snyk code test: "failed to upload files: request entity too large" on a monorepo

Fix snyk code "request entity too large" on a monorepo

TL;DR

snyk code uploads your source for analysis, and monorepos blow past the upload size limit. Exclude the directories that do not need scanning (build output, vendored code, generated files) so the upload fits. If it still fails, scan one package at a time instead of the whole repo.

snyk code test: "failed to upload files: request entity too large" on a monorepo

Steps

1. Measure what is actually being uploaded so you exclude the right things.

   • Run: du -sh --exclude=.git . && du -sh node_modules vendor dist build 2>/dev/null
   • Expected: you see which directories dominate the size (usually node_modules, vendor, or build output).

2. Re-run the scan with the heavy, unscannable directories excluded.

   • Run: snyk code test --exclude=node_modules,vendor,dist,build,.git
   • Expected: the upload succeeds and snyk code prints findings for your source files.

3. If it still fails, split the monorepo into per-package scans.

   • Run: for p in packages/*; do echo "Scanning $p"; (cd "$p" && snyk code test); done
   • Expected: each package uploads and scans independently, all within the size limit.

4. Make the excludes permanent so CI does not regress.

   • Run: add the exclude list to your snyk policy file or the CI step's arguments, then re-run the pipeline
   • Expected: the CI scan passes with the same excludes on every run.

Use this when

• snyk code test fails with "failed to upload files: request entity too large"
• The repo is a monorepo with large vendored or generated directories
• An agent runs snyk code at the repo root and it fails where per-package scans worked

Not for this skill when

• snyk fails with an auth error (fix the login instead)
• snyk code passes but reports no findings on code you know is vulnerable (check the scanned paths)
• The failure is on snyk test (dependency scan), not snyk code (different upload path)

Variant phrasings

• snyk code test entity too large monorepo
• snyk code failed to upload files
• snyk code scan too big to upload

Why it happens

snyk code analysis happens server-side: the CLI bundles the files in scope and uploads the bundle. There is a hard cap on that upload size. Monorepos include huge directories that add nothing to a code scan (dependencies, build artifacts, generated code), and without excludes the bundle exceeds the cap before any analysis starts.

Edge cases

• Excluding too aggressively can hide real findings: keep first-party source in scope and only exclude third-party, generated, and build output.
• Symlinked workspace packages can inflate the bundle: exclude the link targets or scan the real directories directly.
• The limit can also bite on repos with large binary assets: add binary asset directories to the exclude list.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bgJsIj1iB1NYydGh-6xUTg