[Preview] Upgrading to ProGet 2023

ProGet 2023 is a major update, and this article provides information about what will change, the impact to your instance, and how to mitigate risk during upgrade.

Planning for Your Upgrade

ProGet 2023 is a major upgrade, and many of the changes were additive features (available as "preview" features in ProGet 2022), platform updates (library upgrades, etc.), and UI changes.

Upgrading from ProGet 2022

There are some key things to keep in mind before upgrading:

You can also rollback to ProGet 2022 if there are issues without restoring your database.

Upgrading from Older Versions

In most cases, we recommend directly upgrading to ProGet 2023 from ProGet 5.2, ProGet 5.3, and ProGet 6.0. Please read the upgrade notes from each version to learn what changed and how to mitigate risks.

In ProGet 6.0, due API Keys changes, some users reported that some API Key needing to edited or deleted/recreated to fix permissions issues.

In ProGet 5.3, legacy NuGet ("quirks") feeds were removed. You will need to migrate all of these feeds before upgrading.

Upgrading from ProGet 5.1 or Earlier

We recommend upgrade to latest ProGet 5.2, then latest ProGet 2023. See: 5.3 notes, v4 notes, v2/v3 notes

New Features in ProGet 2023

Redesigned Feature: Vulnerabilities

ProGet 2023 includes an "offline" vulnerability database called ProGet Vulnerability Central (PGVC) that is periodically updated on a nightly basis, and whenever you upgrade ProGet. Unlike third-party vulnerability services (such as OSS Index) that require using an API or an overnight download, PGVC vulnerability data will be available immediately, even on remote packages.

Having this built-in database led us to rethink the vulnerabilities feature, and make the following changes:

• You now can enable or disable vulnerabilities on a feed (instead of relying on the confusing Feed Usage setting)
• On remote packages (i.e. not cached or local)...
  • vulnerabilities from PGVC will always be displayed
  • you can assess these vulnerabilities before downloading or using the package
  • if "block unassessed" is configured, attempting to download a remote package will result in an error
  • otherwise, the vulnerabilities will be added to ProGet and considered unassessed
• vulnerability sources like OSS Index are now called "third-party vulnerability sources"

On cached or local packages, vulnerabilities will behave largely the same: if a new vulnerability is downloaded in a PGVC update, the package will get an unassessed vulnerability

The experimental "on-demand vulnerability scanning" feature was also removed, as it rarely worked due to rate limitations of OSS Index.

There is no risk mitigation required, as this is additive and will not impact your existing data or configuration. In addition, this was introduced as a preview feature in ProGet 2022.20.

New Feature: HTTP/HTTPS Setting

ProGet 2023 allows you to configure HTTP/HTTPS settings from within ProGet, on the Administration page. This only applies if you're using the Integrated Web Server on Windows, as both IIS and Docker manage these settings externally to ProGet. See Configuring HTTPS on the Integrated Web Server to learn more.

There is no risk mitigation required, as the pages simply edit configuration files on disk and restart the web server. The changes/additions were introduced as a preview feature in ProGet 2022.19.

Improved Feature: NuGet Symbol Serving

NuGet feeds in ProGet 2023 support symbol package (i.e. a .snupkg file) to be stored alongside the main package (i.e. the .nupkg file).

When this feature is enabled, you can use the dotnet nuget push --symbol command to push both packages to the same feed. If you've already enabled symbol serving on your NuGet feed and would like to try this combine approach, you can change the symbol serving setting from Legacy (.symbols.nupkg) to Mixed (both formats). See the updated Source and Symbol Server documentation to learn more.

There is no risk mitigation required, as trying to run dotnet nuget push --symbol would simply result in an error. In addition, this was introduced as a preview feature in ProGet 2022.20.

Improved Feature: Active Directory Integration

ProGet 2023 supports the latest version (v4) of our Active Directory / LDAP integration. This version is are write of the previous (v3), and added optimizations, advanced LDAP filtering, and is tied to a single domain, simplifying LDAP queries. It also includes a new Microsoft Active Directory Group Search Type for improved performance and customization of LDAP queries, supporting large forests and other LDAP providers. See Active Directory / LDAP (v4) to learn more.

There is no risk mitigation required, as this is a separate user directory and will not be enabled by default. Support was introduced as a preview feature in ProGet 2022.20.

Upgrade Process

You should generally perform the upgrade using the same method you used to install.

• On Windows, the most common installation method is using the internet-connected Inedo Hub; see HOWTO: Upgrade or Downgrade with the Inedo Hub for more details on how to upgrade.
• On Linux, the most common installation method is using our Docker container; see Upgrading Docker Containers for more details.

However, there are other installation options available, including offline installation, cluster installation, and even manual installation. If you want to change installation methods, the easiest way is to simply uninstall (by following the process in reverse) and install using the new method.

If you're upgrading from ProGet 5.3 or earlier, it's possible ProGet was installed with the legacy installer, The Inedo Hub should be able to upgrade these installations, but you may need to uninstall and then reinstall using the Inedo Hub.

While you can upgrade from ProGet 5.0 and later to ProGet 2023 (i.e. there is no need to install intermediate versions), you can only rollback to ProGet 2022 without restoring your database.

Rolling Back

However, if you need to rollback to ProGet 2022, you can do so without restoring the database by simply using the Inedo Hub. While there are database schema changes, they are all backwards-compatible with ProGet 2022, which means you can safely rollback your ProGet installation if there's a showstopper bug, and then upgrade later.