oven-sh/bun · error

INVALID_VERSION

INVALID_VERSION

Error message

Security scanner must be version 1, got version ${scanner.version}

What it means

The subprocess checks `scanner.version !== "1"` and reports {type:"error", code:"INVALID_VERSION"}. The only supported scanner protocol version is exactly the string "1"; any other value is rejected before scan() is called.

Source

Thrown at src/install/PackageManager/scanner-entry.ts:94

    });
  } else {
    sendAndExit({
      type: "error",
      code: "SCAN_FAILED",
      message: error instanceof Error ? error.message : String(error),
    });
  }
}

try {
  if (typeof scanner !== "object" || scanner === null || typeof scanner.version !== "string") {
    throw new Error("Security scanner must export a 'scanner' object with a version property");
  }

  if (scanner.version !== "1") {
    sendAndExit({
      type: "error",
      code: "INVALID_VERSION",
      message: `Security scanner must be version 1, got version ${scanner.version}`,
    });
  }

  if (typeof scanner.scan !== "function") {
    throw new Error(`scanner.scan is not a function, got ${typeof scanner.scan}`);
  }

  const result = await scanner.scan({ packages });

  if (!Array.isArray(result)) {
    throw new Error("Security scanner must return an array of advisories");
  }

  sendAndExit({ type: "result", advisories: result });
} catch (error) {
  if (!suppressError) {
    console.error(error);

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Pin the scanner package release that declares version: "1"
2. If you own the scanner, set version to the exact string "1"
3. Upgrade Bun to a version whose scanner protocol matches your scanner's major
4. Check Bun's release notes for scanner protocol changes before upgrading the scanner

Example fix

// before
export const scanner = { version: "1.0", scan };

// after
export const scanner = { version: "1", scan };

const { scanner } = await import("@corp/scanner");
if (scanner.version !== "1") {
  throw new Error(`Unsupported scanner protocol ${scanner.version}; expected \"1\"`);
}

function isProtocolV1(s: { version: string }): boolean {
  return s.version === "1";
}

When it happens

Trigger: scanner.version is "2", "1.0", "0.9", or "" — anything but exactly "1". Typically a scanner built against a different protocol revision than the installed Bun supports.

Common situations: Scanner major release bumps its protocol version while installed Bun still speaks v1; formatting drift ("1.0" vs "1"); in-house scanner copied from a v2 template.

Related errors

• Security scanner must export a 'scanner' object with a versi
• scanner.scan is not a function, got ${typeof scanner.scan}
• Security scanner must return an array of advisories
• Invalid data object: ${JSON.stringify(data)}
• Expected ${receivedCount[0]} to equal ${sentCount}

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/3e83b92f3f78f6d6. Report an issue: GitHub.