github/copilot-sdk · error

failed to fetch legacy package-lock.json

Error message

failed to fetch legacy package-lock.json: %s

What it means

This error is returned when the HTTP response for the legacy package-lock.json has a non-200 status code. The bundler includes resp.Status (e.g. '404 Not Found') so the developer can see exactly what the server said. It typically means the gitRef is invalid or the file no longer exists at that ref.

Solutions

1. Check the HTTP status in the error message; a 404 means verify the gitRef and file path.
2. Confirm package-lock.json still exists at the given ref in the repository.
3. If 403, wait out or raise the GitHub rate limit (authenticated requests).
4. Retry on 5xx; transient server errors resolve themselves.
5. Fix the primary version source so the legacy fallback path is not needed.

Example fix

// before
if resp.StatusCode != http.StatusOK {
	return "", fmt.Errorf("failed to fetch legacy package-lock.json: %s", resp.Status)
}
// after
if resp.StatusCode == http.StatusNotFound {
	return "", fmt.Errorf("legacy package-lock.json not found at ref %q (check gitRef): %s", gitRef, resp.Status)
}
if resp.StatusCode != http.StatusOK {
	return "", fmt.Errorf("failed to fetch legacy package-lock.json: %s", resp.Status)
}

resp, err := http.Head(u)
if err != nil || resp.StatusCode != http.StatusOK {
	return fmt.Errorf("lockfile URL %s not reachable: %v", u, err)
}

v, err := fetchLegacyCLIVersionFromRepo(ref)
if err != nil {
	var httpErr *HTTPStatusError
	if errors.As(err, &httpErr) && httpErr.Code == http.StatusNotFound {
		// try a different gitRef
	}
}

When it happens

Trigger: http.Get succeeds but resp.StatusCode != http.StatusOK — most commonly 404 when the gitRef does not exist or package-lock.json was removed/renamed at that ref; also 403 rate limiting or 5xx server errors in fetchLegacyCLIVersionFromRepo.

Common situations: Typo or stale tag/branch in gitRef; repo restructured so package-lock.json moved; GitHub API rate limiting returning 403; transient GitHub 5xx outages during CI.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• failed to fetch legacy package-lock.json
• failed to fetch
• failed to fetch package.json
• failed to parse package.json
• failed to parse legacy package-lock.json

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/884f6a8baa035948. Report an issue: GitHub.

Appendix: source

Thrown at go/cmd/bundler/main.go:358

	if packageJSON.CopilotCLIVersion == "" {
		return fetchLegacyCLIVersionFromRepo(gitRef)
	}

	return packageJSON.CopilotCLIVersion, nil
}

func fetchLegacyCLIVersionFromRepo(gitRef string) (string, error) {
	url := fmt.Sprintf(packageLockURLFmt, gitRef)
	fmt.Printf("Falling back to %s...\n", url)

	resp, err := http.Get(url)
	if err != nil {
		return "", fmt.Errorf("failed to fetch legacy package-lock.json: %w", err)
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("failed to fetch legacy package-lock.json: %s", resp.Status)
	}

	var packageLock struct {
		Packages map[string]struct {
			Version string `json:"version"`
		} `json:"packages"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&packageLock); err != nil {
		return "", fmt.Errorf("failed to parse legacy package-lock.json: %w", err)
	}
	pkg, ok := packageLock.Packages["node_modules/@github/copilot"]
	if !ok || pkg.Version == "" {
		return "", fmt.Errorf("could not find copilotCliVersion in package.json or @github/copilot in package-lock.json")
	}
	return pkg.Version, nil
}

// isHex returns true if s contains only hexadecimal characters.

View on GitHub (pinned to cd8cf15dc3)