oven-sh/bun · error · bun_install::Error

MissingLevelField

Error message

MissingLevelField

What it means

An advisory object is missing the required `level` field (security_scanner.rs:1885-1890). Every advisory must classify severity as either "fatal" or "warn"; the failing index is printed.

Source

Thrown at src/install/error.rs:139

    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]
    InvalidLevelField,
    #[error("InvalidLevelValue")]
    InvalidLevelValue,
    #[error("Missing global bin directory: try setting $BUN_INSTALL")]
    MissingGlobalBinDirectoryTrySettingBUNINSTALL,
    #[error("InvalidURL")]
    InvalidURL,
    #[error("Fail")]
    Fail,
    #[error("IntegrityCheckFailed")]
    IntegrityCheckFailed,
    #[error("RepositoryNotFound")]
    RepositoryNotFound,
    #[error("DebugTextLockfileRoundTrip")]
    DebugTextLockfileRoundTrip,
    #[error("NoPackage")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Add "level": "fatal" or "level": "warn" to every advisory object
2. Map source severities: critical/high → "fatal"; moderate/low/info → "warn"
3. Add an assertion in the scanner that every advisory has a valid level before sending

Example fix

// before
advisories: [{ package: "foo", severity: "high" }]

// after
const level = (s) => (s === "critical" || s === "high" ? "fatal" : "warn");
advisories: [{ package: "foo", level: level("high") }]

// scanner-side: every advisory must carry a level before sending
const LEVELS = new Set(["fatal", "warn"]);
const advisories = raw.filter((a) => LEVELS.has(a.level));

const hasLevel = (a) => a?.level === "fatal" || a?.level === "warn";

When it happens

Trigger: Scanner emits {"package":"foo","description":"..."} with no level, or uses an alternative key like "severity"/"impact" that Bun ignores.

Common situations: Porting advisories from npm audit (which uses "severity": "high"); scanners whose schema uses severity buckets that were never mapped to fatal/warn.

Related errors

• InvalidLevelValue
• MissingAdvisoriesField
• InvalidAdvisoriesFormat
• InvalidAdvisoryFormat
• MissingPackageField

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/83568775ef47f138. Report an issue: GitHub.