{"record":{"id":"31e7dc6b0cfe1b13","repo":"jackwener/OpenCLI","slug":"osv-dev-returned-no-vulnerabilities-for-ecosyste","errorCode":null,"errorMessage":"OSV.dev returned no vulnerabilities for ${ecosystem}:${name}${payload.version ? `@${payload.version}` : ''}.","messagePattern":"OSV\\.dev returned no vulnerabilities for (.+?):(.+?)(.+?)` : ''\\}\\.","errorType":"exception","errorClass":"EmptyResultError","httpStatus":null,"severity":"info","filePath":"clis/osv/query.js","lineNumber":41,"sourceCode":"        { name: 'version', type: 'string', required: false, help: 'Pin to a specific version (e.g. \"4.17.20\"); omit for all known vulns' },\n        { name: 'limit', type: 'int', default: 30, help: 'Max rows to return (1-200)' },\n    ],\n    columns: [\n        'rank', 'id', 'summary', 'severity', 'aliases',\n        'published', 'modified', 'affectedPackages', 'url',\n    ],\n    func: async (args) => {\n        const name = requireString(args.package, 'package');\n        const ecosystem = requireEcosystem(args.ecosystem);\n        const limit = requireBoundedInt(args.limit, 30, 200, 'limit');\n        const payload = { package: { name, ecosystem } };\n        if (args.version != null && String(args.version).trim() !== '') {\n            payload.version = String(args.version).trim();\n        }\n        const body = await osvPost(`${OSV_BASE}/v1/query`, payload, `osv query ${ecosystem}:${name}`);\n        const vulns = Array.isArray(body?.vulns) ? body.vulns : [];\n        if (vulns.length === 0) {\n            throw new EmptyResultError(\n                'osv query',\n                `OSV.dev returned no vulnerabilities for ${ecosystem}:${name}${payload.version ? `@${payload.version}` : ''}.`,\n            );\n        }\n        const sorted = vulns\n            .slice()\n            .sort((a, b) => String(b?.published ?? '').localeCompare(String(a?.published ?? '')))\n            .slice(0, limit);\n        return sorted.map((v, i) => {\n            const affected = Array.isArray(v.affected) ? v.affected : [];\n            const pkgPairs = [];\n            for (const a of affected) {\n                const eco = a?.package?.ecosystem;\n                const aname = a?.package?.name;\n                if (eco && aname) pkgPairs.push(`${eco}:${aname}`);\n            }\n            const aliases = Array.isArray(v.aliases) ? v.aliases.filter(Boolean) : [];\n            return {","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/osv/query.js#L23-L59","documentation":"The OSV.dev /v1/query API responded successfully but its `vulns` array was empty, meaning the database has no vulnerability records for that package (and version, when supplied). The adapter treats an empty result as an error condition via EmptyResultError so callers get a consistent signal instead of an empty list.","triggerScenarios":"Calling the osv query flow where POST /v1/query returns `{}` — e.g. a typo'd package name, an ecosystem/name mismatch, or a version that genuinely has no known vulnerabilities.","commonSituations":"Typo in package name; querying a private/unpublished package; passing a version string that doesn't match the registry (e.g. 'v1.2.3' vs '1.2.3'); the package is simply clean at that version.","solutions":["Verify the package name and ecosystem exactly match the registry spelling (case matters for some ecosystems).","Drop the --version flag to check whether the package has any vulnerabilities at any version.","Normalize the version string (strip leading 'v', use the exact registry version).","If the package is private/new, it may legitimately have no records — treat empty as a clean result in your tooling."],"exampleFix":"// before\nawait osvQuery({ ecosystem: 'npm', name: 'lodahs', version: 'v4.17.21' });\n// after\nawait osvQuery({ ecosystem: 'npm', name: 'lodash', version: '4.17.21' });","handlingStrategy":"fallback","validationCode":"if (!pkg || typeof pkg !== 'string' || !pkg.trim()) throw new Error('package name required before querying OSV');\nif (pkg.startsWith('v')) pkg = pkg.slice(1);","typeGuard":"const isQueryPayload = (p) =>\n  typeof p === 'object' && p !== null &&\n  typeof p.ecosystem === 'string' && typeof p.name === 'string' && p.name.trim() !== '';","tryCatchPattern":"try {\n  const vulns = await osvQuery({ ecosystem, name, version });\n} catch (e) {\n  if (e.name === 'EmptyResultError') {\n    console.warn(`No known vulnerabilities for ${ecosystem}:${name} — treating as clean`);\n    return [];\n  }\n  throw e;\n}","preventionTips":["Verify package names against the registry before querying.","Omit --version when unsure the version string matches registry formatting.","Treat empty OSV results as 'no known vulnerabilities', not a failure.","Log the exact payload sent so empty results can be debugged."],"tags":["empty-result","osv","api"],"backgroundTag":"empty-result-set","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}