oven-sh/bun · error · bun_install::Error

InvalidUrlField

Error message

InvalidUrlField

What it means

The advisory's optional `url` field, when present, must be a string or null (security_scanner.rs:1867-1879). Objects or other types are rejected with the index printed. Like description, the field may be omitted entirely.

Source

Thrown at src/install/error.rs:137

    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]
    InvalidURL,
    #[error("Fail")]
    Fail,
    #[error("IntegrityCheckFailed")]
    IntegrityCheckFailed,
    #[error("RepositoryNotFound")]
    RepositoryNotFound,
    #[error("DebugTextLockfileRoundTrip")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Send the link as a plain string: "url": "https://nvd.nist.gov/vuln/detail/CVE-..."
2. Use .href (or String(url)) when you hold a URL object
3. If several links exist, pick the primary one and put the rest in description, or send null

Example fix

// before
advisories: [{ package: "foo", level: "warn", url: new URL("https://example.com/advisory") }]

// after
advisories: [{ package: "foo", level: "warn", url: "https://example.com/advisory" }]

// scanner-side: always send url as a string
for (const a of advisories) if (a.url != null && typeof a.url !== "string") a.url = a.url.href ?? String(a.url);

const validAdvisoryUrl = (u) => u == null || typeof u === "string";

When it happens

Trigger: Scanner sends a parsed URL object ("url": {"href": ..., "protocol": "https:"}) or an array of reference links in the url slot.

Common situations: Serializing a WHATWG/Node URL object without .href; multiple references squashed into an array; advisory records reused from tools with structured links.

Related errors

• MissingAdvisoriesField
• InvalidAdvisoriesFormat
• InvalidAdvisoryFormat
• MissingPackageField
• InvalidPackageField

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/c78ea7bb809dc9cc. Report an issue: GitHub.