jackwener/OpenCLI · error · CommandExecutionError

${label} returned HTTP ${resp.status}

Error message

${label} returned HTTP ${resp.status}

What it means

Generic catch-all for any non-ok HTTP status from api.osv.dev that isn't 404 or 429 (e.g. 500, 502, 503). Thrown as a CommandExecutionError with the raw status code and no remediation hint, since the failure is server-side or unexpected.

Source

Thrown at clis/osv/utils.js:115

export async function osvGet(url, label) {
    let resp;
    try {
        resp = await fetch(url, { headers: { 'user-agent': UA, accept: 'application/json' } });
    }
    catch (err) {
        throw new CommandExecutionError(
            `${label} request failed: ${err?.message ?? err}`,
            'Check that api.osv.dev is reachable from this network.',
        );
    }
    if (resp.status === 404) {
        throw new EmptyResultError(label, `OSV.dev returned 404 for ${url}.`);
    }
    if (resp.status === 429) {
        throw new CommandExecutionError(`${label} returned HTTP 429 (rate limited)`);
    }
    if (!resp.ok) {
        throw new CommandExecutionError(`${label} returned HTTP ${resp.status}`);
    }
    return readJson(resp, label);
}

export async function osvPost(url, payload, label) {
    let resp;
    try {
        resp = await fetch(url, {
            method: 'POST',
            headers: { 'user-agent': UA, accept: 'application/json', 'content-type': 'application/json' },
            body: JSON.stringify(payload),
        });
    }
    catch (err) {
        throw new CommandExecutionError(
            `${label} request failed: ${err?.message ?? err}`,
            'Check that api.osv.dev is reachable from this network.',
        );

View on GitHub (pinned to 49907e53dc)

Solutions

1. Retry after a short delay — 5xx statuses are usually transient on OSV.dev
2. Log/handle the status code: 4xx indicates a bad request (fix the ID/URL), 5xx indicates a server problem
3. Check whether a corporate proxy or firewall is intercepting api.osv.dev traffic
4. Check OSV.dev status or its status page / GitHub for ongoing incidents

Example fix

// before
try { const v = await osvGet(url, label); } catch (e) { throw e; }
// after
try { return await osvGet(url, label); }
catch (e) {
  if (/HTTP 5\d\d/.test(e.message)) return retryWithBackoff(() => osvGet(url, label));
  throw e;
}

const healthy = await fetch('https://api.osv.dev/v1/query', { method: 'HEAD' }).then(r => r.ok).catch(() => false); // pre-check service availability

function isServerError(err) { return err instanceof Error && /HTTP 5\d\d/.test(err.message); }

try {
  return await vuln(id);
} catch (e) {
  if (isServerError(e)) return retryWithBackoff(() => vuln(id), { retries: 3 });
  throw e;
}

When it happens

Trigger: osvGet (called by `vuln`) received a response whose status was neither 404 nor 429 and not resp.ok — for example a 5xx from OSV.dev infrastructure or an unexpected 3xx/4xx like 400 or 403.

Common situations: OSV.dev having a temporary outage; a proxy/firewall returning 403 or 502; sending a request shape OSV rejects with 400; corporate proxies MITM-ing TLS and returning gateway errors.

Related errors

• arXiv API HTTP ${resp.status}
• Bilibili creator comparison request failed: ${detail}
• coingecko categories returned HTTP ${resp.status}
• ${label} returned HTTP ${resp.status}
• Flomo API returned HTTP ${resp.status}

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/abad3fb80cd141f6. Report an issue: GitHub.