Docs / Use / Findings

Findings

Each finding has a severity, a code, the file it applies to, a message and the evidence behind it. There are eighteen codes.

critical: SDK_DEPRECATED, JS_SDK_DEPRECATED, JS_LEGACY_PACKAGE, CLI_DEPRECATED
warning: SDK_BEHIND, JS_SDK_BEHIND, SDK_UNKNOWN, JS_SDK_UNKNOWN, MANIFEST_UNPARSEABLE, DATA_DEGRADED, CLI_BEHIND, CLI_UNKNOWN, RUST_TARGET_LEGACY, RUST_TOOLCHAIN_OLD
info: SDK_CURRENT, JS_SDK_CURRENT, NO_SDK_FOUND, CLI_CURRENT

When a lockfile resolves a dependency, the evidence says so, for example resolved 21.7.6 from Cargo.lock; manifest ^21, and the comparison uses the resolved version. When the lockfile is ambiguous the manifest version is used and the evidence notes it. See What it scans.

The JavaScript checks compare against the current @stellar/stellar-sdk release. @stellar/stellar-base is compared with that same release.

SDK_DEPRECATED

critical

Meaning: soroban-sdk is on a major that Scout lists as deprecated and that is below the current major, or it is more than one major behind the current major.
Evidence shown: The major comparison: for example major 21 < current major 28 and appears in the Scout deprecated sample, or major 21 < current major 28 - 1, followed by the source and observation time.
What to do: Upgrade soroban-sdk to the current major shown in the report header. Release notes are collected from the docs search (see Data sources).

SDK_BEHIND

warning

Meaning: soroban-sdk is exactly one major behind the current major.
Evidence shown: major N = current major M - 1, with the source and observation time.
What to do: Plan an upgrade to the current major. It is not deprecated yet.

SDK_CURRENT

info

Meaning: soroban-sdk is on the current major or newer.
Evidence shown: major N >= current major M, with the source and observation time.
What to do: Nothing. If the major is newer than the ecosystem's, the message says or newer.

SDK_UNKNOWN

warning

Meaning: The soroban-sdk version could not be parsed from the manifest, or the current major is unavailable, so no comparison was made.
Evidence shown: Either Version unparseable from manifest; no comparison made, or Current major evidence unavailable; no deprecation claim made.
What to do: If the version is unparseable, declare a plain version such as 21.0.0 (see What it scans). If the current major is unavailable, look for a DATA_DEGRADED finding and run again.

JS_SDK_DEPRECATED

critical

Meaning: A JavaScript Stellar SDK dependency is more than one major behind the current release.
Evidence shown: major N < current major M - 1, with the source and observation time.
What to do: Upgrade to the current @stellar/stellar-sdk. Check its release notes for breaking changes.

JS_SDK_BEHIND

warning

Meaning: A JavaScript Stellar SDK dependency is exactly one major behind the current release.
Evidence shown: major N = current major M - 1, with the source and observation time.
What to do: Plan an upgrade to the current major.

JS_SDK_CURRENT

info

Meaning: A JavaScript Stellar SDK dependency is on the current major or newer.
Evidence shown: major N >= current major M, with the source and observation time.
What to do: Nothing.

JS_SDK_UNKNOWN

warning

Meaning: The version could not be parsed, or the current JavaScript SDK release is unavailable, so no comparison was made.
Evidence shown: Either Version unparseable from manifest or Current JS SDK version evidence unavailable.
What to do: Declare a plain version, or look for DATA_DEGRADED and run again.

JS_LEGACY_PACKAGE

critical

Meaning: The repo depends on the legacy soroban-client or the unscoped stellar-sdk package.
Evidence shown: Legacy package name detected in manifest, with the reference source and observation time.
What to do: Replace it with @stellar/stellar-sdk.

MANIFEST_UNPARSEABLE

warning

Meaning: A Cargo.toml, a package.json, or a directory could not be read or parsed. Its dependencies were not checked.
Evidence shown: The parser or file-system error message.
What to do: Fix the file or the unreadable directory (for example invalid TOML or JSON, or a permission error) and run again. Until then that path is unchecked.

DATA_DEGRADED

warning

Meaning: One of the ecosystem sources failed or returned partial data, or a stale or fallback cached snapshot was used. Related verdicts may be unknown or incomplete.
Evidence shown: Reported while collecting the snapshot observed <time>. The message names the failing source, for example stellarDocs.get_doc_page: .... The file column reads (ecosystem data).
What to do: Run again. If it persists, check Raven availability and read the message for which source failed.

NO_SDK_FOUND

info

Meaning: No soroban-sdk or Stellar JavaScript SDK dependency was detected in the scanned path.
Evidence shown: Scanned Cargo.toml and package.json files under <root>.
What to do: Check the path. Folders such as node_modules and target are skipped, and the scan stops four levels down.

CLI_DEPRECATED

critical

Meaning: A pinned stellar-cli is two or more majors behind the current Stellar CLI. One finding per pin; nothing is reported when the repo pins none.
Evidence shown: The pin and the file and line it came from, for example pinned in .github/workflows/ci.yml:23. The comparison uses the Stellar CLI version on the official software versions page.
What to do: Upgrade the pin to the current Stellar CLI major.

CLI_BEHIND

warning

Meaning: A pinned stellar-cli is exactly one major behind the current Stellar CLI.
Evidence shown: The pin and the file and line it came from, for example pinned in .github/workflows/ci.yml:23.
What to do: Plan an upgrade to the current major.

CLI_CURRENT

info

Meaning: A pinned stellar-cli is on the current major (or newer).
Evidence shown: The pin and the file and line it came from, for example pinned in .github/workflows/ci.yml:23.
What to do: Nothing.

CLI_UNKNOWN

warning

Meaning: A stellar-cli pin exists but its version is unparseable (for example a branch name or a CI expression), or the current Stellar CLI version is unavailable, so no verdict is made.
Evidence shown: The pin and the file and line it came from, for example pinned in .github/workflows/ci.yml:23.
What to do: Pin a plain version, or look for DATA_DEGRADED and run again.

RUST_TARGET_LEGACY

warning

Meaning: wasm32-unknown-unknown is declared in a repo with soroban-sdk and no wasm32v1-none. Stellar CLI 23+ builds for wasm32v1-none. One finding per declaration site.
Evidence shown: The declaring file and line, such as rust-toolchain.toml, .cargo/config.toml, a workflow, a Makefile or a script.
What to do: Run rustup target add wasm32v1-none and declare it where the legacy target is declared.

RUST_TOOLCHAIN_OLD

warning

Meaning: A pinned Rust channel is below 1.84.0 in a repo with soroban-sdk. The setup guide requires Rust v1.84.0 or higher. stable and nightly are not pins.
Evidence shown: The pinned channel and the file and line it came from.
What to do: Raise the pinned channel to 1.84.0 or higher.