Skip to content

Fix manifest description length validation - #775

Merged
f-f merged 2 commits into
masterfrom
fix-manifest-description-length
Jul 21, 2026
Merged

f-f merged 2 commits into
masterfrom
fix-manifest-description-length

Conversation

@thomashoneyman

Copy link
Copy Markdown
Member

Fixes #773. Manifest descriptions were limited to 300 characters when decoding, but manifests created from spago.yaml used the description string directly without validating its length. This allowed the registry to publish a manifest that it could write to the registry index but package managers could not decode, making the affected package unavailable to consumers.

This PR raises the description limit to 500 characters and introduces a LimitedString type that tracks its maximum length at the type level. Manifest descriptions now use LimitedString 500 and are validated when converting from spago.yaml or legacy manifests, so an invalid description cannot be written to the index. The existing 300-character unpublish reasons use the same type, replacing the previous decode-only limited string codec.

@thomashoneyman
thomashoneyman force-pushed the fix-manifest-description-length branch from 6282356 to 46e2e57 Compare July 21, 2026 18:47
Amp-Thread-ID: https://ampcode.com/threads/T-019f858d-0126-741b-935c-b8ea04533d17

Co-authored-by: Thomas Honeyman <admin@thomashoneyman.com>
@thomashoneyman
thomashoneyman requested a review from f-f July 21, 2026 19:29
@afcondon

Copy link
Copy Markdown

Happy to have enabled you to strengthen Registry and sad to have made extra work for you!

thanks!

@f-f f-f left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The type-level limit is brilliant. Good stuff 🙂

@f-f
f-f merged commit ae82f2e into master Jul 21, 2026
16 checks passed
@f-f
f-f deleted the fix-manifest-description-length branch July 21, 2026 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

spago publish accepts a manifest whose description exceeds the registry 300-char limit, producing an index entry spago build can't decode

3 participants