theonedev/onedev · error · ClientException

Package metadata exceeds maximum size:

Error message

Package metadata exceeds maximum size: 

What it means

Thrown by CargoPackHandler.readPublishBody when the metadata section length (read as little-endian int from the publish request body) is negative or exceeds MAX_METADATA_SIZE. The server rejects oversized publish payloads with HTTP 406 before reading them. This guards against unbounded memory use from hostile or malformed cargo publish requests.

Source

Thrown at server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java:318

			dep.put("optional", publishDep.path("optional").asBoolean(false));
			dep.put("default_features", publishDep.path("default_features").asBoolean(true));
			dep.set("target", publishDep.path("target"));
			dep.put("kind", publishDep.path("kind").asText("normal"));
			dep.set("registry", publishDep.path("registry"));
			if (!explicitName.isMissingNode() && !explicitName.isNull())
				dep.put("package", publishDep.path("name").asText());
			else
				dep.putNull("package");
			indexDeps.add(dep);
		}
		return indexDeps;
	}

	private PublishBody readPublishBody(HttpServletRequest request) {
		try (var is = request.getInputStream()) {
			var metadataLength = readIntLE(is);
			if (metadataLength < 0 || metadataLength > MAX_METADATA_SIZE)
				throw new ClientException(SC_NOT_ACCEPTABLE, "Package metadata exceeds maximum size: " + MAX_METADATA_SIZE);
			var metadata = readBytes(is, metadataLength);
			var crateLength = readIntLE(is);
			if (crateLength < 0 || crateLength > MAX_CRATE_SIZE)
				throw new ClientException(SC_NOT_ACCEPTABLE, "Crate archive exceeds maximum size: " + MAX_CRATE_SIZE);
			var crateFile = readBytes(is, crateLength);
			return new PublishBody(metadata, crateFile);
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}

	private int readIntLE(InputStream is) throws IOException {
		var b1 = is.read();
		var b2 = is.read();
		var b3 = is.read();
		var b4 = is.read();
		if ((b1 | b2 | b3 | b4) < 0)
			throw new EOFException();

View on GitHub (pinned to d44925c47c)

Solutions

1. Reduce the metadata size (trim dependencies, features, or description in Cargo.toml)
2. Increase MAX_METADATA_SIZE in CargoPackHandler if large metadata is legitimate for your setup
3. Ensure the cargo client is using the sparse/standard publish protocol compatible with this registry
4. Check for a proxy that is mangling the request body framing

Example fix

// before
[package]
description = "...very long text..."
// after: shorten metadata or raise limit in CargoPackHandler
private static final int MAX_METADATA_SIZE = 1024 * 1024;

const fs = require('fs');
const size = fs.statSync('target/package/<crate>.crate').size;
// metadata is a small JSON section; if publish fails with size error, inspect Cargo.toml bloat
if (process.env.VERBOSE) console.log('crate size:', size);

try { execSync('cargo publish'); } catch (e) { if (/metadata exceeds maximum size/.test(e.message)) { /* trim Cargo.toml metadata */ } }

When it happens

Trigger: Running `cargo publish` against the OneDev registry with a crate whose compressed metadata JSON exceeds MAX_METADATA_SIZE, or a malformed/custom client sending a bogus length prefix.

Common situations: Very large crate manifests with hundreds of dependencies/features; non-cargo scripts posting to the publish endpoint with hand-crafted bodies; misremembered endpoint protocol versions.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• Crate archive exceeds maximum size:
• No package write permission for project: ${projectPath}
• Package metadata exceeds maximum size:
• Page should be no more than {MAX_PAGES}
• Method Not Allowed

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/49a6b1d2092fc675. Report an issue: GitHub.