jackwener/OpenCLI · error · ArgumentError

osv --ecosystem "${value}" is not a recognised OSV ecosystem

Error message

osv --ecosystem "${value}" is not a recognised OSV ecosystem

What it means

requireEcosystem validates the value against the OSV_ECOSYSTEMS allowlist; unknown strings are rejected. OSV ecosystems are case-sensitive registry names (e.g. 'PyPI', not 'pypi'; 'crates.io', not 'cargo').

Source

Thrown at clis/osv/utils.js:66

    if (!VULN_ID.test(s)) {
        throw new ArgumentError(
            `osv vulnerability id "${value}" is not a valid OSV id`,
            'IDs are short ASCII tokens like "GHSA-...", "CVE-...", "PYSEC-...".',
        );
    }
    return s;
}

export function requireEcosystem(value) {
    const s = String(value ?? '').trim();
    if (!s) {
        throw new ArgumentError(
            'osv --ecosystem is required when querying by package',
            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,
        );
    }
    if (!OSV_ECOSYSTEMS.has(s)) {
        throw new ArgumentError(
            `osv --ecosystem "${value}" is not a recognised OSV ecosystem`,
            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,
        );
    }
    return s;
}

export function requireBoundedInt(value, defaultValue, maxValue, label = 'limit') {
    const raw = value ?? defaultValue;
    const n = typeof raw === 'number' ? raw : Number(raw);
    if (!Number.isInteger(n) || n <= 0) {
        throw new ArgumentError(`osv ${label} must be a positive integer`);
    }
    if (n > maxValue) {
        throw new ArgumentError(`osv ${label} must be <= ${maxValue}`);
    }
    return n;
}

View on GitHub (pinned to 49907e53dc)

Solutions

1. Use an exact value from the allowlist: npm, PyPI, Go, Maven, NuGet, RubyGems, crates.io, Packagist, Pub, Hex, Hackage, CRAN, Bitnami, GitHub Actions, SwiftURL.
2. Fix casing to match the canonical OSV name (PyPI, RubyGems, crates.io).
3. Map common aliases in your wrapper (node→npm, cargo→crates.io, pip→PyPI).
4. Consult https://ossf.github.io/osv-schema/#defined-ecosystems for canonical names.

Example fix

// before
requireEcosystem('pypi');
// after
requireEcosystem('PyPI');

const OSV_ECOSYSTEMS = new Set(['npm','PyPI','Go','Maven','NuGet','RubyGems','crates.io','Packagist','Pub','Hex','Hackage','CRAN','Bitnami','GitHub Actions','SwiftURL']);
if (!OSV_ECOSYSTEMS.has(ecosystem)) {
  throw new Error(`Unknown ecosystem "${ecosystem}" — use one of: ${[...OSV_ECOSYSTEMS].join(', ')}`);
}

const isKnownEcosystem = (v) =>
  typeof v === 'string' && OSV_ECOSYSTEMS.has(v.trim());

try {
  const result = await osvQuery({ ecosystem, name });
} catch (e) {
  if (e instanceof ArgumentError && /not a recognised OSV ecosystem/.test(e.message)) {
    console.error('Fix the ecosystem name/case, e.g. pypi→PyPI, cargo→crates.io');
    return;
  }
  throw e;
}

When it happens

Trigger: Passing an unsupported or misspelled ecosystem: 'node', 'javascript', 'pypi', 'cargo', 'ruby', 'CRATES.IO', etc.

Common situations: Guessing ecosystem names instead of using registry names; lowercase normalization from config files; mapping language names rather than package-manager names.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• osv ${label} cannot be empty
• osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9"
• osv vulnerability id "${value}" is not a valid OSV id
• Unknown 12306 station telecode "${trimmed}"
• Unknown 12306 station "${trimmed}"

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/ef4e320808824d9a. Report an issue: GitHub.