{"record":{"id":"3a058b5dbe0fe900","repo":"jackwener/OpenCLI","slug":"osv-ecosystem-is-required-when-querying-by-packa","errorCode":null,"errorMessage":"osv --ecosystem is required when querying by package","messagePattern":"osv --ecosystem is required when querying by package","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"clis/osv/utils.js","lineNumber":60,"sourceCode":"    if (!s) {\n        throw new ArgumentError(\n            'osv vulnerability id is required (e.g. \"GHSA-29mw-wpgm-hmr9\", \"CVE-2020-28500\")',\n            'IDs are listed at https://osv.dev — paste the canonical id from the vulnerability page.',\n        );\n    }\n    if (!VULN_ID.test(s)) {\n        throw new ArgumentError(\n            `osv vulnerability id \"${value}\" is not a valid OSV id`,\n            'IDs are short ASCII tokens like \"GHSA-...\", \"CVE-...\", \"PYSEC-...\".',\n        );\n    }\n    return s;\n}\n\nexport function requireEcosystem(value) {\n    const s = String(value ?? '').trim();\n    if (!s) {\n        throw new ArgumentError(\n            'osv --ecosystem is required when querying by package',\n            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,\n        );\n    }\n    if (!OSV_ECOSYSTEMS.has(s)) {\n        throw new ArgumentError(\n            `osv --ecosystem \"${value}\" is not a recognised OSV ecosystem`,\n            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,\n        );\n    }\n    return s;\n}\n\nexport function requireBoundedInt(value, defaultValue, maxValue, label = 'limit') {\n    const raw = value ?? defaultValue;\n    const n = typeof raw === 'number' ? raw : Number(raw);\n    if (!Number.isInteger(n) || n <= 0) {\n        throw new ArgumentError(`osv ${label} must be a positive integer`);","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/osv/utils.js#L42-L78","documentation":"requireEcosystem rejects an empty --ecosystem value because package queries must state which registry ecosystem to search. The hint lists every accepted ecosystem from OSV_ECOSYSTEMS.","triggerScenarios":"Running a package-based OSV query without --ecosystem, or with an empty/whitespace value; an unset env var feeding the flag.","commonSituations":"Omitting the flag in scripts; confusing the ecosystem flag with the vulnerability-ID flow (which doesn't need it); a config file missing the ecosystem field.","solutions":["Add --ecosystem with one of the supported values (npm, PyPI, Go, Maven, NuGet, RubyGems, crates.io, Packagist, Pub, Hex, Hackage, CRAN, Bitnami, GitHub Actions, SwiftURL).","If looking up a known vulnerability ID instead, use the ID flow which needs no ecosystem.","Default the ecosystem in your wrapper script based on the project type (e.g. npm for package.json repos)."],"exampleFix":"// before\nawait osvQuery({ name: 'lodash' }); // ecosystem missing\n// after\nawait osvQuery({ ecosystem: 'npm', name: 'lodash' });","handlingStrategy":"validation","validationCode":"if (!ecosystem || String(ecosystem).trim() === '') {\n  throw new Error('--ecosystem is required for package queries (e.g. npm, PyPI, Go)');\n}","typeGuard":"const hasEcosystem = (p) =>\n  typeof p === 'object' && p !== null && typeof p.ecosystem === 'string' && p.ecosystem.trim() !== '';","tryCatchPattern":"try {\n  const result = await osvQuery({ ecosystem, name });\n} catch (e) {\n  if (e instanceof ArgumentError && /--ecosystem is required/.test(e.message)) {\n    console.error('Add --ecosystem <name>; see https://ossf.github.io/osv-schema/#defined-ecosystems');\n    return;\n  }\n  throw e;\n}","preventionTips":["Infer the ecosystem from project files (package.json→npm, pyproject.toml→PyPI) in scripts.","Always pass --ecosystem explicitly for package queries.","Document the ecosystem requirement in wrapper tooling.","Use the ID-lookup flow when you have an advisory ID and no ecosystem."],"tags":["argument-validation","missing-flag","osv"],"backgroundTag":"missing-required-argument","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}