Yeah, that's a nightmare and a half and I can see why you did that.

Currently I've tried repackaging the nuget but it brings about other errors, where it restores properly but later on in compile I get build errors. Right now I'm using the legacy version/older version of the nuget URL instead of the current v3 one until they get off of that package and I can remove it from my feed. It follows the format: https://url.domain/nuget/feedName/ instead of https://url.domain/nuget/feedName/v3/index.json .

@Dan_Woolf

Thanks for the update!

for the --append-dependencies flag do i only use that on the 2nd attempt?

@Dan_Woolf Thank you!

if it helps, my version is 2022.18 (Build 7)

@Dan_Woolf

Testing:
that test plan should work perfectly fine for me. We have 2 main scenarios for using this on yarn:

1. there are frontend-only builds where it's a project running on node.js and yarn
2. there are dotnet builds with SPA .csproj in them that downloads yarn in the background. if it was npm those calls would be done the same there.

Inspect:
I tried that command on a project that I haven't created an SCA for. I received a peculiar error testing it out that I'm not sure how i'd go about troubleshooting. It didn't create the project, and when I made one myself it still errored out with this message.

I have version 1.4.1 installed as a dotnet tool. Below is what I'm calling:

pgscan identify `
            --input=$pwd\PROJECT.sln `
            --proget-url=https://myprogeturl.mydomain `
            --consumer-package-version=0.1.0 `
            --project-name=PROJECT `
            --api-key=myApiKey `
            --report

Heyo @Dan_Woolf

1. Thanks for the clarification on the package.json parameter.
2. I'd be interested in helping work on it. What would be needed of me?
3. does Inspect require me to manually create a project for SCA or is there some manner of creating them programmatically?

I've got a few questions about how the pgscan utility works with regards to NPM packages.

• The code for the npm scanner indicates that it requires a package-lock.json file to be present in that directory. Is this intended to be used against the root solution, or a csproj? I have a project where this is used, but I consistently get a "pgscan : Unhandled exception. System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary." error regardless of where that file is.
• If we're using Yarn, which produces a yarn.lock file instead, would I still be able to use this with the pgscan utility? Yarn uses the same packages as NPM, with different commands + a slightly different process for how it behaves.
• If I have a dotnet SPA, would I be required to report my packages twice: once to a nuget feed and once to a npm feed in order to get my package data uploaded? I think the answer is yes, but mostly because I don't understand what the Identify command is for, or why i should use it instead of publish.

@atripp that's extremely informative!

What I found this morning that was deleting and re-adding the connector for the IP feed after clearing the cache(because I'm paranoid) was what needed to happen for it to stop being cached by our Mainline feed.

My version of Proget is 6.0.7.

We created our own custom package and put it in a feed for custom packages made by my organization, called the IP feed. There's a secondary feed named Mainline, which has packages we store that we got from 3rd party sources, mainly Nuget.org. Mainline has a connector to IP that pulls packages in from said feed.

Recently I was told that a Nuget Package was being removed from IP as it was renamed, and thus I should remove it from the feed. I delete it from IP, but it still shows in mainline. I then try the following:

• unlist package before ensuring all versions are deleted from IP.
• go into Azure Blob storage (where the packages are kept) and delete it. I'll note that it was not in blob under the containers that had IP or Mainline when I verified.
• run the cleanup tasks in the management UI on both feeds.
• set cleanup of the feed under storage and Retention to Delete Cached connector Packages, and delete old versions of everything except the 10 most recent. It's been 24 hours and it's still there.
• clicked the "clear cache" button on the feed management page.

I see it still in Mainline, with the little radio tower symbol which indicates it's pulled from a connector. In the dropdown menu that allows me to download a package the option to delete it is not one of them. I'm out of ideas, sadly.

Who do I have to sacrifice to make the package go away? Albino goats are particularly expensive.

@atripp you're the best.

I'll give these a shot and come back if i run into something i can't work through.

@atripp

Are those APIs case sensitive? because I had originally tried to use npmFeeds_SetTagVersion and got the first error I posted

[16:07:11]Step 5/6: Proget: Apply tag to Latest Version (15s)
[16:07:11][Step 5/6] Step 1/1: Apply Latest Tag to Version (PowerShell) (15s)
[16:07:27][Step 1/1] Invoke-RestMethod : There is no API method named npmFeeds_SetTagVersion
[16:07:27][Step 1/1] Error message: Invoke-RestMethod : There is no API method named npmFeeds_SetTagVersion
[16:07:27][Step 1/1] At C:\TeamCity\BuildAgent\temp\buildTmp\powershell16555570498298526.ps1:25 char:13

I would have expected to get a 400 error from your API from my bad parameters making an invalid request instead of this.

@atripp

What I mean is that I want to try to tag npm packages via the API. I found this in a build that wasn't finished that I am now responsible for. The engineer previously responsible for it has left our organization and I don't know where he got this or how, and this was not documented by him to my knowledge in any ticket he worked on.

Here's the actual API call I saw in our build in a custom powershell runner in Team City. The %variable% references are Team City syntax for how that software inserts its own variables into script runners.

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Content-Type", "application/json")

$body = "{
`n`"Feed_Name`" : `"npm`",
`n`"FeedType_Name`" : `"npm`",
`n`"API_Key`" : '%svc.proget.apikey%',
`n`"Feed_Id`": 6,
`n`"Package_Name`": '%package.name%',
`n`"Scope_Name`": `"MyCompany`",
`n`"Tag_Name`": `"latest`",
`n`"Tag_Version`": '%app.version%'
`n}"

$response = Invoke-RestMethod "%svc.proget.host%/api/json/NugetFeeds_SetTagVersion" -Method 'POST' -Headers $headers -Body $body