{"record":{"id":"740ddd38437f9e96","repo":"oven-sh/bun","slug":"invalidlevelvalue","errorCode":null,"errorMessage":"InvalidLevelValue","messagePattern":"InvalidLevelValue","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":143,"sourceCode":"    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]\n    MissingGlobalBinDirectoryTrySettingBUNINSTALL,\n    #[error(\"InvalidURL\")]\n    InvalidURL,\n    #[error(\"Fail\")]\n    Fail,\n    #[error(\"IntegrityCheckFailed\")]\n    IntegrityCheckFailed,\n    #[error(\"RepositoryNotFound\")]\n    RepositoryNotFound,\n    #[error(\"DebugTextLockfileRoundTrip\")]\n    DebugTextLockfileRoundTrip,\n    #[error(\"NoPackage\")]\n    NoPackage,\n    #[error(\"BrokenPipe\")]\n    BrokenPipe,\n    #[error(\"WriteFailed\")]","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L125-L161","documentation":"The advisory's `level` string is neither \"fatal\" nor \"warn\" (security_scanner.rs:1899-1908). These two exact lowercase values are the whole vocabulary; anything else — \"error\", \"high\", \"info\", \"FATAL\" — is rejected, with the received value printed.","triggerScenarios":"Scanner maps severities to npm-style names (\"low\"/\"moderate\"/\"critical\"), uses uppercase (\"Fatal\"), or sends \"error\"/\"info\" — none of which match the case-sensitive comparison.","commonSituations":"Adapters for npm audit / OSV / GitHub advisory feeds passing severity names through unchanged; casing inconsistencies; intermediate severity buckets that need collapsing.","solutions":["Emit exactly \"fatal\" or \"warn\" (lowercase, case-sensitive)","Collapse richer scales: critical/high → \"fatal\"; everything else → \"warn\"","Print/assert your level values in scanner tests to catch casing drift"],"exampleFix":"// before\nadvisories: [{ package: \"foo\", level: \"high\" }]\n\n// after\nadvisories: [{ package: \"foo\", level: \"fatal\" }]","handlingStrategy":"validation","validationCode":"// scanner-side: collapse any severity vocabulary to the two allowed values\nconst toLevel = (s) => (String(s).toLowerCase() === \"critical\" || String(s).toLowerCase() === \"high\" ? \"fatal\" : \"warn\");\nfor (const a of advisories) a.level = toLevel(a.level);","typeGuard":"const isValidLevelValue = (l) => l === \"fatal\" || l === \"warn\";","tryCatchPattern":null,"preventionTips":["Only two lowercase values are valid: \"fatal\" and \"warn\" — match them exactly","Map external severity scales (low/moderate/high/critical) through one function","Add a unit test asserting every emitted level is in the allowed set"],"tags":["security-scanner","json","schema","severity"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}