What causes "InvalidAdvisoryFormat" in oven-sh/bun?

Wrap every entry as an object: {"package":"lodash","level":"warn",...}

oven-sh/bun · error · bun_install::Error

InvalidAdvisoryFormat

Error message

InvalidAdvisoryFormat

What it means

The `advisories` array parsed, but one of its elements is not a JSON object (security_scanner.rs:1818-1823). Each advisory must be an object with at minimum `package` and `level` fields; the offending index and received type are printed.

Source

Thrown at src/install/error.rs:127

    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Wrap every entry as an object: {"package":"lodash","level":"warn",...}
Check the printed index to find which entry is malformed in your scanner's output
Map string shorthand to objects before sending over IPC

Example fix

// before
advisories: ["lodash@4.17.19"]

// after
advisories: [{ package: "lodash", level: "warn", description: "prototype pollution", url: "https://..." }]

Defensive patterns

Strategy: type-guard

Validate before calling

// scanner-side: drop/fix non-object entries before sending
const advisories = raw.filter((a) => a != null && typeof a === "object" && !Array.isArray(a));

Type guard

const isAdvisoryEntry = (a) => typeof a === "object" && a !== null && !Array.isArray(a);

Prevention

Represent every advisory as an object literal from one constructor function
Watch the printed index when debugging — it points at the exact bad entry
Avoid mixed-type arrays from loosely-typed data pipelines

When it happens

Trigger: An advisory entry is a bare string ("lodash@4.17.19"), a nested array, or a number — anything other than an object at the reported index.

Common situations: Shorthand encodings in custom scanners; mixed-format output after refactoring; accidentally wrapping/omitting a level of nesting (e.g. spreading an array of entries).

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/6e25ce040860b50a. Report an issue: GitHub.