What causes "SecurityScannerNotInDependencies" in oven-sh/bun?

Run `bun add --dev ` exactly matching the bunfig.toml value

oven-sh/bun · error · bun_install::Error

SecurityScannerNotInDependencies

Error message

SecurityScannerNotInDependencies

What it means

The security scanner named in bunfig.toml reported MODULE_NOT_FOUND on the first attempt, and it is not present in the project's dependencies or lockfile (no package ID exists for it), so Bun has no way to install it automatically. This is the 'you configured a scanner you never added' error.

Source

Thrown at src/install/error.rs:111

    #[error("NoSecurityScanData")]
    NoSecurityScanData,
    #[error("InvalidIPCMessage")]
    InvalidIPCMessage,
    #[error("InvalidIPCFormat")]
    InvalidIPCFormat,
    #[error("MissingIPCType")]
    MissingIPCType,
    #[error("InvalidIPCType")]
    InvalidIPCType,
    #[error("MissingErrorCode")]
    MissingErrorCode,
    #[error("InvalidErrorCode")]
    InvalidErrorCode,
    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Run `bun add --dev <scanner-package-name>` exactly matching the bunfig.toml value
Re-run `bun install` so the scanner is resolvable before the security scan step
If the scanner should not run in this project, remove the `security_scanner` key from bunfig.toml

Example fix

# terminal — before: bun install fails with SecurityScannerNotInDependencies
# after:
bun add --dev bun-security-scanner
bun install

Defensive patterns

Strategy: validation

Validate before calling

# fail early if bunfig names a scanner that package.json does not declare
SCANNER=$(grep -oP 'security_scanner\s*=\s*"\K[^"]+' bunfig.toml)
if [ -n "$SCANNER" ] && ! grep -q "\"$SCANNER\"" package.json; then
  echo "bunfig.toml security_scanner '$SCANNER' is not in dependencies — run: bun add --dev $SCANNER" >&2
  exit 1
fi

Prevention

Install the scanner with `bun add --dev` in the same commit that adds security_scanner to bunfig.toml
In monorepos, put the scanner dependency in the workspace root where bunfig.toml lives
Remove the bunfig.toml key when you remove the scanner dependency

When it happens

Trigger: Configure `[install] security_scanner = "some-npm-scanner"` in bunfig.toml without adding that package to package.json, then run `bun install`. The scanner process fails to find its own module; since security_scanner_pkg_id is None, Bun reports SecurityScannerNotInDependencies (security_scanner.rs:1659) and prints a hint to `bun add --dev <scanner>`.

Common situations: Copy-pasting a bunfig.toml from a template or teammate without installing the scanner it references; removing the scanner from devDependencies but leaving bunfig.toml configured; using a scanner package only present in a different workspace of a monorepo.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/f5bc2aec7061a417. Report an issue: GitHub.