What causes "InvalidAdvisoriesFormat" in oven-sh/bun?

Emit a JSON array: "advisories": [] for clean scans, "advisories":[{...},{...}] otherwise

oven-sh/bun · error · bun_install::Error

InvalidAdvisoriesFormat

Error message

InvalidAdvisoriesFormat

What it means

In the scanner's result message, the top-level `advisories` field is present but is not a JSON array (security_scanner.rs:1808-1813). The parser requires an array even when empty; objects, strings, or null are rejected and the actual received type tag is printed.

Source

Thrown at src/install/error.rs:125

    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Emit a JSON array: "advisories": [] for clean scans, "advisories":[{...},{...}] otherwise
Convert map-shaped results with Object.values(advisoryMap) before serializing
Never null — use an empty array

Example fix

// before
send({ type: "result", advisories: null });

// after
send({ type: "result", advisories: [] });

Defensive patterns

Strategy: type-guard

Validate before calling

// scanner-side: normalize before sending
const advisories = Array.isArray(raw?.advisories) ? raw.advisories : Object.values(raw?.advisories ?? {});

Type guard

const isValidAdvisories = (v) => Array.isArray(v);

Prevention

Always serialize an array — use Object.values() if your internal model is a map
Replace null sentinels for 'clean' with []
Validate the outgoing payload shape in scanner unit tests

When it happens

Trigger: Scanner sends "advisories": {...} (an object/map keyed by package), "advisories": null when there is nothing to report, or a string summary instead of the array.

Common situations: Scanner authors modeling advisories as a map for deduplication; returning null as a 'clean' sentinel; partially refactored output code.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/d30d14de8c30f897. Report an issue: GitHub.