{"record":{"id":"6c6638241011cc89","repo":"oven-sh/bun","slug":"missingadvisoriesfield","errorCode":null,"errorMessage":"MissingAdvisoriesField","messagePattern":"MissingAdvisoriesField","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":119,"sourceCode":"    #[error(\"InvalidIPCType\")]\n    InvalidIPCType,\n    #[error(\"MissingErrorCode\")]\n    MissingErrorCode,\n    #[error(\"InvalidErrorCode\")]\n    InvalidErrorCode,\n    #[error(\"UnknownErrorCode\")]\n    UnknownErrorCode,\n    #[error(\"SecurityScannerNotFound\")]\n    SecurityScannerNotFound,\n    #[error(\"SecurityScannerNotInDependencies\")]\n    SecurityScannerNotInDependencies,\n    #[error(\"InvalidScannerVersion\")]\n    InvalidScannerVersion,\n    #[error(\"ScannerFailed\")]\n    ScannerFailed,\n    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L101-L137","documentation":"The scanner sent a well-formed \"result\" IPC message, but the JSON object lacks the required `advisories` field (security_scanner.rs:1754-1756). An empty scan must still include \"advisories\": [] — omitting the key entirely is a protocol violation.","triggerScenarios":"A custom scanner returns {\"type\":\"result\"} with no advisories key, or names it differently (\"findings\", \"vulnerabilities\", \"issues\") instead of the required \"advisories\".","commonSituations":"First-time implementation of a custom scanner guessing field names; scanner that conditionally omits the field when no vulnerabilities were found; protocol drift between scanner versions.","solutions":["Always include the key, even when clean: {\"type\":\"result\",\"advisories\":[]}","Rename any 'findings'/'vulnerabilities'/'issues' field to exactly \"advisories\"","Validate your scanner's output against the expected schema before writing it to the IPC pipe"],"exampleFix":"// before\nsend({ type: \"result\", findings: [] });\n\n// after\nsend({ type: \"result\", advisories: [] });","handlingStrategy":"validation","validationCode":"// scanner-side: always emit the advisories key\nconst payload = { type: \"result\", advisories: collectAdvisories() ?? [] };\nif (!(\"advisories\" in payload)) throw new Error(\"result message missing advisories\");","typeGuard":"const isResultMessage = (m) => m?.type === \"result\" && Array.isArray(m.advisories);","tryCatchPattern":null,"preventionTips":["Build result messages from one factory function that always sets advisories","Use the exact field name \"advisories\" — not findings/vulnerabilities/issues","Test the empty-scan path explicitly (it must still send advisories: [])"],"tags":["security-scanner","ipc","schema","json"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}