badges/shields · error · NotFound

version requirement not found

Error message

version requirement not found

What it means

This NotFound error means the requested package version WAS found on Packagist, but that version's metadata has no 'require' section — i.e. its composer.json declares no dependencies. The service needs the require map to look up the dependency's constraint.

Source

Thrown at services/packagist/packagist-dependency-version.service.js:106

      try {
        packageVersion = await this.findSpecifiedVersion(
          versions,
          user,
          repo,
          version,
          server,
        )
      } catch (e) {
        packageVersion = null
      }
    }

    if (!packageVersion) {
      throw new NotFound({ prettyMessage: 'invalid version' })
    }

    if (!packageVersion.require) {
      throw new NotFound({ prettyMessage: 'version requirement not found' })
    }

    // All dependencies' names in the 'require' section from the response should be lowercase,
    // so that we can compare lowercase name of the dependency given via url by the user.
    Object.keys(packageVersion.require).forEach(dependency => {
      packageVersion.require[dependency.toLowerCase()] =
        packageVersion.require[dependency]
    })

    const depLowerCase = dependency.toLowerCase()

    if (!packageVersion.require[depLowerCase]) {
      throw new NotFound({ prettyMessage: 'version requirement not found' })
    }

    return { dependencyVersion: packageVersion.require[depLowerCase] }
  }

View on GitHub (pinned to 766fd8bc89)

Solutions

  1. Verify the target package version actually declares the dependency you are querying (check its composer.json on packagist.org)
  2. Remove the dependency-version badge for packages with no dependencies
  3. Query a different version of the package that does include the require entry
  4. If you maintain the package, add the correct require entries in composer.json and publish a new version

Example fix

// before
GET /packagist/vendor/leaf-package/1.0.0/symfony/console  ->  NotFound
// after
GET /packagist/vendor/full-package/1.0.0/symfony/console
Defensive patterns

Strategy: validation

Validate before calling

const versionMeta = await getPackagistVersionMeta(user, repo, version)
if (!versionMeta || !versionMeta.require || Object.keys(versionMeta.require).length === 0) throw new Error('Package version declares no dependencies; dependency badge not applicable')

Type guard

function hasRequireSection(pkgVersion) {
  return typeof pkgVersion === 'object' && pkgVersion !== null && typeof pkgVersion.require === 'object' && pkgVersion.require !== null && Object.keys(pkgVersion.require).length > 0
}

Try / catch

try {
  const result = await dependencyVersion(user, repo, dep, version)
} catch (e) {
  if (e instanceof NotFound && e.message === 'version requirement not found') console.warn('This package version has no require section; skip the dependency badge')
  else throw e
}

Prevention

When it happens

Trigger: Querying a dependency version for a package version whose composer.json has an empty or missing 'require' key (e.g. a package with no dependencies), such as /packagist/user/pkg/1.0.0/dep where pkg@1.0.0 requires nothing.

Common situations: Asking a dependency badge for a dependency of a dependency-less package; querying leaf/utility packages that declare no require entries.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/5ce5380e9a5ed669. Report an issue: GitHub.