What causes "ScannerFailed" in oven-sh/bun?

Check the printed 'Security scanner failed: ' line — it carries the scanner's own reason; act on it first

oven-sh/bun · error · bun_install::Error

ScannerFailed

Error message

ScannerFailed

What it means

The security scanner subprocess replied over IPC with error code SCAN_FAILED — the scanner ran but could not complete its scan. Bun prints the scanner's human-readable `message` field (if present) and then fails with ScannerFailed (security_scanner.rs:1673-1682).

Source

Thrown at src/install/error.rs:115

    #[error("InvalidIPCFormat")]
    InvalidIPCFormat,
    #[error("MissingIPCType")]
    MissingIPCType,
    #[error("InvalidIPCType")]
    InvalidIPCType,
    #[error("MissingErrorCode")]
    MissingErrorCode,
    #[error("InvalidErrorCode")]
    InvalidErrorCode,
    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Check the printed 'Security scanner failed: <message>' line — it carries the scanner's own reason; act on it first
Re-run `bun install` after fixing connectivity (the scanner usually needs network to fetch advisories)
Clear or rebuild the scanner's local cache/database per its documentation
If the failure is persistent and environmental, temporarily remove `security_scanner` from bunfig.toml to unblock installs, then restore it

Example fix

# before: CI offline, scanner cannot fetch advisory DB → ScannerFailed
# after: pre-cache the scanner DB in a prior CI step
cache:  # .gitlab-ci.yml / GitHub Actions style
  paths:
    - .scanner-cache/
- run: scanner-cli --update-db   # warms cache
- run: bun install

Defensive patterns

Strategy: retry

Validate before calling

# warm the scanner's database/network prerequisites before installing
curl -fsS https://advisories.example.com/health > /dev/null || echo "scanner DB unreachable" >&2

Try / catch

# transient scanner failures (DB fetch, network): retry once before failing CI
bun install || bun install

Prevention

Pre-fetch/cache the scanner's advisory database in a CI cache step
Provide required tokens to the scanner via env before bun install runs
Keep the bunfig security_scanner optional in environments where the scan is best-effort

When it happens

Trigger: The scanner process starts, receives the package list, and hits an internal failure: unreadable advisory database, network error reaching an vulnerability API, malformed internal input, or a crash it catches and reports as SCAN_FAILED.

Common situations: Offline CI runner where the scanner cannot fetch its advisories database; scanner's database cache corrupted; scanner's own API token expired; scanner encountering a package manifest it cannot parse.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/503821f7fc1d45b2. Report an issue: GitHub.