theonedev/onedev · error · ClientException

Package metadata exceeds maximum size:

Error message

Package metadata exceeds maximum size: 

What it means

During npm publish, the package metadata document (the npm publish JSON payload) is read from the request stream up to MAX_UPLOAD_METADATA_LEN bytes. If the metadata exceeds this limit (copyWithMaxSize returns -1), the handler rejects with HTTP 406 Not Acceptable 'Package metadata exceeds maximum size: <limit>'.

Source

Thrown at server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java:350

							try {
								response.getOutputStream().write(writeJson(packageMetadata));
							} catch (IOException e) {
								throw new RuntimeException(e);
							}
							response.setStatus(SC_OK);
						} else {
							response.setStatus(SC_NOT_FOUND);
						}	
					});
				} else if (isPut) {
					sessionService.run(() -> {
						checkProject(projectId, true);
					});
					try (var is = request.getInputStream()) {
						var baos = new ByteArrayOutputStream();
						var copied = copyWithMaxSize(is, baos, MAX_UPLOAD_METADATA_LEN);
						if (copied == -1)
							throw new ClientException(SC_NOT_ACCEPTABLE, "Package metadata exceeds maximum size: " + MAX_UPLOAD_METADATA_LEN);

						var packageMetadata = readJson(baos.toByteArray());

						var distTags = new HashMap<String, String>();
						var distTagsNode = packageMetadata.get("dist-tags");
						if (distTagsNode != null) {
							for (var it = distTagsNode.fields(); it.hasNext(); ) {
								var field = it.next();
								distTags.put(field.getKey(), field.getValue().asText());
							}
						}

						var attachments = new HashMap<String, byte[]>();
						var attachmentsNode = packageMetadata.get("_attachments");
						if (attachmentsNode != null) {
							for (var it = attachmentsNode.fields(); it.hasNext(); ) {
								var field = it.next();
								var fileName = field.getKey();

View on GitHub (pinned to d44925c47c)

Solutions

1. Shrink the package metadata: trim README, description, and unnecessary fields in package.json
2. Publish fewer attachments per request or split versions
3. Raise MAX_UPLOAD_METADATA_LEN in NpmPackHandler if large metadata is legitimate for your usage
4. Check whether the client is accidentally sending the tarball inline in metadata beyond expected attachments

Example fix

// before (package.json)
"description": "<50KB essay>"
// after
"description": "Short summary of the package"

const meta = buildPublishMetadata();
if (Buffer.byteLength(JSON.stringify(meta)) > MAX_UPLOAD_METADATA_LEN) throw new Error('Publish metadata too large; trim README/description or reduce attachments');

try { await publish() } catch (e) { if (e.response?.status === 406 && /metadata exceeds maximum size/i.test(e.message ?? '')) { console.error('Shrink package metadata or raise MAX_UPLOAD_METADATA_LEN'); } else throw e }

When it happens

Trigger: npm publish of a package whose metadata JSON (including READMEs, all versions info on republish, long descriptions) exceeds MAX_UPLOAD_METADATA_LEN.

Common situations: Very large README files; packages with many files each contributing attachment metadata; republish payloads that embed large blobs of prior metadata; unusually long package descriptions.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• Tag body exceeds maximum size:
• Package metadata exceeds maximum size:
• Crate archive exceeds maximum size:
• File length incorrect:
• Package already exists (name: %s, version: %s)

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/98f9c9a439e50393. Report an issue: GitHub.