Budibase/budibase · error · HTTPError

Project package is too large.

Error message

Project package is too large.

What it means

readDirectoryRecursively walks the extracted project package directory and accumulates total file count and byte size. When the cumulative extracted size exceeds MAX_EXTRACTED_SIZE_BYTES it throws this HTTPError (400). Budibase enforces this limit to prevent resource exhaustion (zip bombs / oversized imports) on the server.

Source

Thrown at packages/server/src/sdk/workspace/projects/backups/imports.ts:210

        400
      )
    }
    if (entry.isSymbolicLink()) {
      throw new HTTPError("Project package contains unsupported links.", 400)
    }
    if (entry.isDirectory()) {
      files.push(
        ...(await readDirectoryRecursively(fullPath, rootPath, totals))
      )
    } else {
      const stats = await fsp.stat(fullPath)
      totals.files += 1
      totals.bytes += stats.size
      if (totals.files > MAX_PACKAGE_FILES) {
        throw new HTTPError("Project package contains too many files.", 400)
      }
      if (totals.bytes > MAX_EXTRACTED_SIZE_BYTES) {
        throw new HTTPError("Project package is too large.", 400)
      }
      files.push(fullPath)
    }
  }

  return files
}

const validateProjectPackageBeforeExtraction = async (file: {
  path: string
}) => {
  const archiveHeader = new Uint8Array(2)
  const archiveFile = await fsp.open(file.path, "r")
  try {
    await archiveFile.read(archiveHeader, 0, archiveHeader.length, 0)
  } finally {
    await archiveFile.close()
  }

View on GitHub (pinned to a81a902e9a)

Solutions

1. Reduce the package size: remove unnecessary files (node_modules, build output, attachments) from the export directory before compressing.
2. Check MAX_EXTRACTED_SIZE_BYTES in packages/server/src/sdk/workspace/projects/backups/imports.ts and, if you self-host and accept the risk, raise the limit via configuration.
3. Verify the uploaded .tar.gz is not corrupted/duplicated content by re-exporting the project from source.
4. Split very large projects into smaller apps, or import subsets of resources manually.

Example fix

// before: exporting everything including heavy artifacts
tar -czf app-export.tar.gz ./my-app  // my-app contains node_modules, dist
// after: export only the app resources
tar -czf app-export.tar.gz --exclude=node_modules --exclude=dist ./my-app

import { statSync, readdirSync } from "fs"
import { join } from "path"

function dirSize(dir: string): { files: number; bytes: number } {
  let totals = { files: 0, bytes: 0 }
  for (const entry of readdirSync(dir, { withFileTypes: true })) {
    const p = join(dir, entry.name)
    if (entry.isDirectory()) {
      const sub = dirSize(p)
      totals.files += sub.files
      totals.bytes += sub.bytes
    } else {
      totals.files += 1
      totals.bytes += statSync(p).size
    }
  }
  return totals
}

const t = dirSize(extractedDir)
if (t.bytes > MAX_EXTRACTED_SIZE_BYTES) throw new Error("Package too large")

try {
  await api.importProjectPackage(file)
} catch (err) {
  if (err?.status === 400 && err?.message === "Project package is too large.") {
    // surface size guidance to user: reduce package contents or raise limit
  } else throw err
}

When it happens

Trigger: Importing a project package (backup upload) whose extracted contents total more bytes than MAX_EXTRACTED_SIZE_BYTES, as measured while recursively reading the extraction directory after an earlier file pushed the running total over the limit.

Common situations: Restoring a very large app export; a package that balloons on extraction (compressed tar.gz much smaller than extracted contents, i.e. compression-bomb style packages); accidental inclusion of build artifacts, node_modules or large attachments inside the export directory.

Related errors

• Unsupported Project doc path '${relPath}'.
• Project package contains a doc without an id.
• Project package doc path does not match '${id}'.
• Project package doc '${id}' does not match resource type '${
• Project import failed while saving '${failedId}'.

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/2998f6c44b03e8cc. Report an issue: GitHub.