What causes "InvalidLevelValue" in oven-sh/bun?

Emit exactly "fatal" or "warn" (lowercase, case-sensitive)

oven-sh/bun · error · bun_install::Error

InvalidLevelValue

Error message

InvalidLevelValue

What it means

The advisory's `level` string is neither "fatal" nor "warn" (security_scanner.rs:1899-1908). These two exact lowercase values are the whole vocabulary; anything else — "error", "high", "info", "FATAL" — is rejected, with the received value printed.

Source

Thrown at src/install/error.rs:143

    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]
    InvalidURL,
    #[error("Fail")]
    Fail,
    #[error("IntegrityCheckFailed")]
    IntegrityCheckFailed,
    #[error("RepositoryNotFound")]
    RepositoryNotFound,
    #[error("DebugTextLockfileRoundTrip")]
    DebugTextLockfileRoundTrip,
    #[error("NoPackage")]
    NoPackage,
    #[error("BrokenPipe")]
    BrokenPipe,
    #[error("WriteFailed")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Emit exactly "fatal" or "warn" (lowercase, case-sensitive)
Collapse richer scales: critical/high → "fatal"; everything else → "warn"
Print/assert your level values in scanner tests to catch casing drift

Example fix

// before
advisories: [{ package: "foo", level: "high" }]

// after
advisories: [{ package: "foo", level: "fatal" }]

Defensive patterns

Strategy: validation

Validate before calling

// scanner-side: collapse any severity vocabulary to the two allowed values
const toLevel = (s) => (String(s).toLowerCase() === "critical" || String(s).toLowerCase() === "high" ? "fatal" : "warn");
for (const a of advisories) a.level = toLevel(a.level);

Type guard

const isValidLevelValue = (l) => l === "fatal" || l === "warn";

Prevention

Only two lowercase values are valid: "fatal" and "warn" — match them exactly
Map external severity scales (low/moderate/high/critical) through one function
Add a unit test asserting every emitted level is in the allowed set

When it happens

Trigger: Scanner maps severities to npm-style names ("low"/"moderate"/"critical"), uses uppercase ("Fatal"), or sends "error"/"info" — none of which match the case-sensitive comparison.

Common situations: Adapters for npm audit / OSV / GitHub advisory feeds passing severity names through unchanged; casing inconsistencies; intermediate severity buckets that need collapsing.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/740ddd38437f9e96. Report an issue: GitHub.