{"record":{"id":"3ee8ec8a434949bf","repo":"nats-io/nats-server","slug":"error-setting-up-update-handling-v","errorCode":null,"errorMessage":"error setting up update handling: %v","messagePattern":"error setting up update handling: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4540,"sourceCode":"\t\t\t\treturn\n\t\t\t}\n\t\t\tif claim, err := jwt.DecodeAccountClaims(string(msg)); err != nil {\n\t\t\t\trespondToUpdate(s, resp, \"n/a\", \"jwt update resulted in error\", err)\n\t\t\t} else if err := claimValidate(claim); err != nil {\n\t\t\t\trespondToUpdate(s, resp, claim.Subject, \"jwt validation failed\", err)\n\t\t\t} else if claim.Subject != pubKey {\n\t\t\t\terr := errors.New(\"subject does not match jwt content\")\n\t\t\t\trespondToUpdate(s, resp, pubKey, \"jwt update resulted in error\", err)\n\t\t\t} else if claim.Issuer == op && strict {\n\t\t\t\terr := errors.New(\"operator requires issuer to be a signing key\")\n\t\t\t\trespondToUpdate(s, resp, pubKey, \"jwt update resulted in error\", err)\n\t\t\t} else if err := dr.save(pubKey, string(msg)); err != nil {\n\t\t\t\trespondToUpdate(s, resp, pubKey, \"jwt update resulted in error\", err)\n\t\t\t} else {\n\t\t\t\trespondToUpdate(s, resp, pubKey, \"jwt updated\", nil)\n\t\t\t}\n\t\t}); err != nil {\n\t\t\treturn fmt.Errorf(\"error setting up update handling: %v\", err)\n\t\t}\n\t}\n\tif _, err := s.sysSubscribe(accClaimsReqSubj, func(_ *subscription, c *client, _ *Account, _, resp string, msg []byte) {\n\t\t// As this is a raw message, we need to extract payload and only decode claims from it,\n\t\t// in case request is sent with headers.\n\t\t_, msg = c.msgParts(msg)\n\t\tif claim, err := jwt.DecodeAccountClaims(string(msg)); err != nil {\n\t\t\trespondToUpdate(s, resp, \"n/a\", \"jwt update resulted in error\", err)\n\t\t} else if claim.Issuer == op && strict {\n\t\t\terr := errors.New(\"operator requires issuer to be a signing key\")\n\t\t\trespondToUpdate(s, resp, claim.Subject, \"jwt update resulted in error\", err)\n\t\t} else if err := claimValidate(claim); err != nil {\n\t\t\trespondToUpdate(s, resp, claim.Subject, \"jwt validation failed\", err)\n\t\t} else if err := dr.save(claim.Subject, string(msg)); err != nil {\n\t\t\trespondToUpdate(s, resp, claim.Subject, \"jwt update resulted in error\", err)\n\t\t} else {\n\t\t\trespondToUpdate(s, resp, claim.Subject, \"jwt updated\", nil)\n\t\t}","sourceCodeStart":4522,"sourceCodeEnd":4558,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4522-L4558","documentation":"During setup of the directory-resolver update subscription, the server subscribes to the account update subject and registers a handler that saves the received JWT via dr.save. If s.sysSubscribe for that update handler fails (subscription setup error), the whole setup function aborts with 'error setting up update handling: %v', wrapping the underlying cause.","triggerScenarios":"Calling resolver setup (server start or reload) where sysSubscribe for the account claims update subject fails — e.g. internal subscription limits exhausted, malformed internal subject, or server shutting down concurrently.","commonSituations":"max_subscriptions / internal sub limits hit on busy servers; races during server shutdown/reload; resource exhaustion preventing new internal subscriptions.","solutions":["Inspect the wrapped %v cause in the error for the actual subscribe failure and fix that.","Raise internal subscription limits or reduce per-server subscription pressure.","Retry server start; check logs around shutdown/reload races."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := startResolver(); err != nil {\n    if strings.Contains(err.Error(), \"error setting up update handling\") {\n        log.WithError(err).Error(\"resolver update sub failed; check internal sub limits / shutdown state\")\n        // retry start after fixing cause\n    }\n}","preventionTips":["Monitor internal subscription counts against limits","Avoid reload/shutdown racing server startup","Parse the wrapped %v cause from startup logs"],"tags":["nats","resolver","subscription","internal"],"backgroundTag":"subscription-setup-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}