{"record":{"id":"ea7171f57a1e6fe2","repo":"oven-sh/bun","slug":"invaliddescriptionfield","errorCode":null,"errorMessage":"InvalidDescriptionField","messagePattern":"InvalidDescriptionField","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":135,"sourceCode":"    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]\n    MissingPackageField,\n    #[error(\"InvalidPackageField\")]\n    InvalidPackageField,\n    #[error(\"EmptyPackageField\")]\n    EmptyPackageField,\n    #[error(\"InvalidDescriptionField\")]\n    InvalidDescriptionField,\n    #[error(\"InvalidUrlField\")]\n    InvalidUrlField,\n    #[error(\"MissingLevelField\")]\n    MissingLevelField,\n    #[error(\"InvalidLevelField\")]\n    InvalidLevelField,\n    #[error(\"InvalidLevelValue\")]\n    InvalidLevelValue,\n    #[error(\"Missing global bin directory: try setting $BUN_INSTALL\")]\n    MissingGlobalBinDirectoryTrySettingBUNINSTALL,\n    #[error(\"InvalidURL\")]\n    InvalidURL,\n    #[error(\"Fail\")]\n    Fail,\n    #[error(\"IntegrityCheckFailed\")]\n    IntegrityCheckFailed,\n    #[error(\"RepositoryNotFound\")]","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L117-L153","documentation":"The advisory's optional `description` field, when present, must be a string or null (security_scanner.rs:1849-1861). Sending a number, object, or boolean is rejected with the offending index printed. Omitting the field entirely is fine.","triggerScenarios":"Scanner sends \"description\": {\"summary\": ..., \"cwe\": [...]}, a severity number, or true/false in the description slot.","commonSituations":"Rich structured descriptions from vulnerability databases serialized directly; template values defaulting to non-null non-string sentinels.","solutions":["Serialize description to a single string (e.g. join summary lines) or send null","Omit the field when there is nothing to report — omission is valid","Coerce with String(x) only for genuine scalars; restructure objects into the string"],"exampleFix":"// before\nadvisories: [{ package: \"foo\", level: \"warn\", description: { text: \"RCE\", cwe: 78 } }]\n\n// after\nadvisories: [{ package: \"foo\", level: \"warn\", description: \"RCE (CWE-78)\" }]","handlingStrategy":"type-guard","validationCode":"// scanner-side: coerce description to string|null or delete it\nfor (const a of advisories) {\n  if (a.description != null && typeof a.description !== \"string\") {\n    a.description = typeof a.description === \"object\" ? JSON.stringify(a.description) : String(a.description);\n  }\n}","typeGuard":"const validDescription = (d) => d == null || typeof d === \"string\";","tryCatchPattern":null,"preventionTips":["Treat description as string|null|absent — nothing else","Stringify structured descriptions at the adapter boundary","Prefer omitting the field over sending non-string placeholders"],"tags":["security-scanner","json","schema","type-mismatch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}