{"record":{"id":"63dc011b401c2b1b","repo":"apple/pkl","slug":"invaliddependencymetadata","errorCode":"invalidDependencyMetadata","errorMessage":"invalidDependencyMetadata","messagePattern":"invalidDependencyMetadata","errorType":"error_code","errorClass":"PackageLoadError","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java","lineNumber":118,"sourceCode":"\n    @Override\n    public Pair<DependencyMetadata, Checksums> getDependencyMetadataAndComputeChecksum(\n        PackageUri packageUri) throws IOException, SecurityManagerException {\n      var requestUri = packageUri.getMetadataRequestUri();\n      var inputStream = openExternalUri(requestUri);\n      return readDependencyMetadataAndComputeChecksum(packageUri, inputStream);\n    }\n\n    protected Pair<DependencyMetadata, Checksums> readDependencyMetadataAndComputeChecksum(\n        PackageUri packageUri, InputStream inputStream) throws IOException {\n      try (var in = newDigestInputStream(inputStream)) {\n        var bytes = in.readAllBytes();\n        var dependencyMetadata =\n            DependencyMetadata.parse(new String(bytes, StandardCharsets.UTF_8));\n        var checksums = new Checksums(ByteArrayUtils.toHex(in.getMessageDigest().digest()));\n        return Pair.of(dependencyMetadata, checksums);\n      } catch (JsonParseException e) {\n        throw new PackageLoadError(\n            e,\n            \"invalidDependencyMetadata\",\n            packageUri.getDisplayName(),\n            packageUri.getMetadataRequestUri(),\n            e.getMessage());\n      }\n    }\n\n    @Override\n    public List<PathElement> listElements(PackageAssetUri uri, @Nullable Checksums checksums)\n        throws IOException, SecurityManagerException {\n      checkNotClosed();\n      return doListElements(uri, checksums);\n    }\n\n    @Override\n    public boolean hasElement(PackageAssetUri uri, @Nullable Checksums checksums)\n        throws IOException, SecurityManagerException {","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java#L100-L136","documentation":"Pkl failed to parse the dependency metadata file (DependencyMetadata.json) fetched from a package's remote repository as JSON. PackageLoadError invalidDependencyMetadata is thrown by readDependencyMetadataAndComputeChecksum when Jackson raises a JsonParseException, wrapping the underlying parser message. It means the bytes at the metadata request URI are not well-formed JSON.","triggerScenarios":"Resolving a remote Pkl package whose DependencyMetadata.json is corrupt, truncated, HTML (e.g. a captive portal or error page returned with 200), or served from a wrong/non-repository URL.","commonSituations":"A proxy or corporate firewall intercepts the request and returns an HTML login page; a self-hosted package repository misconfigures the metadata path; the package registry is temporarily broken or the cached/uploaded metadata file was corrupted.","solutions":["Inspect the URL from the error message (packageUri metadata request URI) in a browser or curl and check whether it returns valid JSON.","Check for a proxy/firewall intercepting HTTPS requests and returning HTML; bypass or configure the proxy correctly.","Retry later if the package repository is temporarily broken, or use a different version of the package.","If you host the repository, re-upload or fix the DependencyMetadata.json file."],"exampleFix":"// before: intercepted response parsed as JSON\nDependencyMetadata.parse(new String(bytes, StandardCharsets.UTF_8)); // JsonParseException\n// after: verify the endpoint returns JSON first (shell)\n// curl -fsSL https://example.com/pkl/.../DependencyMetadata.json | jq .","handlingStrategy":"validation","validationCode":"// shell: verify the metadata endpoint serves JSON before running pkl\n// curl -fsSL \"$URL\" | jq -e . >/dev/null && echo ok || echo 'metadata is not valid JSON'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin exact package versions and repository URLs in PklProject files.","Bypass captive-portal proxies for package hosts.","Monitor self-hosted repositories for corrupted uploads."],"tags":["pkl","json","package-management","network"],"backgroundTag":"invalid-json-response","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}