CAP.L0.RULE_WITHHELD_BY_DEPRECATION — a rule was not applied because it was retired
- Category: safety
- Level: 0
- Stability: stable
- Suites: audit
A rule that SQLens has retired is still registered and no longer runs. This notice is how the run says so.
Why a notice rather than a silent skip
A deprecation makes a report quieter. The rule stops producing findings, the output gets shorter, and every finding still in it is still true — which is indistinguishable from a database that got healthier.
That is the one shape this package refuses everywhere: a check that stopped running must not read like a check that passed. Governance promises that a deprecated rule "stops producing findings and says so". This id is the saying.
How it differs from its two siblings
Three things can make a rule absent from a run, and the reader's next move is different for each:
| Notice | Why the rule did not run | What to do |
|---|---|---|
| CAP.L0.RULE_WITHHELD_BY_VERSION | the server is outside the version window the rule reasons about | upgrade the server, or accept the gap |
| CAP.L0.INSTANCE_SCOPE_UNANSWERABLE | this instance cannot answer the question — a replica, for a rule about the write path | point the audit at the instance that can |
| CAP.L0.RULE_WITHHELD_BY_DEPRECATION | SQLens retired the rule | adopt the successor named in the message |
The first two are about your deployment. This one is about a decision made in this package, which is why the message names the successor rather than leaving you to look for it.
What the message tells you
- Since which version the rule has been deprecated.
- The successor id, when there is one — that is the whole value of the notice.
- That there is none, in words, when there is not. A rule retired without a replacement means what it used to check is now unchecked, and a reader who knows that stops looking for a successor that was never written.
Your configuration does not break
A deprecated rule stays resolvable. A baseline entry, an ignore-list entry or a suppression that names it keeps working, and the id is not reported as unknown.
That is deliberate: an upgrade that turned retired ids into configuration errors would break every project that had ever suppressed one — months after anybody remembers why the id is in the file.
When you will not see it
Only for rules this run would otherwise have applied. A deprecated rule outside the active level, the selected categories or the configured stability tier is not announced, because its absence changes nothing about this report. Announcing every retired rule in the package would be noise, and noise is how a notice gets filtered out and stops being read.