There is code in the toolkit, for example, the download package, that creates cr_items with parent_id referring to a non-CR object such as a package_id.
This works fine, there is no constraint on parent_id so it is very flexible.
Changes for 5.2 to add package_id to acs_objects also added code in content_item__new to "guess" the package_id if one was not specified. This relies on the parent_id being a content_item, with the root parent of the tree the item is in being a CR root folder. If you put parent_id as a package_id this breaks.
The download package relies on this and has been like this for years. Recently there has been much new code that also relies on parent_ids that are not folders and not even cotnent repository items. Chances are the new code passes package_id explicitly and does not encounter this bug.
How should we fix that? The simplest most straightforward fix is to requite code that needs package_id set to set it correctly or set it NULL.
Another option is to devise a query to find the ultimate parent object without requiring it be a cr_folder. THis is probably possible with a tree query using connect by on oracle and tree_sortkey on PostgreSQL.
This is delaying OpenACS 5.2.1 obviously since I can't upload the new release to openacs.org with this bug.