Petter