Hi @v-makkenze_6348, This fix has been released in pgscan 1.5.7. Please let us know if you have any questions! Thanks, Rich

Thanks, I updated and feed cleanup is back to seconds instead of hours [image: 1692943179937-5b6aebe8-48a0-410b-bc47-c5d54f86e8f6-image.png]

Hi @aivanov_3749 , I'm afraid the reply is the same :( ProGet 2023 is effectively a new database architecture entirely, and while we tested every possible scenario we could imagine (as well as dozens of customer databases), some regressions are to be expected. It's also possible that there was a bug or edge case in the old retention rules, and the packages that should have been deleted weren't/ Upgrading to ProGet 2023 will automatically disable all retention rules on all feeds, and you'll be prompted to attempt a dry run before re-enabling them. The best way to troubleshoot retention rules deleting unexpected packages is to use the "dry run" feature. This will let you tweak the rules, and find which setting is behaving unexpectedly. If you can let us know specifics or provide those execution logs, we will definitely do our best to identify the underlying cause. Thanks, Steve

@v-makkenze_6348 said in Reporting & Software Composition Analysis (SCA) shows many unresolved Issues: I repackaged the Owin package but didn't relalize that that would break all my builds as the dll's are now in a 1.0.0 folder where all the project files expect them in the 1.0 folder. I guess this would work if the projects are in sdk project format but most of them are not. Unfortunately, a consequence of those quirky versions. Hopefully it won't be too bad to update those projects/references with a bit of search/replace :)

This is now fixed in 2023.3, which is going to be released later today. Thank you!

Hi @v-makkenze_6348, When you enable the preview feature for ProGet Vulnerability Central, ProGet will add a vulnerability source name PGVC automatically, but it will not show under the vulnerability sources. It looks like after you enabled that, you added a new ProGet Vulnerability Center (which will default the name to "ProGet Vulnerability Central"). So the ProGet Vulnerability Center source should be left off and can probably be removed. That is definitely what was causing a duplicate vulnerability. Thanks, Dan

Also: I did remove the second website as we want ProGet to be running on the default web site on port 443 (https).

I can confirm that its working for us now. Thanks!