What causes "MissingAdvisoriesField" in oven-sh/bun?

Always include the key, even when clean: {"type":"result","advisories":[]}

oven-sh/bun · error · bun_install::Error

MissingAdvisoriesField

Error message

MissingAdvisoriesField

What it means

The scanner sent a well-formed "result" IPC message, but the JSON object lacks the required `advisories` field (security_scanner.rs:1754-1756). An empty scan must still include "advisories": [] — omitting the key entirely is a protocol violation.

Source

Thrown at src/install/error.rs:119

    #[error("InvalidIPCType")]
    InvalidIPCType,
    #[error("MissingErrorCode")]
    MissingErrorCode,
    #[error("InvalidErrorCode")]
    InvalidErrorCode,
    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Always include the key, even when clean: {"type":"result","advisories":[]}
Rename any 'findings'/'vulnerabilities'/'issues' field to exactly "advisories"
Validate your scanner's output against the expected schema before writing it to the IPC pipe

Example fix

// before
send({ type: "result", findings: [] });

// after
send({ type: "result", advisories: [] });

Defensive patterns

Strategy: validation

Validate before calling

// scanner-side: always emit the advisories key
const payload = { type: "result", advisories: collectAdvisories() ?? [] };
if (!("advisories" in payload)) throw new Error("result message missing advisories");

Type guard

const isResultMessage = (m) => m?.type === "result" && Array.isArray(m.advisories);

Prevention

Build result messages from one factory function that always sets advisories
Use the exact field name "advisories" — not findings/vulnerabilities/issues
Test the empty-scan path explicitly (it must still send advisories: [])

When it happens

Trigger: A custom scanner returns {"type":"result"} with no advisories key, or names it differently ("findings", "vulnerabilities", "issues") instead of the required "advisories".

Common situations: First-time implementation of a custom scanner guessing field names; scanner that conditionally omits the field when no vulnerabilities were found; protocol drift between scanner versions.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/6c6638241011cc89. Report an issue: GitHub.