halo-dev/halo · info · Error

Cannot resolve shared dependency ${root} from ${resolutionBa

Error message

Cannot resolve shared dependency ${root} from ${resolutionBase}.

What it means

TokenBasedRememberMeServices.processAutoLoginCookie throws Spring Security's InvalidCookieException when the remember-me cookie does not split into exactly 3 or 4 tokens. handleError catches it, logs at debug, cancels the cookie, and returns Mono.empty() — the user is simply not auto-logged-in and must re-authenticate.

Source

Thrown at ui/packages/ui-plugin-bundler-kit/src/runtime-snapshot.ts:126

      snapshot.haloVersion !==
      `${target.major}.${target.minor}.${target.patch}`,
  };
}

export async function resolveSharedPackage(
  root: SharedPackageRoot,
  providerRoot: string,
  sourceId?: string
) {
  const resolutionBase = getPackageResolutionBase(providerRoot, sourceId);
  let packageJsonPath: string;
  try {
    packageJsonPath = await resolvePackageJSON(root, {
      from: resolutionBase,
      conditions: ["browser", "import", "default"],
    });
  } catch (error) {
    throw new Error(
      `Cannot resolve shared dependency ${root} from ${resolutionBase}.`,
      { cause: error }
    );
  }
  const packageRoot = fs.realpathSync(path.dirname(packageJsonPath));
  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")) as {
    name?: string;
    version?: string;
  };

  if (packageJson.name !== root || !packageJson.version) {
    throw new Error(
      `Shared dependency ${root} resolved to ${packageJson.name || "an unnamed package"} at ${packageRoot}.`
    );
  }

  return {
    name: packageJson.name,

View on GitHub (pinned to d2f5165f9c)

Solutions

1. Have the user log in again — the invalid cookie is expired automatically and a fresh one is issued.
2. Keep the halo.security.remember-me.key stable across restarts/versions so existing cookies keep their token shape.
3. Avoid proxies/load balancers truncating long cookie values.
4. Do not hand-edit the remember-me cookie.

// You normally do not call this directly; framework handles it. To pre-check a cookie:
String[] tokens = cookie.getValue().split(":");
if (tokens.length != 3 && tokens.length != 4) {
    // expire the cookie and force a fresh login instead of submitting it
}

// Framework already wraps processAutoLoginCookie in handleError -> cancelCookie.
// In custom code, treat InvalidCookieException as 'silent re-login', not a hard error:
.autoLogin(exchange)
    .onErrorResume(InvalidCookieException.class, e -> {
        rememberMeCookieResolver.expireCookie(exchange);
        return Mono.empty();
    })

When it happens

Trigger: A browser sends a remember-me cookie whose value, split on the delimiter, yields a count other than 3 or 4 (corrupted, truncated, manually edited, or from an incompatible auth scheme version).

Common situations: Cookie truncated by proxy/CDN; manually edited cookie; switching remember-me key/algorithm between versions so old cookies no longer parse; cookie from a different application sharing the domain.

Related errors

• Shared dependency ${root} resolved to ${packageJson.name ||
• Cookie contained signature '{}' but expected '{}'
• Cookie token[1] did not contain a valid number (contained '{
• Cookie token was not Base64 encoded; value was '{}'
• ESM UI provider output must expose a default PluginModule ex

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/7605f56db978a5fe. Report an issue: GitHub.