What causes "SecurityScannerTerminated" in oven-sh/bun?

Raise the memory limit for the environment (CI container, Docker mem limit) so the scanner can finish

oven-sh/bun · error · bun_install::Error

SecurityScannerTerminated

Error message

SecurityScannerTerminated

What it means

The security scanner process was killed by an OS signal (SIGKILL, SIGTERM, OOM-killer, etc.) instead of exiting normally (security_scanner.rs:1770-1775). The signal name is printed. Common causes are memory pressure or an external supervisor terminating the child.

Source

Thrown at src/install/error.rs:123

    #[error("InvalidErrorCode")]
    InvalidErrorCode,
    #[error("UnknownErrorCode")]
    UnknownErrorCode,
    #[error("SecurityScannerNotFound")]
    SecurityScannerNotFound,
    #[error("SecurityScannerNotInDependencies")]
    SecurityScannerNotInDependencies,
    #[error("InvalidScannerVersion")]
    InvalidScannerVersion,
    #[error("ScannerFailed")]
    ScannerFailed,
    #[error("UnknownMessageType")]
    UnknownMessageType,
    #[error("MissingAdvisoriesField")]
    MissingAdvisoriesField,
    #[error("SecurityScannerFailed")]
    SecurityScannerFailed,
    #[error("SecurityScannerTerminated")]
    SecurityScannerTerminated,
    #[error("InvalidAdvisoriesFormat")]
    InvalidAdvisoriesFormat,
    #[error("InvalidAdvisoryFormat")]
    InvalidAdvisoryFormat,
    #[error("MissingPackageField")]
    MissingPackageField,
    #[error("InvalidPackageField")]
    InvalidPackageField,
    #[error("EmptyPackageField")]
    EmptyPackageField,
    #[error("InvalidDescriptionField")]
    InvalidDescriptionField,
    #[error("InvalidUrlField")]
    InvalidUrlField,
    #[error("MissingLevelField")]
    MissingLevelField,
    #[error("InvalidLevelField")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Raise the memory limit for the environment (CI container, Docker mem limit) so the scanner can finish
Reduce scan scope (fewer packages, exclude workspaces) if the scanner supports it
Re-run once to rule out a one-off external kill; if reproducible, capture which signal was printed and find its sender
If a wrapper enforces a timeout shorter than scan duration, increase it

Example fix

# before: container limit kills scanner (SIGKILL)
docker run --memory=512m bun-install

# after
docker run --memory=2g bun-install

Defensive patterns

Strategy: retry

Validate before calling

# pre-flight memory headroom in constrained CI/containers
avail=$(awk '/MemAvailable/ {print int($2/1024)}' /proc/meminfo)
[ "$avail" -ge 1024 ] || echo "low memory: scanner may be OOM-killed" >&2

Try / catch

# signals are usually environmental: retry the install once
bun install || (echo "retrying after scanner termination" >&2 && bun install)

Prevention

Size container/CI memory limits above the scanner's peak RSS for your dependency count
Avoid tight process timeouts around the install step while a scan is in flight
Monitor for OOM kills (dmesg) when scans of large trees fail mysteriously

When it happens

Trigger: Scanner child process exceeds container/CI memory limits and the OOM killer sends SIGKILL; a tooling wrapper (test runner, Docker stop) sends SIGTERM mid-scan; scanner spawns large analysis that triggers resource limits.

Common situations: CI containers with low memory ceilings scanning large dependency trees; Docker `timeout`/`stop_grace_period` terminating the install step; system-wide OOM during a scan of big monorepos.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/182166398ed62298. Report an issue: GitHub.