It was recommended by sfdx to move from sfdx force:mdapi:deploy -d mdapi/ -u ... to sfdx project:deploy:start -d mdapi/ -o ..., however, I'm getting errors like:

An object 'https_force_com' of type CorsWhitelistOrigin was named in package.xml, but was not found in zipped directory

This is due to both the new sfdx project:convert:source -d mdapi/ and the old deprecated sfdx force:source:convert -d mdapi/ commands convert source CORS without -meta.xml in the end of file names.

While with the old deprecated command sfdx force:mdapi:deploy -d mdapi/ -u ... I'm able to deploy such files to the destination org, with the new one sfdx project:deploy:start -d mdapi/ -o ... it is not possible.

It's worth mentioning, that my original CORS files DO HAVE -meta.xml in their names.

The question is: am I missing some flags in convert commands for the new deploy command to execute properly? Or is this a bug and I should log it with salesforce support?

2 Answers 2


It sounds like a bug. I would recommend logging a bug on github, as that is the official channel for submitting these kinds of issues. In the interim, I suggest simply using project retrieve start from an org with options like -m CorsWhitelistOrigin, rather than trying to convert the metadata.


I haven't posted the bug report, but I have resolved the issue by:

  • updating the node version from 16 to 18,
  • running only sf project deploy start from the root directory of the project without converting it to mdapi format.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .