{"record":{"id":"f5bc2aec7061a417","repo":"oven-sh/bun","slug":"securityscannernotindependencies","errorCode":null,"errorMessage":"SecurityScannerNotInDependencies","messagePattern":"SecurityScannerNotInDependencies","errorType":"exception","errorClass":"bun_install::Error","httpStatus":null,"severity":"error","filePath":"src/install/error.rs","lineNumber":111,"sourceCode":"    #[error(\"NoSecurityScanData\")]\n    NoSecurityScanData,\n    #[error(\"InvalidIPCMessage\")]\n    InvalidIPCMessage,\n    #[error(\"InvalidIPCFormat\")]\n    InvalidIPCFormat,\n    #[error(\"MissingIPCType\")]\n    MissingIPCType,\n    #[error(\"InvalidIPCType\")]\n    InvalidIPCType,\n    #[error(\"MissingErrorCode\")]\n    MissingErrorCode,\n    #[error(\"InvalidErrorCode\")]\n    InvalidErrorCode,\n    #[error(\"UnknownErrorCode\")]\n    UnknownErrorCode,\n    #[error(\"SecurityScannerNotFound\")]\n    SecurityScannerNotFound,\n    #[error(\"SecurityScannerNotInDependencies\")]\n    SecurityScannerNotInDependencies,\n    #[error(\"InvalidScannerVersion\")]\n    InvalidScannerVersion,\n    #[error(\"ScannerFailed\")]\n    ScannerFailed,\n    #[error(\"UnknownMessageType\")]\n    UnknownMessageType,\n    #[error(\"MissingAdvisoriesField\")]\n    MissingAdvisoriesField,\n    #[error(\"SecurityScannerFailed\")]\n    SecurityScannerFailed,\n    #[error(\"SecurityScannerTerminated\")]\n    SecurityScannerTerminated,\n    #[error(\"InvalidAdvisoriesFormat\")]\n    InvalidAdvisoriesFormat,\n    #[error(\"InvalidAdvisoryFormat\")]\n    InvalidAdvisoryFormat,\n    #[error(\"MissingPackageField\")]","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L93-L129","documentation":"The security scanner named in bunfig.toml reported MODULE_NOT_FOUND on the first attempt, and it is not present in the project's dependencies or lockfile (no package ID exists for it), so Bun has no way to install it automatically. This is the 'you configured a scanner you never added' error.","triggerScenarios":"Configure `[install] security_scanner = \"some-npm-scanner\"` in bunfig.toml without adding that package to package.json, then run `bun install`. The scanner process fails to find its own module; since security_scanner_pkg_id is None, Bun reports SecurityScannerNotInDependencies (security_scanner.rs:1659) and prints a hint to `bun add --dev <scanner>`.","commonSituations":"Copy-pasting a bunfig.toml from a template or teammate without installing the scanner it references; removing the scanner from devDependencies but leaving bunfig.toml configured; using a scanner package only present in a different workspace of a monorepo.","solutions":["Run `bun add --dev <scanner-package-name>` exactly matching the bunfig.toml value","Re-run `bun install` so the scanner is resolvable before the security scan step","If the scanner should not run in this project, remove the `security_scanner` key from bunfig.toml"],"exampleFix":"# terminal — before: bun install fails with SecurityScannerNotInDependencies\n# after:\nbun add --dev bun-security-scanner\nbun install","handlingStrategy":"validation","validationCode":"# fail early if bunfig names a scanner that package.json does not declare\nSCANNER=$(grep -oP 'security_scanner\\s*=\\s*\"\\K[^\"]+' bunfig.toml)\nif [ -n \"$SCANNER\" ] && ! grep -q \"\\\"$SCANNER\\\"\" package.json; then\n  echo \"bunfig.toml security_scanner '$SCANNER' is not in dependencies — run: bun add --dev $SCANNER\" >&2\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Install the scanner with `bun add --dev` in the same commit that adds security_scanner to bunfig.toml","In monorepos, put the scanner dependency in the workspace root where bunfig.toml lives","Remove the bunfig.toml key when you remove the scanner dependency"],"tags":["bunfig-toml","security-scanner","dependencies","install"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}