google / google/osv-scanner

Improve error message when Python requirements transitive dependency resolution fails behind SOCKS5 proxy on Windows

Open
#2,891 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

## Summary

While testing OSV-Scanner on Windows PowerShell behind a local SOCKS5 proxy, I found that scanning Python projects with `requirements.txt` can fail during transitive dependency resolution with `unexpected EOF`.

The scanner successfully detects the requirements files, but the extraction step fails when resolving dependencies. Under the same proxy environment, scanning another Python project with `uv.lock` works, so this seems specific to the requirements/transitive dependency resolution path or its error reporting.

## Environment

* OS: Windows
* Shell: PowerShell
* OSV-Scanner version: `
osv-scanner version: 2.3.8
osv-scalibr version: 0.4.5
commit: 408fcd6f8707999a29e7ba45e15809764cf24f67
built at: 2026-05-08T04:54:35Z
* Proxy: SOCKS5 `127.0.0.1:1080`
* Failed project: `psf/requests`
* Successful comparison project: `fastapi/fastapi`

## Proxy setup

```powershell
$proxy = "socks5://127.0.0.1:1080"
$env:HTTP_PROXY=$proxy
$env:HTTPS_PROXY=$proxy
$env:ALL_PROXY=$proxy
$env:http_proxy=$proxy
$env:https_proxy=$proxy
$env:all_proxy=$proxy
```

## Command that reproduces the issue

```powershell
osv-scanner scan source -r .\projects\requests --format json --output-file .\results\osv\requests.osv.json --verbosity info
```

## Actual behavior

OSV-Scanner detects the requirements files:

```text
Scanned F:\Github\supply-chain-sca-lab\projects\requests\docs\requirements.txt file and found 1 package
Scanned F:\Github\supply-chain-sca-lab\projects\requests\requirements-dev.txt file and found 6 packages
```

But dependency resolution fails:

```text
failed resolution for Github/supply-chain-sca-lab/projects/requests/docs/requirements.txt: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: reading server HTTP response: unexpected EOF"

failed resolution for Github/supply-chain-sca-lab/projects/requests/requirements-dev.txt: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: reading server HTTP response: unexpected EOF"

Error during extraction: (extracting as transitivedependency/requirements) failed resolution for Github/supply-chain-sca-lab/projects/requests/docs/requirements.txt: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: reading server HTTP response: unexpected EOF"
```

## Comparison

Using the same proxy environment, scanning `fastapi/fastapi` with `uv.lock` completes the extraction step:

```powershell
osv-scanner scan source -r .\projects\fastapi --format json --output-file .\results\osv\fastapi.osv.json --verbosity info
```

Output:

```text
Scanned F:\Github\supply-chain-sca-lab\projects\fastapi\uv.lock file and found 246 packages
Filtered 1 local/unscannable package/s from the scan.
```

## Expected behavior

When requirements transitive dependency resolution fails because of proxy/network issues, the scanner could provide a clearer message or troubleshooting hint.

For example, it would be helpful to mention:

* requirements transitive dependency resolution may require network access;
* proxy configuration may affect this step;
* Windows PowerShell users may need to verify `HTTP_PROXY`, `HTTPS_PROXY`, and `ALL_PROXY`;
* whether using an HTTP proxy or `--no-resolve` could be used as a diagnostic workaround.

## Why this matters

For students, researchers, and developers using OSV-Scanner in restricted network environments, this error is difficult to distinguish from a package extraction problem or an OSV API problem. A short troubleshooting note or clearer error message would make OSV-Scanner easier to use for Windows and beginner users.

[requests_minimal_repro_clean.log](https://github.com/user-attachments/files/28952725/requests_minimal_repro_clean.log)

## Additional logs

I attached a sanitized minimal reproduction log for the `requests` scan. The issue body includes the key lines, while the attached log preserves the full command output from the reproduction run.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.