Paket fails to resolve packages in JFrog Artifactory with no dependencies

We are in the middle of migrating all our packages and CI pipelines from using an on-prem JFrog Artifactory server (a version from july 2025), to using their hosted cloud service (latest version). During this migration, we discovered that most of our builds using Paket started failing, with error messages like these:

Resolving dependency graph...
Possible Performance degradation, ignore '1_https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget/Packages(Id='dips.3rdparty.devexpress221.data',Version='22.1.4')'
Possible Performance degradation, ignore '1_https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget/Packages(Id='DIPS.3rdParty.DevExpress221.Data',Version='22.1.4')'
Possible Performance degradation, ignore '2_https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget/Packages?$filter=(Id eq 'DIPS.3rdParty.DevExpress221.Data') and (NormalizedVersion eq '22.1.4')'
Possible Performance degradation, ignore '2_https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget/Packages?$filter=(tolower(Id) eq 'dips.3rdparty.devexpress221.data') and (NormalizedVersion eq '22.1.4')'
Possible Performance degradation, ignore '2_https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget/Packages?$filter=(Id eq 'DIPS.3rdParty.DevExpress221.Data') and (Version eq '22.1.4')'
Possible Performance degradation, ignore '2_https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget/Packages?$filter=(tolower(Id) eq 'dips.3rdparty.devexpress221.data') and (Version eq '22.1.4')'
Source 'https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget' exception: System.Exception: unable to find dependencies for package DIPS.3rdParty.DevExpress221.Data 22.1.4
   at Microsoft.FSharp.Core.PrintfModule.PrintFormatToStringThenFail@1448.Invoke(String message)
   at Paket.NuGetV2.handleODataEntry[a,b](String nugetURL, a packageName, b version, XmlNode entry) in D:\code\Paket\src\Paket.Core\Dependencies\NuGetV2.fs:line 185
   at Paket.NuGetV2.parseFindPackagesByIDODataListDetails[a](a url, String nugetURL, PackageName packageName, SemVerInfo version, XmlNode doc) in D:\code\Paket\src\Paket.Core\Dependencies\NuGetV2.fs:line 406
   at Paket.NuGetV2.parseFindPackagesByIDODataEntryDetails@415-5.Invoke(Unit unitVar) in D:\code\Paket\src\Paket.Core\Dependencies\NuGetV2.fs:line 417
   at Microsoft.FSharp.Control.AsyncPrimitives.CallThenInvoke[T,TResult](AsyncActivation`1 ctxt, TResult result1, FSharpFunc`2 part2) in D:\a\_work\1\s\src\FSharp.Core\async.fs:line 510
   at Microsoft.FSharp.Control.Trampoline.Execute(FSharpFunc`2 firstAction) in D:\a\_work\1\s\src\FSharp.Core\async.fs:line 112
Something failed in GetPackageDetails, trying again with force: Couldn't get package details for package DIPS.3rdParty.DevExpress221.Data 22.1.4 on https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget.
Source 'https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget' exception: System.Exception: unable to find dependencies for package DIPS.3rdParty.DevExpress221.Data 22.1.4
   at Microsoft.FSharp.Core.PrintfModule.PrintFormatToStringThenFail@1448.Invoke(String message)
   at Paket.NuGetV2.handleODataEntry[a,b](String nugetURL, a packageName, b version, XmlNode entry) in D:\code\Paket\src\Paket.Core\Dependencies\NuGetV2.fs:line 185
   at Paket.NuGetV2.parseFindPackagesByIDODataListDetails[a](a url, String nugetURL, PackageName packageName, SemVerInfo version, XmlNode doc) in D:\code\Paket\src\Paket.Core\Dependencies\NuGetV2.fs:line 406
   at Paket.NuGetV2.parseFindPackagesByIDODataEntryDetails@415-5.Invoke(Unit unitVar) in D:\code\Paket\src\Paket.Core\Dependencies\NuGetV2.fs:line 417
   at Microsoft.FSharp.Control.AsyncPrimitives.CallThenInvoke[T,TResult](AsyncActivation`1 ctxt, TResult result1, FSharpFunc`2 part2) in D:\a\_work\1\s\src\FSharp.Core\async.fs:line 510
   at Microsoft.FSharp.Control.Trampoline.Execute(FSharpFunc`2 firstAction) in D:\a\_work\1\s\src\FSharp.Core\async.fs:line 112
    Package not available.
      Message: Unable to retrieve package details for 'DIPS.3rdParty.DevExpress221.Data'-22.1.4

The paket.dependencies for this specific case is very simple:

framework: net48
strategy: max

source https://myserver.jfrog.io/artifactory/api/nuget/DIPS-Nuget

nuget DIPS.3rdParty.DevExpress221.Data

It's worth mentioning that while our old on-prem solution allowed anonymous access, the cloud-hosted solution does not, so we have authenticated Paket with paket config add-credentials. This works for most packages, so authentication is likely not the issue.

We use the latest version of Paket as of today, 10.3.1+bbc45f336c7f9bac95cf1d17267ab2383d029682.

I suspected there might be differences in the responses from JFrog Artifactory, so I tried running the OData query directly, and there is indeed a difference. Here is the <m:properties> part the result from the on-prem server, which works:

<m:properties>
    <d:lastUpdated>2022-08-10T09:35:30</d:lastUpdated>
    <d:Version>22.1.4</d:Version>
    <d:Copyright m:null="true"/>
    <d:Created m:type="Edm.DateTime">2022-08-10T09:35:30</d:Created>
    <d:Dependencies></d:Dependencies>
    <d:Description>DIPS.3rdParty.DevExpress221.Data</d:Description>
    <d:DownloadCount m:type="Edm.Int64">562</d:DownloadCount>
    <d:IconUrl m:null="true"/>
    <d:IsLatestVersion m:type="Edm.Boolean">true</d:IsLatestVersion>
    <d:IsAbsoluteLatestVersion m:type="Edm.Boolean">true</d:IsAbsoluteLatestVersion>
    <d:IsPrerelease m:type="Edm.Boolean">false</d:IsPrerelease>
    <d:Published m:type="Edm.DateTime">2022-08-10T09:35:30</d:Published>
    <d:PackageHash>RcSJ1vTfLvUQUetNVsndWJ/B5gFWTLrzYrU0VuZyUwq1j/yyJvBo3lq+oMCS4BbLEQFtAzVwEZLcTD5K8YMvMQ==</d:PackageHash>
    <d:PackageHashAlgorithm>SHA512</d:PackageHashAlgorithm>
    <d:PackageSize m:type="Edm.Int64">2285730</d:PackageSize>
    <d:ReleaseNotes m:null="true"/>
    <d:RequireLicenseAcceptance m:type="Edm.Boolean">false</d:RequireLicenseAcceptance>
    <d:Title>DIPS.3rdParty.DevExpress221.Data</d:Title>
    <d:VersionDownloadCount m:type="Edm.Int64">562</d:VersionDownloadCount>
    <d:Authors>DIPS</d:Authors>
    <d:MinClientVersion m:null="true"/>
</m:properties>

Here is the same result from the cloud-hosted server:

<m:properties>
    <d:lastUpdated>2025-12-12T09:47:51</d:lastUpdated>
    <d:Version>22.1.4</d:Version>
    <d:Copyright m:null="true"/>
    <d:Created m:type="Edm.DateTime">2025-12-12T09:47:51</d:Created>
    <d:Description>DIPS.3rdParty.DevExpress221.Data</d:Description>
    <d:DownloadCount m:type="Edm.Int64">1</d:DownloadCount>
    <d:IconUrl m:null="true"/>
    <d:IsLatestVersion m:type="Edm.Boolean">true</d:IsLatestVersion>
    <d:IsAbsoluteLatestVersion m:type="Edm.Boolean">true</d:IsAbsoluteLatestVersion>
    <d:IsPrerelease m:type="Edm.Boolean">false</d:IsPrerelease>
    <d:Published m:type="Edm.DateTime">2025-12-12T09:47:51</d:Published>
    <d:PackageHash>RcSJ1vTfLvUQUetNVsndWJ/B5gFWTLrzYrU0VuZyUwq1j/yyJvBo3lq+oMCS4BbLEQFtAzVwEZLcTD5K8YMvMQ==</d:PackageHash>
    <d:PackageHashAlgorithm>SHA512</d:PackageHashAlgorithm>
    <d:PackageSize m:type="Edm.Int64">2285730</d:PackageSize>
    <d:ReleaseNotes m:null="true"/>
    <d:RequireLicenseAcceptance m:type="Edm.Boolean">false</d:RequireLicenseAcceptance>
    <d:Title>DIPS.3rdParty.DevExpress221.Data</d:Title>
    <d:VersionDownloadCount m:type="Edm.Int64">1</d:VersionDownloadCount>
    <d:Authors>DIPS</d:Authors>
    <d:MinClientVersion m:null="true"/>
</m:properties>

The self-hosted server returns an empty <d:Dependencies></d:Dependencies> block, but this is missing in the response from the cloud-hosted server running a newer version, and I suspect this is what's causing Paket to fail. I have not found any workaround yet.

While this is obviously a breaking change from JFrog, it would probably be good if Paket could handle the absence of dependencies more gracefully. This is currently blocking us from finishing our migration, so I'm hoping it's easy and quick to fix!

Thank you for keeping this tool running and up to date!

Start in src/Paket.Core/Dependencies/NuGetV2.fs at handleODataEntry and the parseFindPackagesByIDODataListDetails path around lines 185, 406, and 417. Compare how the parser handles the on-premises OData response with an empty Dependencies element versus the cloud response where it is absent. Done means a package with no dependencies can resolve successfully from the cloud-hosted Artifactory response.