What causes "Invalid response from the server." in octobercms/october?

Fetch the changelog URL manually and confirm it returns pure JSON

octobercms/october · warning · ApplicationException

system::lang.server.response_invalid

system::lang.server.response_invalid

Error message

Invalid response from the server.

What it means

requestChangelog() wraps json_decode($contents, true) in try/catch and throws 'Invalid response from the server' (response_invalid) when decoding fails. The changelog endpoint returned HTTP 200 but a body that is not valid JSON — typically an HTML page, a truncated response, or injected content. Note the quirk: unlike the JSON-path code in HasGatewayAccess, there is no post-decode emptiness check, so only a hard decode failure triggers this.

Source

Thrown at modules/system/classes/updatemanager/ManagesModules.php:193

        $contents = $result->body();

        if ($result->status() === 404) {
            throw new ApplicationException(Lang::get('system::lang.server.response_empty'));
        }

        if ($result->status() !== 200) {
            throw new ApplicationException(
                strlen($contents)
                ? $contents
                : Lang::get('system::lang.server.response_empty')
            );
        }

        try {
            $resultData = json_decode($contents, true);
        }
        catch (Exception $ex) {
            throw new ApplicationException(Lang::get('system::lang.server.response_invalid'));
        }

        return $resultData;
    }

    /**
     * getBuildFromVersion will return the patch version of a semver string
     * eg: 1.2.3 -> 3, 1.2.3-dev -> 3
     */
    protected function getBuildFromVersion(string $version): int
    {
        $parts = explode('.', $version);
        if (count($parts) !== 3) {
            return 0;
        }

        $lastPart = $parts[2];
        if (!is_numeric($lastPart)) {

View on GitHub (pinned to b608633a7e)

Solutions

Fetch the changelog URL manually and confirm it returns pure JSON
Remove HTML-injecting middleware (WAF pages, proxies, captive portals) from the path to octobercms.com
Check for output corruption: BOM, leading whitespace, or appended scripts in the raw body
Update the CMS if running an old build whose changelog URL/format predates current octobercms.com

Defensive patterns

Strategy: try-catch

Try / catch

try {
    $changelog = \System\Classes\UpdateManager::instance()->requestChangelog();
} catch (\October\Rain\Exception\ApplicationException $ex) {
    if (str_contains($ex->getMessage(), 'Invalid response')) {
        // 200 + non-JSON body — likely a proxy/portal injecting HTML
        Log::warning('Changelog payload was not JSON');
        $changelog = [];
    } else {
        throw $ex;
    }
}

Prevention

Ensure nothing (WAF, proxy, captive portal) rewrites bodies from octobercms.com
Log raw bodies on decode failures once, to identify the injected content
Don't assume 200 means success — validate JSON before use in your own gateway clients too

When it happens

Trigger: Changelog request answered with 200 + HTML (captive portal, error template with 200 status, proxy interstitial); body corrupted in transit; any backend view that calls requestChangelog().

Common situations: Captive/filtered networks rewriting responses; WAF or ad-injection middleware appending content; custom environments pointing the changelog host elsewhere; partial responses from flaky TLS middleboxes.

Related errors

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/8ad014bf4f422cd6. Report an issue: GitHub.