Hi @andreas.unverdorben_1551 ,

Just as an FYI, I submitted two pull requests for this:

• https://github.com/github/advisory-database/pull/8689
• https://github.com/github/advisory-database/pull/8690

Thanks,
Alana

@joshuagilman_1054 I don't really know PowerShell myself (today I learned you can do classes )... but behind-the-scenes it's .NET, and that means we can use nullable value types.

I tried [int?] (nullable shortcut syntax) and [Nullable<int>] (generics shortcut syntax) but PowerShell isn't so happy with either. So the long way it is...

[System.Nullable``1[[System.Int32]]] $myInt = 0
echo "myInt is $myInt "
$myInt = $null
echo "myInt is $myInt "
$myInt = 1000
echo "myInt is $myInt "

That should do the trick for you, and is close to our JSON Model anyways.

You can reset the Admin user account password by stopping the ProGet Windows service, then running ProGet.Service.exe and selecting the "ResetAdminPassword" option. Make sure to restart the Windows service when finished.

@Stephen-Schaff said in API to apply an Alternate Tag to Docker Container Image:

Here is the PowerShell function that does both the promotion and the tagging (incase anyone ever needs something like this). Kind of a "do it yourself" repackaging. (Might be nice to have the Repackaging API support Docker container images someday).

Thanks for sharing this, I've added it to our Semantic Versioning for Containers docs page, I hope that's okay :)

And yes I agree, it woudl be nice to make this an easier API call

Hi @m-lee_3921 ,

Thanks for the heads-up; we'll get this fixed via PG-3059 in the next maintenance release (scheduled for later today).

And you're right -- its basically the same issue. SQL Server silently truncates string values whereas PostgreSQL does not, hence these errors.

We decided to not auto-truncate, since it's better to know about these cases than not. In this case, it's a IPv6 address that was longer than the 20-character limit. We plan to refactor API key logging at some point, so we'll just continue to truncate v6 IPs.

Thanks,
Alana

Hi @carl-westman_8110 ,

The error message means that the database wasn't updated as per normal during the start-up process. It's hard to guess why, as we have special handling for that.

It's likely that restarting the service would have fixed it, but downgrading and then upgrading would also force an upgrade as well. Unfortunately it's hard to say at this point.

Upgrading to 2025.10 should be fine.

Thanks,
Alana

Hi @amy.j ,

This sounds like it's related to PG-3356, which is targeted for this week's maintenance release.

Can you upgrade to 2026.10 (once released) and give it a sot after that?

Thanks,
Alana

Hello; I've updated the documentation to clarify this, but it's available starting in ProGet 5.2.9. So, you'll need to upgrade to enable it :)

Hello; you'll need to change the BaseUrl in advanced settings so that ProGet can construct an absolute URL when needed (certain NuGet fields, etc). I've updated the docs to reflect this.

We've got some major container improvements coming in ProGet 5.3, and will revamp our product; hopefully we'll be able to present this pretty soon!

I think, once you see what we have planned, you'll want to change/improve your workflows to simplify things, and this may not even be necessary... anyways, stay tuned.

Hi @federico.conoscenti ,

Self-connectors won't work in Docker as repositories are already rooted and accessible across all feeds. It's just a quirk of the Docker API really.

The Docker API specifies that the index is located at /v2/_catalog, and as you can see, there's no indication of "feed". For example: https://proget.inedo.com/v2/_catalog

A "feed" is just the first portion of the repositories namespace.

Thanks,
Alana

Hi @amy.j ,

Without a reliable publish date, there's no reasonable way to rely on an automated compliance rule that relies on the publish date.

I would recommend developing a Maven-specific approach, since this feed type is so limited. You've probably noticed it already, but license detection is also not very reliable. But, I wouldn't worry too much about it. Keep in mind:

• the Java ecosystem seems to publish much less frequently than JavaScript
• there are fewer transient dependencies in Java
• version ranges tend to be less popular and much more conservative

Also there seems to be an issue with pulling in certain jar files, eg, when org.springframework:spring-webflux 6.2.19 is promoted no jar file is listed - so cannot be consumed. This has happened for a few packages.

This is probably related to that unreliable Maven Index file.

The Maven API does not support "file listing", so there's no automated way to know what artifacts are contained within a particular release. You just "kinda know" by reading the project's release notes, etc.

Early on, we just "assumed" there would always a .jar file, but I guess that's not the case because there are .war and .ear files too. We also considered parsing the web-based file listing page (e.g. spring-webflux/6.2.19, but a lot of repositories don't provide a listing.

We're open to ideas, but it's just an unfortunately limited ecosystem.

Thanks,
Alana

Hi @sai.pabbareddy ,

Those are both "packages" that contain the same kind of license (ProGet Enterprise).

A single ProGet Enterprise license will allow you to configure a ProGet instance as a HA/cluster.

• "Enterprise Essentials" contains ONE license of ProGet Enterprise and no services
• "Enterprise Complete" contains TWO licenses of ProGet Enterprise plus services

Organizations will often get two licenses of ProGet Enterprise to create two different environments (one Production, one DR/Testing/Training). Hope that helps clarify :)

Thanks,
Alana

Hi @amy.j ,

This package is a bit weird in that (1) it uses a file-embedded licenses, (2) there are 172 contained files, and (3) some of those files don't follow standard naming conventions. When those things happen, I think we get results like this.

The easiest way to work-around this is to just assign a license directly to the package using the Purl (i.e. pkg:pypi/charset_normalizer@3.5.1). You can do that by editing the MIT license type.

Thanks,
Alana

Hi @amy.j ,

I'm afraid publish dates won't work reliably on Maven feeds.

A Maven repository does not contain server-side metadata like Download Count, Publish Date, Deprecated, etc., or even a search capability It's little more than web-based file system with maven-metadata.xml files that are generally maintained by the mvn client (e.g. it will always upload a new maven-metadata.xml file as part of a publish).

The Maven Index file (i.e. nexus-maven-repository-index.gz) attempted to solve the lack of metadata, but it's quite problematic these days (it's like 20-30GB at this point) and is generally disabled by default in most other products (e.g. Artifactory, Sona). On of the problems is that the file does not contain entries for all artifacts, including the .pom.

Publish date is part of the NuGet API, but old packages or some servers may not maintain. It's server-side metadata (like download count), and some basic repositories will just use default dates and 0.

Thanks,
Alana

Hi @jw ,

Can you share us a copy of your database bacakup or export?

I created a ticket that will allow you to upload this: EDO-13159

Once we have that, wecan investigate this further.

Thanks,
Alana

Hi @seanl_4808 ,

Like SAML, OIDC is not intended for developer/CLI tools, but desktop-based applications. I'm not aware of any client-tooling that supports or plans to support OIDC, so there's no sense in having a sever-based tool supported OIDC.

API keys are considered the modern/secure solution. The reason that WIA/OIDC is considered less secure comes down to reducing the attack surface. A rouge user or process would be able to do very little with a limited-access ProGet API key, compared with domain credentials.

Thanks,
Alana

Hi @sai.pabbareddy ,

A 500 is an system error and would be logged under Admin > Diagnostic Center. It's possible there was system overload, network issues, who knows. I wouldn't worry about it.

A 403 is a permission error that would be caused by configuration. It sounds like you resolved it by changing/modifying configuration, waiting for a cache to clear, etc.

Thanks,
Alana

Hi @sai.pabbareddy ,

There is no rule, but I believe admins are encouraged to create one as part of the "onboarding" process when creating feeds, at some point.

Can you point to the documentation that shows that? We will clarify the documentation.

Thanks,
Alana

Hi @sai.pabbareddy ,

This is by design; download blocking is not supported on Docker feeds because it creates a very poor deployment experience, in particular with "fat manifest" images. There is simply no way to communicate to the end-user (typically a devops/release engineer) that an image is blocked, and they just end up getting random and indecipherable errors from the client.

This happens at deploy time, so it causes huge panic. Blocker tickets get opened. Everyone "blames" the tools and no one understands why.

Keep in mind that Docker containers are constantly deployed, so you jus tend up with random production deploy failures from "yet another" overrated vulnerability that just happens to pop-in the system.

Compare this to packages, which are consumed at build-time only and "blocking" only causes a poor developer experience (rarely production failures).

Please use pgutil containers audit instead:
https://docs.inedo.com/docs/proget/api/containers/audit-image

Thanks,
Alana