What causes "InvalidScannerVersion" in oven-sh/bun?

Upgrade the scanner package to the latest version (`bun add --dev @latest`)

oven-sh/bun · error · bun_install::Error

InvalidScannerVersion

Error message

InvalidScannerVersion

What it means

The security scanner subprocess started successfully but replied with an IPC error message carrying code INVALID_VERSION, meaning the scanner detected a version mismatch — typically its own version versus the IPC protocol or arguments Bun passed. Bun surfaces this as InvalidScannerVersion after printing the scanner's message (security_scanner.rs:1662-1671).

Source

Thrown at src/install/error.rs:113

    #[error("InvalidIPCMessage")]
    InvalidIPCMessage,
    #[error("InvalidIPCFormat")]
    InvalidIPCFormat,
    #[error("MissingIPCType")]
    MissingIPCType,
    #[error("InvalidIPCType")]
    InvalidIPCType,
    #[error("MissingErrorCode")]
    MissingErrorCode,
    #[error("InvalidErrorCode")]
    InvalidErrorCode,
    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Upgrade the scanner package to the latest version (`bun add --dev <scanner>@latest`)
Upgrade or align Bun to the release the scanner documents support for (`bun upgrade`)
For a custom scanner, relax or fix the version check that emits INVALID_VERSION so it matches Bun's current IPC shape

Example fix

# before
bun add --dev my-scanner@1.0.0   # emits INVALID_VERSION under new Bun

# after
bun add --dev my-scanner@latest
bun install

Defensive patterns

Strategy: validation

Validate before calling

# pin and verify a known-good scanner/Bun pair before install
bun add --dev my-scanner@^2   # v2 is the line that matches your Bun major
bun pm ls | grep my-scanner   # confirm it actually installed

Prevention

Upgrade Bun and the scanner package together, not independently
Pin both versions in CI (bun version + scanner version) so upgrades are deliberate
For custom scanners, treat the IPC protocol as a contract: version and test it

When it happens

Trigger: The spawned scanner validates a protocol/API version handshake and rejects what Bun sends. Happens when a scanner built for an older/newer Bun security-scanner IPC contract is configured, or the installed scanner package version is incompatible with the current Bun release.

Common situations: Upgrading Bun (or the scanner) without upgrading the other half of the pair; pinning an old scanner version in CI while Bun updates; a custom in-house scanner that checks process.argv or an env-provided protocol version and disagrees.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/339fe146f743d624. Report an issue: GitHub.