{"record":{"id":"6e25ce040860b50a","repo":"oven-sh/bun","slug":"invalidadvisoryformat","errorCode":null,"errorMessage":"InvalidAdvisoryFormat","messagePattern":"InvalidAdvisoryFormat","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":127,"sourceCode":"    #[error(\"SecurityScannerNotFound\")]\n    SecurityScannerNotFound,\n    #[error(\"SecurityScannerNotInDependencies\")]\n    SecurityScannerNotInDependencies,\n    #[error(\"InvalidScannerVersion\")]\n    InvalidScannerVersion,\n    #[error(\"ScannerFailed\")]\n    ScannerFailed,\n    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L109-L145","documentation":"The `advisories` array parsed, but one of its elements is not a JSON object (security_scanner.rs:1818-1823). Each advisory must be an object with at minimum `package` and `level` fields; the offending index and received type are printed.","triggerScenarios":"An advisory entry is a bare string (\"lodash@4.17.19\"), a nested array, or a number — anything other than an object at the reported index.","commonSituations":"Shorthand encodings in custom scanners; mixed-format output after refactoring; accidentally wrapping/omitting a level of nesting (e.g. spreading an array of entries).","solutions":["Wrap every entry as an object: {\"package\":\"lodash\",\"level\":\"warn\",...}","Check the printed index to find which entry is malformed in your scanner's output","Map string shorthand to objects before sending over IPC"],"exampleFix":"// before\nadvisories: [\"lodash@4.17.19\"]\n\n// after\nadvisories: [{ package: \"lodash\", level: \"warn\", description: \"prototype pollution\", url: \"https://...\" }]","handlingStrategy":"type-guard","validationCode":"// scanner-side: drop/fix non-object entries before sending\nconst advisories = raw.filter((a) => a != null && typeof a === \"object\" && !Array.isArray(a));","typeGuard":"const isAdvisoryEntry = (a) => typeof a === \"object\" && a !== null && !Array.isArray(a);","tryCatchPattern":null,"preventionTips":["Represent every advisory as an object literal from one constructor function","Watch the printed index when debugging — it points at the exact bad entry","Avoid mixed-type arrays from loosely-typed data pipelines"],"tags":["security-scanner","json","schema","advisories"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}