{"record":{"id":"90e2bddb467788d7","repo":"golang/go","slug":"downloaded-zip-file-too-large","errorCode":null,"errorMessage":"downloaded zip file too large","messagePattern":"downloaded zip file too large","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/modfetch/coderepo.go","lineNumber":1124,"sourceCode":"\tsubdir = strings.Trim(subdir, \"/\")\n\n\t// Spool to local file.\n\tf, err := os.CreateTemp(\"\", \"go-codehost-\")\n\tif err != nil {\n\t\tdl.Close()\n\t\treturn err\n\t}\n\tdefer os.Remove(f.Name())\n\tdefer f.Close()\n\tmaxSize := int64(codehost.MaxZipFile)\n\tlr := &io.LimitedReader{R: dl, N: maxSize + 1}\n\tif _, err := io.Copy(f, lr); err != nil {\n\t\tdl.Close()\n\t\treturn err\n\t}\n\tdl.Close()\n\tif lr.N <= 0 {\n\t\treturn fmt.Errorf(\"downloaded zip file too large\")\n\t}\n\tsize := (maxSize + 1) - lr.N\n\tif _, err := f.Seek(0, 0); err != nil {\n\t\treturn err\n\t}\n\n\t// Translate from zip file we have to zip file we want.\n\tzr, err := zip.NewReader(f, size)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar files []modzip.File\n\tif subdir != \"\" {\n\t\tsubdir += \"/\"\n\t}\n\thaveLICENSE := false\n\ttopPrefix := \"\"","sourceCodeStart":1106,"sourceCodeEnd":1142,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/coderepo.go#L1106-L1142","documentation":"codeRepo.Zip streams the downloaded archive through an io.LimitedReader capped at MaxZipFile (500 MiB, defined in codehost.go). If lr.N drops to zero the source produced more than the cap and the transfer is aborted as too large. The limit is a hard cap meant to prevent a malicious or accidental oversized module from exhausting disk.","triggerScenarios":"A module archive over 500 MiB streamed from the origin or proxy. The download completes against the LimitedReader but N reaches zero, so the guard fires before any unzip.","commonSituations":"Repositories that vendor large binaries, datasets, media, or node_modules; archives with vendored test fixtures; a fork that accidentally committed build artifacts.","solutions":["Reduce module size upstream: remove vendored binaries, .git history is irrelevant but committed blobs matter; split into a separate module or use //go:build constraints to exclude heavy files.","Switch to a lighter dependency or a version predating the bloat.","If you must host large assets, keep them out of the Go module tree (e.g. an assets submodule the Go module does not import)."],"exampleFix":"// upstream: remove oversized committed file\n//   git rm -r --cached vendor/assets\n//   echo /vendor/assets >> .gitignore\n// commit and tag a new release, then `go get` the new tag","handlingStrategy":"validation","validationCode":"// Check archive size against the same cap the go command enforces before\n// hosting/publishing a module.\nconst maxZipFile = int64(500) << 20 // codehost.MaxZipFile\nfunc zipSizeOK(p string) (bool, error) {\n    fi, err := os.Stat(p)\n    if err != nil { return false, err }\n    return fi.Size() <= maxZipFile, nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run `go mod download` in CI on a clean modcache to surface oversized modules before release.","Keep binaries, datasets, and media out of directories covered by the module.","Add a pre-commit check rejecting files above a size threshold in module paths."],"tags":["zip","size-limit","download","maxzipfile"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}