Good questions; You can configure ProGet to block packages with "unassessed" vulnerabilities; this is not the default configuration because a lot of times vulnerabilities are discovered after you've already been using a package anyways That's true, but maybe we could expand webhooks? I'm not sure, but it seems like it could be a feature request if it's something you'd actually want to use, etc.

Thank you for the report - it appears the uninstaller is relying on a configuration value that does not exist; the uninstaller will be fixed in v5.0.8. For reference, here is a quick summary of what the uninstaller does: (IIS only) delete ProGet application pool (IIS only) delete ProGet website stop & delete INEDOPROGETSVC and INEDOPROGETWEBSVC Windows services delete %ProgramFiles%\ProGet directory delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProGet hive from registry (optional) drop ProGet database (optional, SQL-install only) uninstall SQL Server 2016 from "Add or remove programs"

Yes, it's available. You will need to associate the licenses with a "known" license type that is allowed. Many NuGet packages ship with proprietary licenses, or licenses that point to "random" URLS (like GitHub.org/project-name/license.txt) instead of a "known" OSI URL. This is why they are considered "unknown" to ProGet.

That's a bug affecting NuGet feeds - we're publishing a hotfix release today (4.7.6) and will include a fix for this.