{"record":{"id":"3e83b92f3f78f6d6","repo":"oven-sh/bun","slug":"invalid-version","errorCode":"INVALID_VERSION","errorMessage":"Security scanner must be version 1, got version ${scanner.version}","messagePattern":"Security scanner must be version 1, got version (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/install/PackageManager/scanner-entry.ts","lineNumber":94,"sourceCode":"    });\n  } else {\n    sendAndExit({\n      type: \"error\",\n      code: \"SCAN_FAILED\",\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n}\n\ntry {\n  if (typeof scanner !== \"object\" || scanner === null || typeof scanner.version !== \"string\") {\n    throw new Error(\"Security scanner must export a 'scanner' object with a version property\");\n  }\n\n  if (scanner.version !== \"1\") {\n    sendAndExit({\n      type: \"error\",\n      code: \"INVALID_VERSION\",\n      message: `Security scanner must be version 1, got version ${scanner.version}`,\n    });\n  }\n\n  if (typeof scanner.scan !== \"function\") {\n    throw new Error(`scanner.scan is not a function, got ${typeof scanner.scan}`);\n  }\n\n  const result = await scanner.scan({ packages });\n\n  if (!Array.isArray(result)) {\n    throw new Error(\"Security scanner must return an array of advisories\");\n  }\n\n  sendAndExit({ type: \"result\", advisories: result });\n} catch (error) {\n  if (!suppressError) {\n    console.error(error);","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/PackageManager/scanner-entry.ts#L76-L112","documentation":"The subprocess checks `scanner.version !== \"1\"` and reports {type:\"error\", code:\"INVALID_VERSION\"}. The only supported scanner protocol version is exactly the string \"1\"; any other value is rejected before scan() is called.","triggerScenarios":"scanner.version is \"2\", \"1.0\", \"0.9\", or \"\" — anything but exactly \"1\". Typically a scanner built against a different protocol revision than the installed Bun supports.","commonSituations":"Scanner major release bumps its protocol version while installed Bun still speaks v1; formatting drift (\"1.0\" vs \"1\"); in-house scanner copied from a v2 template.","solutions":["Pin the scanner package release that declares version: \"1\"","If you own the scanner, set version to the exact string \"1\"","Upgrade Bun to a version whose scanner protocol matches your scanner's major","Check Bun's release notes for scanner protocol changes before upgrading the scanner"],"exampleFix":"// before\nexport const scanner = { version: \"1.0\", scan };\n\n// after\nexport const scanner = { version: \"1\", scan };","handlingStrategy":"validation","validationCode":"const { scanner } = await import(\"@corp/scanner\");\nif (scanner.version !== \"1\") {\n  throw new Error(`Unsupported scanner protocol ${scanner.version}; expected \\\"1\\\"`);\n}","typeGuard":"function isProtocolV1(s: { version: string }): boolean {\n  return s.version === \"1\";\n}","tryCatchPattern":null,"preventionTips":["Treat scanner protocol bumps as breaking changes in scanner majors","Assert scanner.version === \\\"1\\\" in the scanner's own tests","Check Bun release notes before upgrading the scanner package"],"tags":["security-scanner","version","contract"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}