Skip to main content

CAP.L0.UNSUPPORTED_ENGINE — the engine that answered is not the one the driver names

  • Category: safety
  • Level: 0
  • Stability: stable
  • Suites: audit

The connection is configured with Laravel's mysql driver, and the server behind it is MariaDB. Laravel connects to it happily. SQLens will not audit it.

Why it stops instead of trying​

MariaDB and MySQL share a wire protocol and a driver name. They do not share semantics — and the places they diverge are exactly the places SQLens reasons about: online-DDL behavior, the effect of ALGORITHM/LOCK clauses, sql_mode defaults, the InnoDB version each ships. A rule written against MySQL 8.4 applied to MariaDB produces advice that is confident, specific, and about another product.

That is worse than no advice. Somebody would act on it.

So the run produces nothing — no findings, no partial report, exit 2 (misconfiguration). The message says "nothing was checked", and that sentence is only true if nothing runs.

How the engine is recognized​

Two shapes, because the two suites read different things:

  • The handshake banner carries MariaDB's 5.5.5- compatibility prefix. No MySQL server ever shipped as 5.5.5, so the prefix is unambiguous rather than a heuristic.
  • version() — which the audit reads — never carries that prefix. It reports e.g. 11.4.4-MariaDB, so the vendor marker in the banner is the second signal.

Both are needed. 11.4.4-MariaDB parses to a perfectly modern-looking version number and would otherwise sail past every check.

Why the answer does not depend on which key you typed​

Laravel's mariadb driver key is refused by name, before anything connects. If the mysql key gave a softer answer for the same physical server, SQLens's verdict would depend on a config spelling rather than on the database — which is exactly the determinism the package refuses to trade away.

What to do​

Point SQLens at PostgreSQL or MySQL, or leave the connection unchecked.

MariaDB is a declared non-goal, not an open gap. The supported baseline is PostgreSQL and MySQL, and that is settled rather than pending — so there is nothing here to wait for and nothing to contribute toward. The refusal is enforced in the code (mariadb is a reserved driver key that can never be registered) and held by tests, precisely so that the promise and the behavior cannot drift apart.