@stevedennis

I repackaged the Owin package but didn't relalize that that would break all my builds as the dll's are now in a 1.0.0 folder where all the project files expect them in the 1.0 folder.

I guess this would work if the projects are in sdk project format but most of them are not.

Hi,

I upgraded from 2025.27 to 2026 but was no longer able to access proget through https

Our internal address: https://packages.vicrea.nl/
The local http address still worked: http://localhost:8624/

I reverted back to 2025.27 and that works again.

Could not find much more info then this in the event viewer

Category: Microsoft.AspNetCore.Server.Kestrel
EventId: 0

Overriding address(es) 'http://*:8624, https://packages.vicrea.nl:443'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.

Kind regards,

Valentijn

Hi,

I'm scanning a .NET solution (.slnx) with pgutil. In one of the projects is a folder with a react app with a package.json file thats also gets picked up. Is there a way to prevent that?

The reason I don't want the file to be scanned is it contains lots of dependencies that are never downloaded. Because they are not downloaded Proget has nog license information.
These are usually packages for other platforms like linux, arm etc (we run on windows)

Regards,

Valentijn

Hi,

I was on a short vacation but today I upgraded to 2026.3 (build 14) without any problems.

This probably fixed it:
PG-3299 2026.3 FIX: Hostname based binding fails when hosting on Windows with HTTP.SYS

Kind regards,

Valentijn

I tried http://:8624, https://:443 before upgrading but that does not work and gives the same event viewer warning:

Overriding address(es) 'http://:8624, https://:443'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.

Hi,

I upgraded from 2025.27 to 2026 but was no longer able to access proget through https

Our internal address: https://packages.vicrea.nl/
The local http address still worked: http://localhost:8624/

I reverted back to 2025.27 and that works again.

Could not find much more info then this in the event viewer

Category: Microsoft.AspNetCore.Server.Kestrel
EventId: 0

Overriding address(es) 'http://*:8624, https://packages.vicrea.nl:443'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.

Kind regards,

Valentijn

Hi,

My instance says that build 22 is available but Inedo Hub only shows build 21.
Am I too early is something missing?

Kind regards,

Valentijn

Thanks for the confirmition we downgraded to 2025.19

Hi,

We updates to Proget 2025.21 and a build started failing with this message.

npm error 400 Bad Request - GET https://packages.vicrea.nl/npm/VicreaNpmJs/eslint-config-prettier/-/eslint-config-prettier-9.1.0.tgz - Package is known to contain malicious code.

Which is great but it seems all versions of eslint-config-prettier are now blocked although not all are versions actually malicious
https://nvd.nist.gov/vuln/detail/CVE-2025-54313

Is this by design or am i missing something?

Re: [ProGet] Malicious package blocking

@stevedennis I tried in a docker image but also could not reproduce it reading SBOM from the UI. We have a major release ahead perhaps i can try after the release, but failing builds scares people me included.

@stevedennis we went back to an older version that doesn't break our builds and accepts this SBOM

I tried to reproduce it in a docker image but then i need a license key and the latest docker image version isn't build 9 but 6

@stevedennis I sent the SBOM to support