CAP.L0.SERVER_BELOW_FLOOR — the instance that answered is below the supported floor
- Category: safety
- Level: 0
- Stability: stable
- Suites: audit
SQLens supports PostgreSQL 18 and above, and MySQL 8.4 and above. This finding says the instance this audit read is older than that.
The audit did not stop. The catalog was read and judged as usual. What this finding withdraws is the claim that those judgments are about this server.
Why it is undetermined and not a failure
Nothing about your schema is wrong. What is uncertain is whether rules written against a newer server describe an older one — and that uncertainty runs in both directions:
- a rule may report a hazard your version does not have, and
- a rule may say nothing about a hazard your version does have, because no rule was ever written for a version below the floor.
A clean audit on an unsupported server is therefore the least informative result the tool can produce, and the one most easily mistaken for good news.
Under --strict the run exits 3 — undetermined — which is the exit code that means a human
should look. It is never 1: that code says findings breached a gate, and no gate was breached
here. It is never 2 either: the configuration is not wrong, the server is simply older than the
tool's floor.
The lint suite says this differently
A lint run reasons about migration files and may be pinned to a version with
assume_server_version; an audit reads a live instance and reports what that instance said. The two
reach the same fact by different routes, so they carry different ids and different pages —
LINT.SERVER_BELOW_FLOOR is the other one. A pipeline branching on the
id can tell which suite spoke.
Not the same as an unsupported engine
unsupported_engine means SQLens will never reason about this engine, and the only fix is to stop
pointing it here. This means upgrade, and until then read the report as advisory. A pipeline has
to be able to tell a dead end from a deadline, so the two carry different undetermined reasons.
What to do
Upgrade the instance. If that is scheduled rather than immediate, keep running the audit — the findings are still worth acting on — but do not treat a clean result as clearance.
Related
CAP.L0.ASSUMED_VERSION_SKEW— the pinned version and the instance disagreeLINT.SERVER_BELOW_FLOOR— the same fact, reached by a lint run