[ProGet] Unexpected redirect when accessing Maven package with non-standard version starting with a character

[koksime.yap_5909]

Hi ProGet team,

I’ve encountered an issue when uploading Maven packages to ProGet that use non-standard version strings starting with a character.

Example:

• Package name: package-alpha-0.1.pom
• Version: alpha-0.1

When I upload this package and then try to access the .pom file directly from the feed, instead of downloading the file as usual, the browser is redirected to a page ending with / (e.g., .../package-alpha-0.1/), rather than returning the file contents.

However, this behavior does not occur when the non-standard version starts with a number.
For example:

• 0.1_a-l-p-h-a works correctly — the .pom file is downloaded normally.

Steps to Reproduce:

1. Upload a Maven package with a non-standard version starting with a letter (e.g. alpha-0.1).
2. Attempt to access the .pom file directly from the feed URL.
3. Observe that the request is redirected to a URL ending in / instead of downloading the file.

Expected Behavior:
Accessing the .pom file should return the file contents directly, similar to when using a numeric-starting version.

Actual Behavior:
Accessing the .pom file with a version starting with a character causes a redirect, preventing the file from being downloaded.

Questions:

• Is this the expected behavior in ProGet for non-standard Maven versions?
• If not, how can I configure ProGet or the Maven feed so that files with such versions are handled correctly (i.e., downloaded instead of redirected)?

Environment:

• ProGet version: 25.0.12; container
• Feed type: Maven
• Client: Browser / curl

Thanks for your help!

[atripp]

Hi @koksime-yap_5909 ,

I'm afraid this is a known limitation with Maven feeds; we made the assumption that package authors would follow the bare-minimum of Maven versioning: packages start with letters, versions start with numbers.

The only examples we found that were counter to that were 20+ year old artifacts, however, we've since learned that authors still mistakenly use these incorrect versions.

Unfortunately, supporting these types of versions require a complex/risky change.

Maven is a file-based API and the client just GETs/PUTs files. However, ProGet is not a file server so we need to actually parse the URLs to figure out which artifact/package the files refer to. In this case, we parse package-alpha-0.1 as package-alpha (version 0.1), not package (version alpha-0.1). Hence, why it's not working.

If these are your internal packages, the easiest solution is to follow the standard:
https://docs.oracle.com/middleware/1212/core/MAVEN/maven_version.htm

Thanks,
Alana