{"record":{"id":"98f9c9a439e50393","repo":"theonedev/onedev","slug":"package-metadata-exceeds-maximum-size-98f9c9","errorCode":null,"errorMessage":"Package metadata exceeds maximum size: ","messagePattern":"Package metadata exceeds maximum size: ","errorType":"http","errorClass":"ClientException","httpStatus":406,"severity":"error","filePath":"server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java","lineNumber":350,"sourceCode":"\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\tresponse.getOutputStream().write(writeJson(packageMetadata));\n\t\t\t\t\t\t\t} catch (IOException e) {\n\t\t\t\t\t\t\t\tthrow new RuntimeException(e);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tresponse.setStatus(SC_OK);\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tresponse.setStatus(SC_NOT_FOUND);\n\t\t\t\t\t\t}\t\n\t\t\t\t\t});\n\t\t\t\t} else if (isPut) {\n\t\t\t\t\tsessionService.run(() -> {\n\t\t\t\t\t\tcheckProject(projectId, true);\n\t\t\t\t\t});\n\t\t\t\t\ttry (var is = request.getInputStream()) {\n\t\t\t\t\t\tvar baos = new ByteArrayOutputStream();\n\t\t\t\t\t\tvar copied = copyWithMaxSize(is, baos, MAX_UPLOAD_METADATA_LEN);\n\t\t\t\t\t\tif (copied == -1)\n\t\t\t\t\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package metadata exceeds maximum size: \" + MAX_UPLOAD_METADATA_LEN);\n\n\t\t\t\t\t\tvar packageMetadata = readJson(baos.toByteArray());\n\n\t\t\t\t\t\tvar distTags = new HashMap<String, String>();\n\t\t\t\t\t\tvar distTagsNode = packageMetadata.get(\"dist-tags\");\n\t\t\t\t\t\tif (distTagsNode != null) {\n\t\t\t\t\t\t\tfor (var it = distTagsNode.fields(); it.hasNext(); ) {\n\t\t\t\t\t\t\t\tvar field = it.next();\n\t\t\t\t\t\t\t\tdistTags.put(field.getKey(), field.getValue().asText());\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tvar attachments = new HashMap<String, byte[]>();\n\t\t\t\t\t\tvar attachmentsNode = packageMetadata.get(\"_attachments\");\n\t\t\t\t\t\tif (attachmentsNode != null) {\n\t\t\t\t\t\t\tfor (var it = attachmentsNode.fields(); it.hasNext(); ) {\n\t\t\t\t\t\t\t\tvar field = it.next();\n\t\t\t\t\t\t\t\tvar fileName = field.getKey();","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java#L332-L368","documentation":"During npm publish, the package metadata document (the npm publish JSON payload) is read from the request stream up to MAX_UPLOAD_METADATA_LEN bytes. If the metadata exceeds this limit (copyWithMaxSize returns -1), the handler rejects with HTTP 406 Not Acceptable 'Package metadata exceeds maximum size: <limit>'.","triggerScenarios":"npm publish of a package whose metadata JSON (including READMEs, all versions info on republish, long descriptions) exceeds MAX_UPLOAD_METADATA_LEN.","commonSituations":"Very large README files; packages with many files each contributing attachment metadata; republish payloads that embed large blobs of prior metadata; unusually long package descriptions.","solutions":["Shrink the package metadata: trim README, description, and unnecessary fields in package.json","Publish fewer attachments per request or split versions","Raise MAX_UPLOAD_METADATA_LEN in NpmPackHandler if large metadata is legitimate for your usage","Check whether the client is accidentally sending the tarball inline in metadata beyond expected attachments"],"exampleFix":"// before (package.json)\n\"description\": \"<50KB essay>\"\n// after\n\"description\": \"Short summary of the package\"","handlingStrategy":"validation","validationCode":"const meta = buildPublishMetadata();\nif (Buffer.byteLength(JSON.stringify(meta)) > MAX_UPLOAD_METADATA_LEN) throw new Error('Publish metadata too large; trim README/description or reduce attachments');","typeGuard":null,"tryCatchPattern":"try { await publish() } catch (e) { if (e.response?.status === 406 && /metadata exceeds maximum size/i.test(e.message ?? '')) { console.error('Shrink package metadata or raise MAX_UPLOAD_METADATA_LEN'); } else throw e }","preventionTips":["Keep READMEs and descriptions small","Avoid republishing flows that inflate metadata","Monitor metadata size for packages with many attachments"],"tags":["http-406","npm","payload-size","publish"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}