What causes "SecurityScannerFailed" in oven-sh/bun?

Make the scanner exit with code 0 whenever it successfully reports results — express severity via advisory levels, not exit codes

oven-sh/bun · error · bun_install::Error

SecurityScannerFailed

Error message

SecurityScannerFailed

What it means

The scanner produced a parseable result message, but its process then exited with a non-zero exit code (or an unrecognized failure status) — Bun requires the scanner process to exit 0 after reporting results (security_scanner.rs:1762-1780). Results from a failed process are not trusted.

Source

Thrown at src/install/error.rs:121

    #[error("MissingErrorCode")]
    MissingErrorCode,
    #[error("InvalidErrorCode")]
    InvalidErrorCode,
    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Make the scanner exit with code 0 whenever it successfully reports results — express severity via advisory levels, not exit codes
Await/flush all writes before exiting; catch teardown errors and still exit 0
Look at stderr from the scanner process for the post-result crash and fix it

Example fix

// before (scanner)
send({ type: "result", advisories });
process.exit(advisories.length > 0 ? 1 : 0); // wrong signal

// after
send({ type: "result", advisories }); // fatal advisories carry severity
process.exit(0);

Defensive patterns

Strategy: validation

Validate before calling

// scanner-side: guarantee exit 0 after a successful send
const ok = send({ type: "result", advisories });
process.on("uncaughtException", (e) => { console.error(e); process.exit(0); }); // reported already
process.exitCode = 0;

Prevention

Use advisory level "fatal" to fail the build — never a non-zero scanner exit after results
Register unhandledRejection/uncaughtException handlers that still allow a clean exit
Flush stdout (await a drain promise) before the process ends

When it happens

Trigger: Scanner writes the result JSON to IPC but afterwards crashes, throws an unhandled exception, or calls process.exit(1) — e.g. a bug in shutdown/finalization code, or exiting non-zero to signal 'vulnerabilities found' instead of using advisory levels.

Common situations: Scanner authors using exit code 1 to mean 'issues detected' (the protocol expects level:"fatal" advisories instead); async work (flush, upload) failing after the result is written; unhandled promise rejection during teardown.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/3386a26ba3c89fbc. Report an issue: GitHub.