jackwener/OpenCLI · error · ArgumentError

osv ${label} cannot be empty

Error message

osv ${label} cannot be empty

What it means

requireString rejects any value that is null, undefined, or trims to an empty string for a required OSV CLI string argument. It throws ArgumentError before any network call is made.

Source

Thrown at clis/osv/utils.js:36

    'PyPI',
    'Go',
    'Maven',
    'NuGet',
    'RubyGems',
    'crates.io',
    'Packagist',
    'Pub',
    'Hex',
    'Hackage',
    'CRAN',
    'Bitnami',
    'GitHub Actions',
    'SwiftURL',
]);

export function requireString(value, label) {
    const s = String(value ?? '').trim();
    if (!s) throw new ArgumentError(`osv ${label} cannot be empty`);
    return s;
}

export function requireVulnId(value) {
    const s = String(value ?? '').trim();
    if (!s) {
        throw new ArgumentError(
            'osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9", "CVE-2020-28500")',
            'IDs are listed at https://osv.dev — paste the canonical id from the vulnerability page.',
        );
    }
    if (!VULN_ID.test(s)) {
        throw new ArgumentError(
            `osv vulnerability id "${value}" is not a valid OSV id`,
            'IDs are short ASCII tokens like "GHSA-...", "CVE-...", "PYSEC-...".',
        );
    }
    return s;

View on GitHub (pinned to 49907e53dc)

Solutions

1. Supply the required argument, e.g. --name lodash.
2. Check that the shell variable feeding the flag is actually set and non-empty.
3. Quote arguments so whitespace doesn't get eaten, and trim user input before passing.
4. Add shell-level checks ([ -n "$PKG" ]) before invoking the command in scripts.

Example fix

// before
const name = requireString(process.env.PKG, 'name'); // PKG unset
// after
const name = requireString(process.env.PKG || 'lodash', 'name');

if (value == null || String(value).trim() === '') {
  throw new Error(`osv ${label} cannot be empty: provide a non-empty value`);
}

const isNonEmptyString = (v) => typeof v === 'string' && v.trim().length > 0;

try {
  return await runOsvCommand(args);
} catch (e) {
  if (e instanceof ArgumentError && /cannot be empty/.test(e.message)) {
    console.error(`Missing required argument: ${e.message}`);
    process.exitCode = 2;
    return;
  }
  throw e;
}

When it happens

Trigger: Calling a command that routes through requireString (e.g. package `name`) with an empty string, whitespace-only string, null, or undefined — commonly an unset flag or shell variable that expanded to nothing.

Common situations: `--name ""` on the command line; an env var like $PKG that is unset; a script passing an empty field from a parsed manifest; piping empty input.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• osv vulnerability id is required (e.g. "GHSA-29mw-wpgm-hmr9"
• ${label} must be a non-negative integer, got ${JSON.stringif
• limit must be a positive integer
• archive wayback timestamp must be YYYY[MM[DD[hh[mm[ss]]]]] o
• archive wayback url cannot be empty

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/c5e30c858a85000f. Report an issue: GitHub.