{"record":{"id":"7b1527bda19df2eb","repo":"oven-sh/bun","slug":"invalidlevelfield","errorCode":null,"errorMessage":"InvalidLevelField","messagePattern":"InvalidLevelField","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":141,"sourceCode":"    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]\n    MissingGlobalBinDirectoryTrySettingBUNINSTALL,\n    #[error(\"InvalidURL\")]\n    InvalidURL,\n    #[error(\"Fail\")]\n    Fail,\n    #[error(\"IntegrityCheckFailed\")]\n    IntegrityCheckFailed,\n    #[error(\"RepositoryNotFound\")]\n    RepositoryNotFound,\n    #[error(\"DebugTextLockfileRoundTrip\")]\n    DebugTextLockfileRoundTrip,\n    #[error(\"NoPackage\")]\n    NoPackage,\n    #[error(\"BrokenPipe\")]","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L123-L159","documentation":"The advisory's `level` field exists but is not a string (security_scanner.rs:1892-1897) — typically a number (1-3 severity scale) or an object. The parser requires a string so it can compare against \"fatal\"/\"warn\"; the failing index is printed.","triggerScenarios":"Scanner sends \"level\": 2, \"level\": {\"value\":\"high\"}, or a boolean in the level slot.","commonSituations":"Internal severity enums represented as integers; structured severity objects from upstream vulnerability feeds serialized as-is.","solutions":["Convert numeric/enum severities to the strings \"fatal\" or \"warn\" before serialization","Flatten structured severity to one of the two accepted strings","Centralize the mapping in one function so all advisories classify consistently"],"exampleFix":"// before\nadvisories: [{ package: \"foo\", level: 2 }]\n\n// after\nadvisories: [{ package: \"foo\", level: \"fatal\" }]","handlingStrategy":"type-guard","validationCode":"// scanner-side: stringify/normalize numeric severity enums before sending\nfor (const a of advisories) if (typeof a.level !== \"string\") a.level = a.level >= 2 ? \"fatal\" : \"warn\";","typeGuard":"const isLevelString = (a) => typeof a?.level === \"string\";","tryCatchPattern":null,"preventionTips":["Keep severity as a string enum {fatal, warn} end-to-end in scanner code","Convert integer scales at the ingestion boundary, not at serialization time","Avoid structured severity objects in the outgoing payload"],"tags":["security-scanner","json","schema","type-mismatch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}