What causes "InvalidLevelField" in oven-sh/bun?

Convert numeric/enum severities to the strings "fatal" or "warn" before serialization

oven-sh/bun · error · bun_install::Error

InvalidLevelField

Error message

InvalidLevelField

What it means

The advisory's `level` field exists but is not a string (security_scanner.rs:1892-1897) — typically a number (1-3 severity scale) or an object. The parser requires a string so it can compare against "fatal"/"warn"; the failing index is printed.

Source

Thrown at src/install/error.rs:141

    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]
    InvalidURL,
    #[error("Fail")]
    Fail,
    #[error("IntegrityCheckFailed")]
    IntegrityCheckFailed,
    #[error("RepositoryNotFound")]
    RepositoryNotFound,
    #[error("DebugTextLockfileRoundTrip")]
    DebugTextLockfileRoundTrip,
    #[error("NoPackage")]
    NoPackage,
    #[error("BrokenPipe")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Convert numeric/enum severities to the strings "fatal" or "warn" before serialization
Flatten structured severity to one of the two accepted strings
Centralize the mapping in one function so all advisories classify consistently

Example fix

// before
advisories: [{ package: "foo", level: 2 }]

// after
advisories: [{ package: "foo", level: "fatal" }]

Defensive patterns

Strategy: type-guard

Validate before calling

// scanner-side: stringify/normalize numeric severity enums before sending
for (const a of advisories) if (typeof a.level !== "string") a.level = a.level >= 2 ? "fatal" : "warn";

Type guard

const isLevelString = (a) => typeof a?.level === "string";

Prevention

Keep severity as a string enum {fatal, warn} end-to-end in scanner code
Convert integer scales at the ingestion boundary, not at serialization time
Avoid structured severity objects in the outgoing payload

When it happens

Trigger: Scanner sends "level": 2, "level": {"value":"high"}, or a boolean in the level slot.

Common situations: Internal severity enums represented as integers; structured severity objects from upstream vulnerability feeds serialized as-is.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/7b1527bda19df2eb. Report an issue: GitHub.