Analyzer dependency graph exceeded ${limits.runtimePackages}

Error message

Analyzer dependency graph exceeded ${limits.runtimePackages} packages: ${packageRoot}

What it means

Thrown by collectRuntimePackages when the number of distinct dependency packages discovered exceeds limits.runtimePackages (default 10_000). The counter increments once per newly resolved childRoot (not per edge), so this fires on the breadth of the dependency closure rather than its edge fan-out. It protects the identity hash from unbounded manifest reads.

Source

Thrown at gitnexus/src/core/analyzer-identity.ts:1260

        pathGuards,
        limits,
      );
      if (!childRoot) {
        edges.push({
          parentLocator: parent.locator,
          parentLabel: parent.label,
          dependencyName,
          childLocator: '<missing>',
          childLabel: '<missing>',
        });
        continue;
      }

      let child = packages.get(childRoot);
      if (!child) {
        budget.packages += 1;
        if (budget.packages > limits.runtimePackages) {
          throw new Error(
            `Analyzer dependency graph exceeded ${limits.runtimePackages} packages: ${packageRoot}`,
          );
        }
        const manifestPath = path.join(childRoot, 'package.json');
        recordDirectoryGuard(directoryGuards, childRoot);
        const read = readManifest(manifestPath, options, budget, limits);
        child = {
          root: childRoot,
          locator: runtimePackageLocator(packageRoot, childRoot),
          manifestPath,
          manifestBytes: read.bytes,
          manifestState: read.state,
          manifest: read.manifest,
          label: manifestLabel(read.manifest),
        };
        packages.set(childRoot, child);
        queue.push(child);
      }

View on GitHub (pinned to d540b00184)

Solutions

Deduplicate dependencies: run `npm dedupe` (or rely on pnpm/yarn dedup) so one resolved root serves all requesters.
Audit the biggest offenders with `npm ls --all --parseable | sort -u | wc -l` and remove unused transitive fat.
Move heavy dev-only trees out of the package that runs the analyzer, or run the analyzer against a production install.
Do NOT try to raise runtimePackages via options.traversalLimits — resolveTraversalLimits clamps overrides to Math.min(value, default), so the ceiling is fixed at 10k.

Example fix

// before: 12k+ unique package roots from duplicated versions
//   -> "Analyzer dependency graph exceeded 10000 packages"
//
// after: dedupe to a single resolved root per package
//   $ npm dedupe
//   $ npm ls --all --parseable | sort -u | wc -l   # verify < 10000

Defensive patterns

Strategy: validation

Validate before calling

const { execSync } = require('node:child_process');
function assertPackageCountFeasible(packageRoot) {
  let out;
  try { out = execSync('npm ls --all --parseable', { cwd: packageRoot, stdio: ['ignore','pipe','ignore'], maxBuffer: 64*1024*1024 }).toString(); }
  catch (e) { out = e.stdout?.toString() ?? ''; }
  const uniqueRoots = new Set(out.split('\n').filter(Boolean)).size;
  if (uniqueRoots > 9_500) {
    throw new Error(`Unique package roots ${uniqueRoots} near the 10000 analyzer limit; run 'npm dedupe'.`);
  }
}
// assertPackageCountFeasible(process.cwd());

Prevention

Run `npm dedupe` (or pnpm/yarn dedupe) after every install so each package resolves to one root.
Audit duplicate versions: `npm ls <pkg>` and pin to a single version where possible.
The runtimePackages cap is hard-clamped to 10_000 — no option raises it; shrinking the install is the only relief.
For monorepos, prefer a hoisted node-linker when running the analyzer.

When it happens

Trigger: resolveAnalyzerRunnerIdentity() cold path -> collectRuntimePackages: the `packages` Map gains a new entry for each unique childRoot resolved via resolveDependencyPackageRoot. When budget.packages crosses 10k (the 10_001st unique package), the next insertion throws before readManifest runs.

Common situations: A polyfilled browser/electron project pulling a huge transitive set, a pnpm install with many distinct versioned duplicates of the same package (each resolved root counts once), or an accidental `npm install` of a meta-package that aggregates hundreds of sub-packages. Monorepos that vendor copies of shared libs also blow the count.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/a722a577b39e7304. Report an issue: GitHub.