theonedev/onedev · error · ClientException

Package metadata exceeds maximum size:

Error message

Package metadata exceeds maximum size: 

What it means

Thrown by CargoPackHandler.readPublishBody when the metadata section length (read as little-endian int from the publish request body) is negative or exceeds MAX_METADATA_SIZE. The server rejects oversized publish payloads with HTTP 406 before reading them. This guards against unbounded memory use from hostile or malformed cargo publish requests.

Solutions

1. Reduce the metadata size (trim dependencies, features, or description in Cargo.toml)
2. Increase MAX_METADATA_SIZE in CargoPackHandler if large metadata is legitimate for your setup
3. Ensure the cargo client is using the sparse/standard publish protocol compatible with this registry
4. Check for a proxy that is mangling the request body framing

Example fix

// before
[package]
description = "...very long text..."
// after: shorten metadata or raise limit in CargoPackHandler
private static final int MAX_METADATA_SIZE = 1024 * 1024;

const fs = require('fs');
const size = fs.statSync('target/package/<crate>.crate').size;
// metadata is a small JSON section; if publish fails with size error, inspect Cargo.toml bloat
if (process.env.VERBOSE) console.log('crate size:', size);

try { execSync('cargo publish'); } catch (e) { if (/metadata exceeds maximum size/.test(e.message)) { /* trim Cargo.toml metadata */ } }

When it happens

Trigger: Running `cargo publish` against the OneDev registry with a crate whose compressed metadata JSON exceeds MAX_METADATA_SIZE, or a malformed/custom client sending a bogus length prefix.

Common situations: Very large crate manifests with hundreds of dependencies/features; non-cargo scripts posting to the publish endpoint with hand-crafted bodies; misremembered endpoint protocol versions.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• Crate archive exceeds maximum size:
• No package write permission for project
• Package metadata exceeds maximum size:
• File length incorrect:
• Integrity check failed:

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/49a6b1d2092fc675. Report an issue: GitHub.

Appendix: source

Thrown at server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java:318

			dep.put("optional", publishDep.path("optional").asBoolean(false));
			dep.put("default_features", publishDep.path("default_features").asBoolean(true));
			dep.set("target", publishDep.path("target"));
			dep.put("kind", publishDep.path("kind").asText("normal"));
			dep.set("registry", publishDep.path("registry"));
			if (!explicitName.isMissingNode() && !explicitName.isNull())
				dep.put("package", publishDep.path("name").asText());
			else
				dep.putNull("package");
			indexDeps.add(dep);
		}
		return indexDeps;
	}

	private PublishBody readPublishBody(HttpServletRequest request) {
		try (var is = request.getInputStream()) {
			var metadataLength = readIntLE(is);
			if (metadataLength < 0 || metadataLength > MAX_METADATA_SIZE)
				throw new ClientException(SC_NOT_ACCEPTABLE, "Package metadata exceeds maximum size: " + MAX_METADATA_SIZE);
			var metadata = readBytes(is, metadataLength);
			var crateLength = readIntLE(is);
			if (crateLength < 0 || crateLength > MAX_CRATE_SIZE)
				throw new ClientException(SC_NOT_ACCEPTABLE, "Crate archive exceeds maximum size: " + MAX_CRATE_SIZE);
			var crateFile = readBytes(is, crateLength);
			return new PublishBody(metadata, crateFile);
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}

	private int readIntLE(InputStream is) throws IOException {
		var b1 = is.read();
		var b2 = is.read();
		var b3 = is.read();
		var b4 = is.read();
		if ((b1 | b2 | b3 | b4) < 0)
			throw new EOFException();

View on GitHub (pinned to d44925c47c)