Improve error message when Python requirements transitive dependency resolution fails behind SOCKS5 proxy on Windows
- Dominant language
- Go
- Stars
- 11k
- Forks
- 792
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 48
Description
## Summary
While testing OSV-Scanner on Windows PowerShell behind a local SOCKS5 proxy, I found that scanning Python projects with `requirements.txt` can fail during transitive dependency resolution with `unexpected EOF`.
The scanner successfully detects the requirements files, but the extraction step fails when resolving dependencies. Under the same proxy environment, scanning another Python project with `uv.lock` works, so this seems specific to the requirements/transitive dependency resolution path or its error reporting.
## Environment
* OS: Windows
* Shell: PowerShell
* OSV-Scanner version: `
osv-scanner version: 2.3.8
osv-scalibr version: 0.4.5
commit: 408fcd6f8707999a29e7ba45e15809764cf24f67
built at: 2026-05-08T04:54:35Z
* Proxy: SOCKS5 `127.0.0.1:1080`
* Failed project: `psf/requests`
* Successful comparison project: `fastapi/fastapi`
## Proxy setup
```powershell
$proxy = "socks5://127.0.0.1:1080"
$env:HTTP_PROXY=$proxy
$env:HTTPS_PROXY=$proxy
$env:ALL_PROXY=$proxy
$env:http_proxy=$proxy
$env:https_proxy=$proxy
$env:all_proxy=$proxy
```
## Command that reproduces the issue
```powershell
osv-scanner scan source -r .\projects\requests --format json --output-file .\results\osv\requests.osv.json --verbosity info
```
## Actual behavior
OSV-Scanner detects the requirements files:
```text
Scanned F:\Github\supply-chain-sca-lab\projects\requests\docs\requirements.txt file and found 1 package
Scanned F:\Github\supply-chain-sca-lab\projects\requests\requirements-dev.txt file and found 6 packages
```
But dependency resolution fails:
```text
failed resolution for Github/supply-chain-sca-lab/projects/requests/docs/requirements.txt: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: reading server HTTP response: unexpected EOF"
failed resolution for Github/supply-chain-sca-lab/projects/requests/requirements-dev.txt: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: reading server HTTP response: unexpected EOF"
Error during extraction: (extracting as transitivedependency/requirements) failed resolution for Github/supply-chain-sca-lab/projects/requests/docs/requirements.txt: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: reading server HTTP response: unexpected EOF"
```
## Comparison
Using the same proxy environment, scanning `fastapi/fastapi` with `uv.lock` completes the extraction step:
```powershell
osv-scanner scan source -r .\projects\fastapi --format json --output-file .\results\osv\fastapi.osv.json --verbosity info
```
Output:
```text
Scanned F:\Github\supply-chain-sca-lab\projects\fastapi\uv.lock file and found 246 packages
Filtered 1 local/unscannable package/s from the scan.
```
## Expected behavior
When requirements transitive dependency resolution fails because of proxy/network issues, the scanner could provide a clearer message or troubleshooting hint.
For example, it would be helpful to mention:
* requirements transitive dependency resolution may require network access;
* proxy configuration may affect this step;
* Windows PowerShell users may need to verify `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY`;
* whether using an HTTP proxy or `--no-resolve` could be used as a diagnostic workaround.
## Why this matters
For students, researchers, and developers using OSV-Scanner in restricted network environments, this error is difficult to distinguish from a package extraction problem or an OSV API problem. A short troubleshooting note or clearer error message would make OSV-Scanner easier to use for Windows and beginner users.
[requests_minimal_repro_clean.log](https://github.com/user-attachments/files/28952725/requests_minimal_repro_clean.log)
## Additional logs
I attached a sanitized minimal reproduction log for the `requests` scan. The issue body includes the key lines, while the attached log preserves the full command output from the reproduction run.
Contributor guide
Assessment
This issue has not been assessed yet.