apple/pkl · error · IllegalStateException

Cannot call both `setSecurityManager` and `setProject`…

Error message

Cannot call both `setSecurityManager` and `setProject`, because both define security manager settings. Call `setProjectOnly` if the security manager is desired.

What it means

Thrown by EvaluatorBuilder.applyFromProject when a custom SecurityManager was already set: the project's resolved evaluator settings may themselves define security settings, and applying them would conflict with the explicitly supplied SecurityManager. The message points to setProjectOnly, which applies project dependencies/settings without touching security configuration.

Solutions

1. Call setProjectOnly instead of applyFromProject to keep the custom SecurityManager.
2. Do not call setSecurityManager when the project's evaluator settings should govern security.

When it happens

Trigger: Thrown at pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java:493 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/89f015d098244d04. Report an issue: GitHub.

Appendix: source

Thrown at pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java:493

    this.powerAssertionsEnabled = powerAssertions;
    return this;
  }

  /** Returns whether power assertions are enabled. */
  public boolean getPowerAssertionsEnabled() {
    return powerAssertionsEnabled;
  }

  /**
   * Given a project, sets its dependencies, and also applies any evaluator settings if set.
   *
   * @throws IllegalStateException if {@link #setSecurityManager(SecurityManager)} was also called.
   */
  public EvaluatorBuilder applyFromProject(Project project) {
    this.dependencies = project.getDependencies();
    var settings = project.getResolvedEvaluatorSettings();
    if (securityManager != null) {
      throw new IllegalStateException(
          "Cannot call both `setSecurityManager` and `setProject`, because both define security manager settings. Call `setProjectOnly` if the security manager is desired.");
    }
    if (settings.allowedModules() != null) {
      setAllowedModules(settings.allowedModules());
    }
    if (settings.allowedResources() != null) {
      setAllowedResources(settings.allowedResources());
    }
    if (settings.externalProperties() != null) {
      setExternalProperties(settings.externalProperties());
    }
    if (settings.env() != null) {
      setEnvironmentVariables(settings.env());
    }
    if (settings.timeout() != null) {
      setTimeout(settings.timeout().toJavaDuration());
    }
    if (settings.modulePath() != null) {

View on GitHub (pinned to f3efcbfc9b)