Docs / Reference / Limitations

Limitations

kedgeway says what it does not know. These are the gaps to keep in mind.

Lockfile parsing is limited

Cargo.lock, package-lock.json, pnpm-lock.yaml and yarn.lock are read; pnpm and yarn with a minimal parser, so unusual layouts fall back to the manifest version. Nothing above the scan root is read. The parsers are tested on seven real lockfiles from public repositories, which is a corpus, not a guarantee: a layout it has not seen can fall back to the manifest. JS ranges use semver; Cargo requirements use a custom matcher.

Annotations are best effort

The line in an annotation comes from a plain scan of the manifest (the first matching key), so it can point at the wrong line in an unusual file. Findings that are not about a file have no location. GitHub shows at most 10 annotations per type per step and 50 per job; the full report is always printed.

No device-code login

Stellar Raven offers authorization code and refresh tokens only. On a server, use kedgeway login --no-browser and paste the redirect back, or forward the callback port with ssh -L.

The deprecated list is a sample

Scout's deprecated sample is capped at 50. A version missing from it is not proof that it is supported. kedgeway also treats anything more than one major behind as deprecated.

Current versions come from a docs page

They are read from the official Software Versions page. If that page changes shape, parsing can fail, and the report says so with DATA_DEGRADED.

Raven must be reachable

A live run needs network access and a valid Raven sign-in. Offline, use --offline (the cached snapshot) or --fixture. For CI, export the login into a KEDGEWAY_AUTH secret; it can go stale if Raven rotates refresh tokens.

Migration is narrow

kedgeway migrate prints a guide and bumps versions in manifests. It lists manual steps, points at up to 20 legacy import sites, and cites a Raven doc only when its title or url is a migration document. It does not rewrite source code and never runs cargo or npm.

Versions only

It measures SDK version drift. It does not audit contract logic, security or runtime behavior.

Scan limits

Four folders deep, with common build and dependency folders skipped. See What it scans.

Platforms

Developed and checked on macOS. The browser-opening code has a Windows branch, but Windows has not been verified.