compozy update fails on every direct-binary install: release binary (135,516,530 B) exceeds the updater's hardcoded 128 MiB extraction cap #359

Summary

compozy update cannot install v0.3.0-beta.13 on a direct-binary install. The release binary has outgrown the updater's own extraction cap, so extraction aborts and the update fails permanently — every retry hits the same wall. The only way forward is a manual reinstall from the release assets.

Status:            failed
Install Method:    direct-binary
Managed:           false
Current Version:   0.3.0-beta.8
Latest Version:    v0.3.0-beta.13
Message:           update: extract binary "/var/folders/.../compozy-update-97774347/compozy":
                   archive entry size 135516530 exceeds the allowed limit of 134217728 bytes
Recommendation:    Run `compozy update`.

Note the recommendation is Run \compozy update``, which is exactly the command that just failed.

Root cause

copyArchiveEntry rejects any tar entry larger than a hardcoded 128 MiB (internal/update/manager_archive.go:155):

if size > maxExtractedBinaryBytes {
    return fmt.Errorf("archive entry size %d exceeds the allowed limit of %d bytes", size, maxExtractedBinaryBytes)
}

with the cap defined in internal/update/types.go:48:

maxExtractedBinaryBytes = int64(128 << 20)  // 134217728

The shipped binary is now larger than that cap:

The guard is a static decompression-bomb limit that the project's own release artifact has crossed. It is not a corrupt download or a user-environment problem — the tarball checksum matches checksums.txt, and extracting it with tar produces a working binary.

Verified

Locally, on macOS 15 / arm64, upgrading from 0.3.0-beta.8:

1. compozy update → fails with the message above.
2. Downloaded compozy_darwin_arm64.tar.gz from the v0.3.0-beta.13 release; SHA-256 a01517b7f3f179ba791a80be27008f3a81e249949afba0126f271249ff37f083 matches checksums.txt.
3. tar tzvf / tar xzf → the compozy entry is 135,516,530 bytes, exactly the size in the error.
4. Installed it manually over /opt/homebrew/bin/compozy → compozy version reports 0.3.0-beta.13 and compozy update now reports current.

So the artifact is fine; only the updater's own limit rejects it.

Impact

• Every direct-binary install is stuck on its current version and cannot self-update to beta.13. The failure is deterministic, not transient.
• The remediation text tells users to re-run the command that just failed, giving no path out.
• This is not specific to darwin/arm64: the per-platform tarballs are all in the same compressed size range (49–52 MB), so the uncompressed binaries are presumably all around or above the cap on every platform.
• Since the binary only grows, this will keep breaking future releases until the cap changes.

One related data point: maxArchiveDownloadBytes is also 128 << 20 (internal/update/types.go:45). The tarballs are ~49–52 MB today, so it is not tripping, but it is a static ceiling of the same size on the same growth curve.

Workaround for anyone hitting this

gh release download v0.3.0-beta.13 -R compozy/compozy -p 'compozy_darwin_arm64.tar.gz'
tar xzf compozy_darwin_arm64.tar.gz
install -m 755 compozy "$(dirname "$(which compozy)")/compozy"
xattr -d com.apple.quarantine "$(which compozy)" 2>/dev/null

(swap the asset name for your platform)