{"record":{"id":"3386a26ba3c89fbc","repo":"oven-sh/bun","slug":"securityscannerfailed","errorCode":null,"errorMessage":"SecurityScannerFailed","messagePattern":"SecurityScannerFailed","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":121,"sourceCode":"    #[error(\"MissingErrorCode\")]\n    MissingErrorCode,\n    #[error(\"InvalidErrorCode\")]\n    InvalidErrorCode,\n    #[error(\"UnknownErrorCode\")]\n    UnknownErrorCode,\n    #[error(\"SecurityScannerNotFound\")]\n    SecurityScannerNotFound,\n    #[error(\"SecurityScannerNotInDependencies\")]\n    SecurityScannerNotInDependencies,\n    #[error(\"InvalidScannerVersion\")]\n    InvalidScannerVersion,\n    #[error(\"ScannerFailed\")]\n    ScannerFailed,\n    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L103-L139","documentation":"The scanner produced a parseable result message, but its process then exited with a non-zero exit code (or an unrecognized failure status) — Bun requires the scanner process to exit 0 after reporting results (security_scanner.rs:1762-1780). Results from a failed process are not trusted.","triggerScenarios":"Scanner writes the result JSON to IPC but afterwards crashes, throws an unhandled exception, or calls process.exit(1) — e.g. a bug in shutdown/finalization code, or exiting non-zero to signal 'vulnerabilities found' instead of using advisory levels.","commonSituations":"Scanner authors using exit code 1 to mean 'issues detected' (the protocol expects level:\"fatal\" advisories instead); async work (flush, upload) failing after the result is written; unhandled promise rejection during teardown.","solutions":["Make the scanner exit with code 0 whenever it successfully reports results — express severity via advisory levels, not exit codes","Await/flush all writes before exiting; catch teardown errors and still exit 0","Look at stderr from the scanner process for the post-result crash and fix it"],"exampleFix":"// before (scanner)\nsend({ type: \"result\", advisories });\nprocess.exit(advisories.length > 0 ? 1 : 0); // wrong signal\n\n// after\nsend({ type: \"result\", advisories }); // fatal advisories carry severity\nprocess.exit(0);","handlingStrategy":"validation","validationCode":"// scanner-side: guarantee exit 0 after a successful send\nconst ok = send({ type: \"result\", advisories });\nprocess.on(\"uncaughtException\", (e) => { console.error(e); process.exit(0); }); // reported already\nprocess.exitCode = 0;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use advisory level \"fatal\" to fail the build — never a non-zero scanner exit after results","Register unhandledRejection/uncaughtException handlers that still allow a clean exit","Flush stdout (await a drain promise) before the process ends"],"tags":["security-scanner","exit-code","process-lifecycle","install"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}