badges/shields · error · InvalidParameter

No version or ref for ${wantedDependency}

Error message

No version or ref for ${wantedDependency}

What it means

This InvalidParameter error is thrown when the dependency WAS found in the lockfile but its entry contains neither a usable version nor a ref (both missing/null). Pipfile.lock entries normally carry a version like '==1.2.3' or a git ref; an entry without either cannot produce a badge.

Source

Thrown at services/pipenv-helpers.js:80

  if (!(wantedDependency in dependenciesOfKind)) {
    throw new InvalidParameter({
      prettyMessage: `${kind} dependency not found`,
    })
  }

  const { version, ref } = dependenciesOfKind[wantedDependency]

  if (version) {
    // Strip the `==` which is always present.
    return { version: version.replace('==', '') }
  } else if (ref) {
    if (ref.length === 40) {
      // assume it is a commit hash
      return { ref: ref.substring(0, 7) }
    }
    return { ref } // tag
  } else {
    throw new InvalidParameter({
      prettyMessage: `No version or ref for ${wantedDependency}`,
    })
  }
}

export { isLockfile, getDependencyVersion }

View on GitHub (pinned to 766fd8bc89)

Solutions

  1. Regenerate the lockfile with `pipenv lock` so every entry has version or ref metadata
  2. Inspect the offending entry in Pipfile.lock and restore the missing 'version' or 'ref' field
  3. Avoid hand-editing Pipfile.lock; use `pipenv install pkg==x.y.z` then relock
  4. Check for unresolved git-merge markers in Pipfile.lock

Example fix

// before (Pipfile.lock)
"requests": { "hashes": [...] }
// after
"requests": { "version": "==2.31.0", "hashes": [...] }
Defensive patterns

Strategy: validation

Validate before calling

const entry = lock.default[wantedDependency]
if (!entry || (!entry.version && !entry.ref)) throw new Error(`Lockfile entry for ${wantedDependency} has neither version nor ref; relock with pipenv lock`)

Type guard

function hasVersionOrRef(entry) {
  return typeof entry === 'object' && entry !== null && (typeof entry.version === 'string' || typeof entry.ref === 'string')
}

Try / catch

try {
  const v = await getDependencyVersion({ kind, wantedDependency }, lockfileData)
} catch (e) {
  if (e instanceof InvalidParameter && e.message.startsWith('No version or ref')) console.warn(`Malformed lockfile entry for ${wantedDependency}; run 'pipenv lock'`)
  else throw e
}

Prevention

When it happens

Trigger: A hand-edited or corrupted Pipfile.lock where the dependency object lacks 'version' and 'ref'; lockfile written by a tool variant that stores resolution differently.

Common situations: Manual lockfile editing, merge conflicts resolved badly inside Pipfile.lock, or exotic dependency entries (e.g. file/path deps) that omit version metadata.

Related errors

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/bb08591b1ac141eb. Report an issue: GitHub.