Skip to content

uv audit fails with error decoding response body when OSV returns empty range events #19492

@angryfoxx

Description

@angryfoxx

Summary

uv audit errors with
error decoding response body
(expected value at line 1 column N).

An OSV vuln. (PYSEC-2026-89)
include an empty {} in affected.ranges.events, which breaks strict event deserialization.

Repro:

uv audit --preview-features audit

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingexternalThe problem is with another package or dependency (not uv)uv auditRelated to uv audit functionality

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions