Proget is unable to download Maven packages that use a nonstandard versioning scheme

joshua.mitchell_8090

Hello,

We have a connector setup to download packages from Maven central. One of the packages we are pulling is: org.jobrunr:jobrunr-bom:v8.5.0 which seems to be having issues downloading through Proget due to the 'v' at the start of the version number.

I did hear that a patch for this was coming. Would it be possible to give it a test drive?

Thanks,
Josh

atripp

Hi @joshua-mitchell_8090 ,

Thanks for the inquiry! The changes are available in the inedo/proget:25.0.24-ci.4 container image, and we'd love to get a second set of eyes. Are you using Docker?

They're relatively simple, but we just avoid changing stuff like this in maintenance releases... so it's currently slated for ProGet 2026.

But it should be okay for a maintenance release. Please let us know, we'll decide to release based on your or other user feedback.

Here's what we changed.

First, we added a "sixth" component called IncrementalVersion2 that will support versions like 1.2.3.4-mybuild-678 (where 4 is the second incrementing version), so that vulnerability identification can work better. Our implementation is based on the the Maven version specs, which in retrospect, seems to be followed only by ProGet. Pretty low risk here.

Second, we changed our "path parsing" logic, which identifies the groupId, artifactId, version, artifactType from a string like /junit/junit/4.8.2/junit-4.8.2.jar into /mygroup/more-group/group-42/my-artifact/1.0-SNAPSHOT/maven-metadata.xml.

It's a little hard to explain, so I'll just share the new and old logic:

//OLD: if (urlPartsQ.TryPeek(out string? maybeVersion) && char.IsNumber(maybeVersion, 0))
if (urlPartsQ.TryPeek(out string? maybeVersion) && (
    char.IsNumber(maybeVersion, 0)
    || maybeVersion.EndsWith("-SNAPSHOT", StringComparison.OrdinalIgnoreCase)
    || (this.FileName is not null && !this.FileName.Equals("maven-metadata.xml", StringComparison.OrdinalIgnoreCase))
    ))
{
    this.Version = maybeVersion;
    urlPartsQ.Pop();
}

Long story short, this seems to work fine for v8.5.0 and shouldn't break unless someone is uploading improperly named artifact files (e.g. my-group/my-artifact/version-1000/maven-metadata.xml or e.g. my-photo/cool-snapshot/hello-kitty.jpg).

Thanks,
Alana

joshua.mitchell_8090

@atripp
Thanks Alana,

We are using podman so it should be the same process as Docker. We'll give it a try and let you know if we run any issues.

Thanks,
Josh

joshua.mitchell_8090

@atripp
Seems to be working perfectly so far. Another question for you though; Do the changes affect how the dependencies are identified within the project build vulnerabilities? We had a look at it before the update with a trial license, but that expired before we upgraded.

Thanks,
Josh

atripp

Thanks @joshua-mitchell_8090 , we'll consider merging it in then!

As for "how the dependencies are identified within the project build vulnerabilities", I suppose so - the IncrementalVersion2 will allow for proper vulnerability associated with packages that use "incorrect" versions (like 1.2.3.4). Jackson Databind is the one we kept coming across.

Note you can request another trial key from my.inedo.com to try it out :)

devops-user

Hi,

I have a similar issue and we already have the latest ProGet version installed. We have created a maven central connector and a feed with this connector attached.
My project needs to download many dependencies with non‑semver artifact versions, for example:
https://mvnrepository.com/artifact/org.springframework.data/spring-data-releasetrain/Neumann-SR9

What is ProGet’s recommended solution for this kind of problem? Very often, we can't simply move to other versions/artifacts with proper semver versions. We are blocked

atripp

Hi @devops-user ,

Can you try out the container image above? We'd like to get confirmation that it's working and we can then merge it to ProGet 2025 (we were otherwise planning ProGet 2026).

Thanks
Alana

devops-user

I'm afraid I'm not able to test it. I'm currently using Inedo Hub on a Windows Server.

atripp

Hi @devops-user ,

No problem, I just pushed Release 2025.25-rc.1.

It's based simply the 2025.24 release with the Maven patch added in. You can install like this:
https://docs.inedo.com/docs/installation/windows/inedo-hub/howto-install-prerelease-product-versions

Thanks,
Alana

joshua.mitchell_8090

Hello,
We have run into one very minor issue when navigating to a feed group and showing packages. For this specific package, we see an error on screen (It still pulls it fine, it just seems to fail when displaying) com.fasterxml.jackson.core:jackson-databind:2.19.4

When navigating to it directly via the URL
https://example.com/feeds/REDACTED-FEED-group/com.fasterxml.jackson.core/jackson-databind/2.19.4

Not sure what this view called (Maven Apache view?) but it works fine when displaying and downloading artifacts.
https://example.com/feeds/REDACTED-FEED-group/com/fasterxml/jackson/core/jackson-databind/2.19.4/

Navigating to the summary of all the versions works fine, but does not display version 2.19.4, only the older versions which were using an invalid maven version.

Here is the message from the Diagnostic Center

An error occurred in the web application: 22001: value too long for type character varying(1000)

URL: http://example.com/feeds/REDACTED-FEED-group/com.fasterxml.jackson.core/jackson-databind/2.19.4
Referrer: https://example.com/projects2/packages?buildId=21&skip=0&take=1000
User: JoshuaM
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:149.0) Gecko/20100101 Firefox/149.0
IP Address: ::ffff:172.18.1
Stack trace:    at Npgsql.Internal.NpgsqlConnector.ReadMessageLong(Boolean async, DataRowLoadingMode dataRowLoadingMode, Boolean readingNotifications, Boolean isReadingPrependedMessage)
   at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder`1.StateMachineBox`1.System.Threading.Tasks.Sources.IValueTaskSource<TResult>.GetResult(Int16 token)
   at Npgsql.NpgsqlDataReader.NextResult(Boolean async, Boolean isConsuming, CancellationToken cancellationToken)
   at Npgsql.NpgsqlDataReader.NextResult(Boolean async, Boolean isConsuming, CancellationToken cancellationToken)
   at Npgsql.NpgsqlDataReader.NextResult()
   at Npgsql.NpgsqlCommand.ExecuteReader(Boolean async, CommandBehavior behavior, CancellationToken cancellationToken)
   at Npgsql.NpgsqlCommand.ExecuteReader(Boolean async, CommandBehavior behavior, CancellationToken cancellationToken)
   at Inedo.ProGet.Data.PostgresDatabaseContext.PostgresCommand.ExecuteReader() in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E649756\Src\src\ProGet\Data\PostgresDatabaseContext.cs:line 372
   at Inedo.Data.DatabaseContext.ExecuteInternal(String storedProcName, GenericDbParameter[] parameters, DatabaseCommandReturnType returnType)
   at Inedo.Data.DatabaseContext.ExecuteNonQuery(String storedProcName, GenericDbParameter[] parameters)
   at Inedo.ProGet.Policies.ComplianceMan.AnalyzePackageInternalAsync(IPackageFeed feed, IPackageMetadata package, Boolean alwaysReanalyze, Func`2 getLocalLatestPatchVersion, ILogSink log, CancellationToken cancellationToken) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E649756\Src\src\ProGet\Policies\ComplianceMan.cs:line 136
   at Inedo.ProGet.WebApplication.Pages.Packages.PackageOverviewPage.<AddContentControlsAsync>b__5_11(IPackageMetadata p) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E649756\Src\src\ProGet\WebApplication\Pages\Packages\PackageOverviewPage.cs:line 137
   at System.Linq.AsyncEnumerable.SelectEnumerableAsyncIteratorWithTask`2.MoveNextCore()
   at System.Linq.AsyncIteratorBase`1.MoveNextAsync() in /_/Ix.NET/Source/System.Linq.Async/System/Linq/AsyncIterator.cs:line 70
   at System.Linq.AsyncIteratorBase`1.MoveNextAsync() in /_/Ix.NET/Source/System.Linq.Async/System/Linq/AsyncIterator.cs:line 75
   at System.Linq.OrderedAsyncEnumerable`1.TryGetFirstAsync(CancellationToken cancellationToken) in /_/Ix.NET/Source/System.Linq.Async/System/Linq/Operators/OrderedAsyncEnumerable.cs:line 269
   at System.Linq.OrderedAsyncEnumerable`1.TryGetFirstAsync(CancellationToken cancellationToken) in /_/Ix.NET/Source/System.Linq.Async/System/Linq/Operators/OrderedAsyncEnumerable.cs:line 290
   at System.Linq.AsyncEnumerable.<FirstOrDefaultAsync>g__Core|91_0[TSource](IAsyncEnumerable`1 source, CancellationToken cancellationToken)
   at Inedo.ProGet.WebApplication.Pages.Packages.PackageOverviewPage.<AddContentControlsAsync>g__createPackageStatusInfoAsync|5_1() in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E649756\Src\src\ProGet\WebApplication\Pages\Packages\PackageOverviewPage.cs:line 135
   at Inedo.ProGet.WebApplication.Pages.Packages.PackageOverviewPage.AddContentControlsAsync(ContentContainer content) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E649756\Src\src\ProGet\WebApplication\Pages\Packages\PackageOverviewPage.cs:line 38
   at Inedo.ProGet.WebApplication.Pages.Packages.PackagePageBase.CreateChildControlsAsync() in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E649756\Src\src\ProGet\WebApplication\Pages\Packages\PackagePageBase.cs:line 91
   at Inedo.ProGet.WebApplication.Pages.ProGetSimplePage.InitializeAsync() in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E649756\Src\src\ProGet\WebApplication\Pages\ProGetSimplePage.cs:line 69
   at Inedo.Web.PageFree.SimplePageBase.ExecutePageLifeCycleAsync()
   at Inedo.Web.PageFree.SimplePageBase.ProcessRequestAsync(AhHttpContext context)
   at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)

::Web Error on 31/03/2026 1:58:15 pm::

devops-user

@atripp thank you for the update. I installed this version, and it looks like it finally works!

Regarding the issue described by @joshua-mitchell_8090, I’m not experiencing the same behaviour. On our server, I can see the same package.

atripp

Hi @devops-user @joshua-mitchell_8090 ,

Thank you so much for testing! We'll merge this in via PG-3251 in tomorrow's maintenance release.

As for the other error, it's technically unrelated - but that package has such a long "compliance analysis report" that it's getting truncated in the database cache. PostgreSQL complains about that, SQL Server silently does it. Anyway w'ell fix via PG-3250 perhaps in tomorrow's release as well.

Cheers,
Alana