{"record":{"id":"b6671f80159ef859","repo":"oven-sh/bun","slug":"missingpackagefield","errorCode":null,"errorMessage":"MissingPackageField","messagePattern":"MissingPackageField","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":129,"sourceCode":"    #[error(\"SecurityScannerNotInDependencies\")]\n    SecurityScannerNotInDependencies,\n    #[error(\"InvalidScannerVersion\")]\n    InvalidScannerVersion,\n    #[error(\"ScannerFailed\")]\n    ScannerFailed,\n    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]\n    MissingGlobalBinDirectoryTrySettingBUNINSTALL,\n    #[error(\"InvalidURL\")]","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L111-L147","documentation":"An advisory object inside the `advisories` array is missing the required `package` field (security_scanner.rs:1826-1831). Every advisory must name the affected package so Bun can map it to a lockfile entry; the failing index is printed.","triggerScenarios":"Scanner emits {\"level\":\"warn\",\"description\":\"...\"} without a package key, or names it differently (\"name\", \"moduleName\", \"pkg\").","commonSituations":"Field-name guesses in custom scanners (npm audit uses \"module_name\"); copying advisory objects from another tool's JSON without renaming keys.","solutions":["Add the exact key \"package\" with the affected package's name as a string to every advisory object","Rename 'name'/'module_name'/'moduleName' fields to \"package\" when adapting foreign formats","Add a unit check in the scanner that every advisory has a truthy package value before sending"],"exampleFix":"// before\nadvisories: [{ level: \"warn\", description: \"RCE in foo\" }]\n\n// after\nadvisories: [{ package: \"foo\", level: \"warn\", description: \"RCE in foo\" }]","handlingStrategy":"type-guard","validationCode":"// scanner-side: filter advisories lacking a package before sending\nconst advisories = raw.filter((a) => \"package\" in a && typeof a.package === \"string\" && a.package !== \"\");","typeGuard":"const hasPackageField = (a) => typeof a?.package === \"string\" && a.package.length > 0;","tryCatchPattern":null,"preventionTips":["Use the exact key \"package\" — not name/module_name/moduleName","Adapt foreign formats (npm audit etc.) through an explicit rename step","Assert required keys in scanner tests"],"tags":["security-scanner","json","schema","advisories"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}