Got this on a NPM feed, which has a connector to *npm-registry.npmjs.org. Recently upgraded to 25.23.11 An error occurred processing a POST request to http://packagemanager.REDACTED/npm/NPM-Source/-/npm/v1/security/advisories/bulk: '0x00' is an invalid start of a property name. Expected a '"'. LineNumber: 0 | BytePositionInLine: 1. System.Text.Json.JsonReaderException: '0x00' is an invalid start of a property name. Expected a '"'. LineNumber: 0 | BytePositionInLine: 1. at System.Text.Json.ThrowHelper.ThrowJsonReaderException(Utf8JsonReader& json, ExceptionResource resource, Byte nextByte, ReadOnlySpan`1 bytes) at System.Text.Json.Utf8JsonReader.ReadSingleSegment() at System.Text.Json.JsonDocument.Parse(ReadOnlySpan`1 utf8JsonSpan, JsonReaderOptions readerOptions, MetadataDb& database, StackRowStack& stack) at System.Text.Json.JsonDocument.Parse(ReadOnlyMemory`1 utf8Json, JsonReaderOptions readerOptions, Byte[] extraRentedArrayPoolBytes, PooledByteBufferWriter extraPooledByteBufferWriter) at System.Text.Json.JsonDocument.Parse(Stream utf8Json, JsonDocumentOptions options) at Inedo.ProGet.WebApplication.FeedEndpoints.Npm.NpmAuditHandler.HandleBulkAdvisory(AhHttpContext context, NpmFeed feed) at Inedo.ProGet.WebApplication.FeedEndpoints.Npm.NpmAuditHandler.TryProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, NpmFeed feed, String relativeUrl) at Inedo.ProGet.WebApplication.FeedEndpoints.Npm.NpmHandler.ProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, NpmFeed feed, String relativeUrl) at Inedo.ProGet.WebApplication.FeedEndpoints.FeedEndpointHandler.FeedRequestHandler.ProcessRequestAsync(AhHttpContext context) ::Web Error on 19.03.2026 19:52:44::

Hi @mayorovp_3701, This is a bug you should definitely report to GitLab -- it's clearly required by the API and all other registries support it. Without that API defined, we have to "make guesses" based on undocumented conventions (i.e. /v3-flatcontainer/{id}), which causes headaches down the line. That's why there's an API contract :) I don't know how/why it works with dotnet sdk -- perhaps it's using a different endpoint, or maybe it's not actually working and just going to NuGet.org. Whatever the case, it doesn't make sense for us to build workarounds for easily-fixable bugs on GitLab when other vendors seem to follow the API contract. -- Dean

Hi @mayorovp_3701 , Thanks for confirming; we can will try to get this fixed in the next maintenance release via PG-3139 -- the underlying issue is most likely a race condition on that trigger I mentioned, so we're going to fix it by adding an advisory lock. It will not remove the duplicate content, but in theory deleting the image will. Thanks, Alana