oven-sh/bun · error · Error

Security scanner must return an array of advisories

Error message

Security scanner must return an array of advisories

What it means

scanner.scan() ran and resolved, but its resolved value is not an Array. The subprocess requires the advisories list itself — a bare array — not a wrapper object, so this throws and is reported as SCAN_FAILED.

Source

Thrown at src/install/PackageManager/scanner-entry.ts:106

    throw new Error("Security scanner must export a 'scanner' object with a version property");
  }

  if (scanner.version !== "1") {
    sendAndExit({
      type: "error",
      code: "INVALID_VERSION",
      message: `Security scanner must be version 1, got version ${scanner.version}`,
    });
  }

  if (typeof scanner.scan !== "function") {
    throw new Error(`scanner.scan is not a function, got ${typeof scanner.scan}`);
  }

  const result = await scanner.scan({ packages });

  if (!Array.isArray(result)) {
    throw new Error("Security scanner must return an array of advisories");
  }

  sendAndExit({ type: "result", advisories: result });
} catch (error) {
  if (!suppressError) {
    console.error(error);
  }

  sendAndExit({
    type: "error",
    code: "SCAN_FAILED",
    message: error instanceof Error ? error.message : "Unknown error occurred",
  });
}

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Return the array directly; return [] when the scan is clean
2. Audit every code path in scan for a missing return
3. Ensure each entry matches the Bun.Security.Advisory shape — the parent process validates each advisory afterwards (InvalidAdvisoryFormat)

Example fix

// before
async scan({ packages }) { return { advisories: [] }; }

// after
async scan({ packages }) { return []; }

const result = await scanner.scan({ packages: [] });
if (!Array.isArray(result)) {
  throw new Error("scan() must resolve to an array of advisories");
}

function isAdvisoryArray(result: unknown): result is unknown[] {
  return Array.isArray(result);
}

When it happens

Trigger: scan returns { advisories: [...] }; returns undefined (async function with a code path that forgets to return); returns a Map or other collection instead of an array.

Common situations: Refactor changed the return type; early `return;` on the happy path; wrapping the array "for future-proofing"; returning the raw HTTP response object from an advisory-DB fetch.

Related errors

• Security scanner must export a 'scanner' object with a versi
• INVALID_VERSION
• scanner.scan is not a function, got ${typeof scanner.scan}
• MODULE_NOT_FOUND
• SecurityScannerNotFound

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/413f5e89f0007f3e. Report an issue: GitHub.