jackwener/OpenCLI · error · ArgumentError

osv --ecosystem is required when querying by package

Error message

osv --ecosystem is required when querying by package

What it means

requireEcosystem rejects an empty --ecosystem value because package queries must state which registry ecosystem to search. The hint lists every accepted ecosystem from OSV_ECOSYSTEMS.

Source

Thrown at clis/osv/utils.js:60

    if (!s) {
        throw new ArgumentError(
            'osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9", "CVE-2020-28500")',
            'IDs are listed at https://osv.dev — paste the canonical id from the vulnerability page.',
        );
    }
    if (!VULN_ID.test(s)) {
        throw new ArgumentError(
            `osv vulnerability id "${value}" is not a valid OSV id`,
            'IDs are short ASCII tokens like "GHSA-...", "CVE-...", "PYSEC-...".',
        );
    }
    return s;
}

export function requireEcosystem(value) {
    const s = String(value ?? '').trim();
    if (!s) {
        throw new ArgumentError(
            'osv --ecosystem is required when querying by package',
            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,
        );
    }
    if (!OSV_ECOSYSTEMS.has(s)) {
        throw new ArgumentError(
            `osv --ecosystem "${value}" is not a recognised OSV ecosystem`,
            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,
        );
    }
    return s;
}

export function requireBoundedInt(value, defaultValue, maxValue, label = 'limit') {
    const raw = value ?? defaultValue;
    const n = typeof raw === 'number' ? raw : Number(raw);
    if (!Number.isInteger(n) || n <= 0) {
        throw new ArgumentError(`osv ${label} must be a positive integer`);

View on GitHub (pinned to 49907e53dc)

Solutions

1. Add --ecosystem with one of the supported values (npm, PyPI, Go, Maven, NuGet, RubyGems, crates.io, Packagist, Pub, Hex, Hackage, CRAN, Bitnami, GitHub Actions, SwiftURL).
2. If looking up a known vulnerability ID instead, use the ID flow which needs no ecosystem.
3. Default the ecosystem in your wrapper script based on the project type (e.g. npm for package.json repos).

Example fix

// before
await osvQuery({ name: 'lodash' }); // ecosystem missing
// after
await osvQuery({ ecosystem: 'npm', name: 'lodash' });

if (!ecosystem || String(ecosystem).trim() === '') {
  throw new Error('--ecosystem is required for package queries (e.g. npm, PyPI, Go)');
}

const hasEcosystem = (p) =>
  typeof p === 'object' && p !== null && typeof p.ecosystem === 'string' && p.ecosystem.trim() !== '';

try {
  const result = await osvQuery({ ecosystem, name });
} catch (e) {
  if (e instanceof ArgumentError && /--ecosystem is required/.test(e.message)) {
    console.error('Add --ecosystem <name>; see https://ossf.github.io/osv-schema/#defined-ecosystems');
    return;
  }
  throw e;
}

When it happens

Trigger: Running a package-based OSV query without --ecosystem, or with an empty/whitespace value; an unset env var feeding the flag.

Common situations: Omitting the flag in scripts; confusing the ecosystem flag with the vulnerability-ID flow (which doesn't need it); a config file missing the ecosystem field.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• osv ${label} cannot be empty
• osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9"
• osv ${label} must be a positive integer
• osv ${label} must be <= ${maxValue}
• Either --to or --to-fid is required

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/3a058b5dbe0fe900. Report an issue: GitHub.