{"record":{"id":"d3ba5083f61fa319","repo":"apple/pkl","slug":"object-d3ba50","errorCode":null,"errorMessage":"object","messagePattern":"object","errorType":"validation","errorClass":"FormatException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/packages/DependencyMetadata.java","lineNumber":146,"sourceCode":"        version,\n        packageZipUrl,\n        packageZipChecksums,\n        dependencies,\n        sourceCodeUrlScheme,\n        sourceCode,\n        documentation,\n        license,\n        licenseText,\n        authors,\n        issueTracker,\n        description,\n        annotations);\n  }\n\n  private static Map<String, RemoteDependency> parseDependencies(Object deps)\n      throws JsonParseException {\n    if (!(deps instanceof JsObject dependencies)) {\n      throw new FormatException(\"object\", deps.getClass());\n    }\n    var ret = new HashMap<String, RemoteDependency>(dependencies.size());\n    for (var key : dependencies.keySet()) {\n      var remoteDependency =\n          dependencies.get(\n              key,\n              (dep) -> {\n                if (!(dep instanceof JsObject obj)) {\n                  throw new FormatException(\"object\", dep.getClass());\n                }\n                var checksums = obj.get(\"checksums\", DependencyMetadata::parseChecksums);\n                var packageUri = obj.get(\"uri\", PackageUtils::parsePackageUriWithoutChecksums);\n                return new RemoteDependency(packageUri, checksums);\n              });\n      ret.put(key, remoteDependency);\n    }\n    return ret;\n  }","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/packages/DependencyMetadata.java#L128-L164","documentation":"DependencyMetadata.parseDependencies throws FormatException(\"object\", deps.getClass()) when the top-level `dependencies` value inside a package's dependency metadata JSON is not a JSON object. The parser expects an object mapping package names to RemoteDependency objects; receiving an array, string, number, or null makes the metadata unusable. This indicates a malformed dependency-metadata file.","triggerScenarios":"Parsing package metadata (e.g. from a package tarball's .pkl/metadata or registry response) where the `dependencies` field is an array/string instead of an object — typically from a hand-written or tool-misgenerated metadata file.","commonSituations":"Publishing a package with metadata generated by a custom script writing `dependencies` as a list; manually editing metadata JSON and changing the shape; registry serving an unexpected schema version.","solutions":["Make `dependencies` a JSON object keyed by package name, e.g. {\"foo\": {\"uri\": ..., \"checksums\": ...}}.","Regenerate the package metadata with `pkl project package` rather than hand-crafting it.","Check the schema version of the metadata and upgrade the tooling that produced it.","Re-download/re-publish the package if the metadata came from a corrupted artifact."],"exampleFix":"// before (metadata JSON)\n{\"dependencies\": [\"foo\", \"bar\"]}\n// after\n{\"dependencies\": {\"foo\": {\"uri\": \"package://example.com/foo@1.0.0\", \"checksums\": {}}}}","handlingStrategy":"validation","validationCode":"// Pre-validate package metadata JSON shape\nvar root = new com.fasterxml.jackson.databind.ObjectMapper().readTree(metadataJson);\nif (root.has(\"dependencies\") && !root.get(\"dependencies\").isObject())\n  throw new IllegalStateException(\"metadata 'dependencies' must be a JSON object\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate package metadata with `pkl project package`, never by hand.","Validate metadata JSON against the expected schema before publishing.","Keep metadata-producing tooling in sync with the Pkl version's schema.","Round-trip test published artifacts by re-parsing their metadata."],"tags":["json","package-metadata","schema","pkl"],"backgroundTag":"schema-validation-failed","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}