oven-sh/bun · error · bun_install::Error

InvalidDescriptionField

Error message

InvalidDescriptionField

What it means

The advisory's optional `description` field, when present, must be a string or null (security_scanner.rs:1849-1861). Sending a number, object, or boolean is rejected with the offending index printed. Omitting the field entirely is fine.

Source

Thrown at src/install/error.rs:135

    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]
    InvalidURL,
    #[error("Fail")]
    Fail,
    #[error("IntegrityCheckFailed")]
    IntegrityCheckFailed,
    #[error("RepositoryNotFound")]

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Serialize description to a single string (e.g. join summary lines) or send null
  2. Omit the field when there is nothing to report — omission is valid
  3. Coerce with String(x) only for genuine scalars; restructure objects into the string

Example fix

// before
advisories: [{ package: "foo", level: "warn", description: { text: "RCE", cwe: 78 } }]

// after
advisories: [{ package: "foo", level: "warn", description: "RCE (CWE-78)" }]
Defensive patterns

Strategy: type-guard

Validate before calling

// scanner-side: coerce description to string|null or delete it
for (const a of advisories) {
  if (a.description != null && typeof a.description !== "string") {
    a.description = typeof a.description === "object" ? JSON.stringify(a.description) : String(a.description);
  }
}

Type guard

const validDescription = (d) => d == null || typeof d === "string";

Prevention

When it happens

Trigger: Scanner sends "description": {"summary": ..., "cwe": [...]}, a severity number, or true/false in the description slot.

Common situations: Rich structured descriptions from vulnerability databases serialized directly; template values defaulting to non-null non-string sentinels.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/ea7171f57a1e6fe2. Report an issue: GitHub.