Hi,

I was on a short vacation but today I upgraded to 2026.3 (build 14) without any problems.

This probably fixed it:
PG-3299 2026.3 FIX: Hostname based binding fails when hosting on Windows with HTTP.SYS

Kind regards,

Valentijn

I tried http://:8624, https://:443 before upgrading but that does not work and gives the same event viewer warning:

Overriding address(es) 'http://:8624, https://:443'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.

Hi,

I upgraded from 2025.27 to 2026 but was no longer able to access proget through https

Our internal address: https://packages.vicrea.nl/
The local http address still worked: http://localhost:8624/

I reverted back to 2025.27 and that works again.

Could not find much more info then this in the event viewer

Category: Microsoft.AspNetCore.Server.Kestrel
EventId: 0

Overriding address(es) 'http://*:8624, https://packages.vicrea.nl:443'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.

Kind regards,

Valentijn

Hi,

My instance says that build 22 is available but Inedo Hub only shows build 21.
Am I too early is something missing?

Kind regards,

Valentijn

Thanks for the confirmition we downgraded to 2025.19

Hi,

We updates to Proget 2025.21 and a build started failing with this message.

npm error 400 Bad Request - GET https://packages.vicrea.nl/npm/VicreaNpmJs/eslint-config-prettier/-/eslint-config-prettier-9.1.0.tgz - Package is known to contain malicious code.

Which is great but it seems all versions of eslint-config-prettier are now blocked although not all are versions actually malicious
https://nvd.nist.gov/vuln/detail/CVE-2025-54313

Is this by design or am i missing something?

Re: [ProGet] Malicious package blocking

@stevedennis I tried in a docker image but also could not reproduce it reading SBOM from the UI. We have a major release ahead perhaps i can try after the release, but failing builds scares people me included.

@stevedennis we went back to an older version that doesn't break our builds and accepts this SBOM

I tried to reproduce it in a docker image but then i need a license key and the latest docker image version isn't build 9 but 6

@stevedennis I sent the SBOM to support

@stevedennis we switched back to latest 2024 version and SQL server and the builds are working again. I can't include the SBOM in the post as its to large, can I mail it or upload it somewhere?

I switched the nps feed audit to enabled (use ProGet's vulnerabilities and assessments)

Hi,

We upgraded to Proget 2025.3 (Build 9) and switched to the internal Postgres database.
But now our builds are starting to fail, in the diagnostic center I see a few different errors.

• Unhandled exception processing https://packages.vicrea.nl/api/sca/import
  System.InvalidOperationException: Nullable object must have a value.

• Connector error: The operation has timed out.
  System.Net.WebException: The operation has timed out.

• An error occurred processing a POST request to https://packages.vicrea.nl/npm/VicreaNpmJs/-/npm/v1/security/advisories/bulk: The operation has timed out.

We also had to switch from IIS to the integrated web server.
Here are the details of the errors

An error occurred processing a POST request to https://packages.vicrea.nl/npm/VicreaNpmJs/-/npm/v1/security/advisories/bulk: The operation has timed out.

System.Net.WebException: The operation has timed out.
   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location ---
   at System.Net.WebRequest.GetResponseAsync()
   at Inedo.ProGet.Feeds.Npm.NpmConnector.ProxyRequestAsync(AhHttpContext context, String relativeUrl)
   at Inedo.ProGet.WebApplication.FeedEndpoints.Npm.NpmAuditHandler.TryProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, NpmFeed feed, String relativeUrl)
   at Inedo.ProGet.WebApplication.FeedEndpoints.Npm.NpmHandler.ProcessRequestAsync(AhHttpContext context, WebApiContext apiContext, NpmFeed feed, String relativeUrl)
   at Inedo.ProGet.WebApplication.FeedEndpoints.FeedEndpointHandler.FeedRequestHandler.ProcessRequestAsync(AhHttpContext context)

::Web Error on 7/7/2025 2:37:47 PM::

Connector error: The operation has timed out.

System.Net.WebException: The operation has timed out.
   at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location ---
   at System.Net.WebRequest.GetResponseAsync()
   at Inedo.ProGet.GlobalExtensions.GetResponseAsync(HttpWebRequest request, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Connector.GetDirectResponseAsync(String url, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Connector.GetCachedResponseAsync(String url, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Npm.NpmConnector.GetCachedResponseWith404Async(String url, CancellationToken cancellationToken)
   at Inedo.ProGet.Feeds.Npm.NpmConnector.GetPackagesAsync(PackageNameId name, String version, CancellationToken cancellationToken)+MoveNext()
   at Inedo.ProGet.Feeds.Npm.NpmConnector.GetPackagesAsync(PackageNameId name, String version, CancellationToken cancellationToken)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()
   at Inedo.ProGet.GlobalExtensions.ExceptionHandlingAsyncEnumerable`1.ExceptionHandlingAsyncEnumerator.MoveNextAsync()

::Feed Error on 7/7/2025 2:39:07 PM::

Unhandled exception processing https://packages.vicrea.nl/api/sca/import

System.InvalidOperationException: Nullable object must have a value.
   at System.Nullable`1.get_Value()
   at Inedo.ProGet.Projects.BomUtil.ImportBuild(Bom bom, Byte[] originalSbomBytes, String originalFormatCode)
   at Inedo.ProGet.Projects.BomUtil.ImportXmlAsync(Stream source)
   at Inedo.ProGet.WebApplication.SimpleHandlers.Api.Bom.ScaApiHandler.ProcessRequestAsync(AhHttpContext context, LoggedResponseStream output, WebApiContext apiContext)
   at Inedo.ProGet.WebApplication.SimpleHandlers.Api.ProGetApiKeySecuredHandler.ProcessRequestInternalAsync(AhHttpContext context, LoggedResponseStream output, WrappedApiKey apiKey)
   at Inedo.Web.Handlers.Api.ApiKeySecuredHandler.ProcessRequestInternalAsync(AhHttpContext context)
   at Inedo.Web.Handlers.Api.StandardApiHandler.ProcessRequestAsync(AhHttpContext context)

:: Error on 7/7/2025 3:17:01 PM::

Failed to fetch package tags for path-to-regexp from registry.npmjs.org.



::Feed Warning on 7/7/2025 2:49:23 PM::

Hi,

We just upgraded to 2025.3 (Build 9) and switched to the postgres database

I want to configure the backup job, but everytime I enter a backup file directory and save it, it seems ok but the directory is not stored and the export link does nothing.

Thanks @rhessinger

I worked around it by uploading it to another feed. But with your help I managed to clean up the original feed. I put an item on our backlog to sort this package out.

Kind regards
Valentijn

Hi,

Most builds work now except our flagship build, it fails on this package

System.Management.Automation.dll version 10.0.10586

I can't find it in te UI but it is on disk.
I tried to upload it again but then I get a message it already exists.

It's a transitive dependency of Open-Xml-PowerTools

Hi,

I deleted the two packages and manually removed them from disk.
Uninstalled Proget and installed build 31 en tried a few builds.
They seem to work now, this weekend all builds will run but I think they will work.

Thanks

Valentijn

Hi,

Is there any way this can be fixed because I can't upgrade ProGet anymore or do you need more information?

Regards

Valentijn

Hi,

Most of our weekly builds started failing after upgrading because packages with quirky versions can nog longer be downloaded. After downgrading to build 27 the builds work again.

The nuget command failed with exit code(1) and error(Failed to download package 'Microsoft.Web.Infrastructure.1.0.0' from ...
The nuget command failed with exit code(1) and error(Failed to download package 'System.Net.Http.Formatting.Extension.5.2.3' from ...

I reinstalled Proget with an offline installer

Hi,

I tried to upgrade Proget from 2024.27 to 2024.29 but the installer crashed and now Proget is gone. I tried to reinstall it but that also crashed also installing the old 27 version resulted in a crash. I tried to report it but that crashed the installer

Unhandled exception: System.ArgumentNullException: Value cannot be null.
Parameter name: s
   at Inedo.UPack.UniversalPackageVersion.Parse(String s)
   at Inedo.UPack.Packaging.UniversalPackageMetadata.get_Version()
   at Inedo.Romp.RompPack.PackageInstaller.<RunAsync>d__30.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Inedo.Romp.RompDeploymentJob.<InstallAsync>d__8.MoveNext()

I found this in the event log

Application: InedoHub.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Net.WebException
   at System.Net.HttpWebRequest.EndGetResponse(System.IAsyncResult)
   at System.Threading.Tasks.TaskFactory`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].FromAsyncCoreLogic(System.IAsyncResult, System.Func`2<System.IAsyncResult,System.__Canon>, System.Action`1<System.IAsyncResult>, System.Threading.Tasks.Task`1<System.__Canon>, Boolean)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(System.Threading.Tasks.Task)
   at Inedo.Hub.Pages.SubmitErrorReportDialog+<Submit_Click>d__3.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.DispatcherOperation.InvokeImpl()
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   at MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
   at System.Windows.Threading.DispatcherOperation.Invoke()
   at System.Windows.Threading.Dispatcher.ProcessQueue()
   at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   at System.Windows.Window.ShowHelper(System.Object)
   at System.Windows.Window.ShowDialog()
   at Inedo.Hub.Pages.ErrorPage.Submit_Click(System.Object, System.Windows.RoutedEventArgs)
   at System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   at System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   at System.Windows.Controls.Primitives.ButtonBase.OnClick()
   at System.Windows.Controls.Button.OnClick()
   at System.Windows.Controls.Primitives.ButtonBase.OnMouseLeftButtonUp(System.Windows.Input.MouseButtonEventArgs)
   at System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   at System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   at System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   at System.Windows.UIElement.ReRaiseEventAs(System.Windows.DependencyObject, System.Windows.RoutedEventArgs, System.Windows.RoutedEvent)
   at System.Windows.UIElement.OnMouseUpThunk(System.Object, System.Windows.Input.MouseButtonEventArgs)
   at System.Windows.RoutedEventArgs.InvokeHandler(System.Delegate, System.Object)
   at System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   at System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   at System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   at System.Windows.UIElement.RaiseTrustedEvent(System.Windows.RoutedEventArgs)
   at System.Windows.Input.InputManager.ProcessStagingArea()
   at System.Windows.Input.InputManager.ProcessInput(System.Windows.Input.InputEventArgs)
   at System.Windows.Input.InputProviderSite.ReportInput(System.Windows.Input.InputReport)
   at System.Windows.Interop.HwndMouseInputProvider.ReportInput(IntPtr, System.Windows.Input.InputMode, Int32, System.Windows.Input.RawMouseActions, Int32, Int32, Int32)
   at System.Windows.Interop.HwndMouseInputProvider.FilterMessage(IntPtr, MS.Internal.Interop.WindowMessage, IntPtr, IntPtr, Boolean ByRef)
   at System.Windows.Interop.HwndSource.InputFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   at System.Windows.Application.RunDispatcher(System.Object)
   at System.Windows.Application.RunInternal(System.Windows.Window)
   at Inedo.Hub.App.Main()

Hi,

In one of our older products we use angular 1.8.3.

Proget reports

This package has no known security vulnerabilities.

but npm audit reports

angular  *
Severity: high
angular vulnerable to regular expression denial of service (ReDoS) - https://github.com/advisories/GHSA-m2h2-264f-f486
Angular (deprecated package) Cross-site Scripting - https://github.com/advisories/GHSA-prc3-vjfx-vhm9
angular vulnerable to regular expression denial of service via the angular.copy() utility - https://github.com/advisories/GHSA-2vrf-hf26-jrp5
angular vulnerable to regular expression denial of service via the $resource service - https://github.com/advisories/GHSA-2qqx-w9hr-q5gx
angular vulnerable to regular expression denial of service via the <input type="url"> element - https://github.com/advisories/GHSA-qwqh-hm9m-p5hr
angular vulnerable to super-linear runtime due to backtracking - https://github.com/advisories/GHSA-4w4v-5hc9-xrr2
fix available via `npm audit fix --force`
Will install angular@1.6.10, which is a breaking change
node_modules/angular

1 high severity vulnerability