1.5.0 - 2026-10-03

Release Notes

Changed

• Per-statement results. Against a backend that advertises the
  check_files capability (GET /ci/config), check and baseline send each
  input as a whole file and the backend reports every statement with its
  real line. Previously a file was evaluated as a single unit, so only its most
  severe finding was reported and every annotation pointed at line 1. Now:

  • text output and the failure summary show path:line;
  • SARIF region.startLine, GitLab Code Quality lines.begin, GitLab SAST
    start_line and GitHub ::error annotations use the statement's line;
  • --format json adds file_index to each result (line is then the
    statement's line in that file).

  A file still costs one check from the monthly allowance, whatever its
  statement count. Against an older backend the CLI keeps the previous request
  shape and output, unchanged.

  If you use a baseline: fingerprints (rule, file, AST path) are unchanged,
  so existing entries keep matching. Findings that were previously hidden behind
  a file's most severe one can now surface as new; re-run vericto baseline to
  accept them, or fix them.

Fixed

• vericto init templates pointed at an image that does not exist. The
  GitLab and Docker templates used ghcr.io/donkan168/vericto-cli; the image is
  published as ghcr.io/vericto/vericto-cli. The installer URL in the GitHub
  workflow and the pre-commit hook now use the vericto org too.
• One suppression no longer covers every look-alike finding. Suppression was
  keyed on the finding's fingerprint (rule, file, AST path), so a single
  baseline entry or inline ignore also silenced every other finding with that
  fingerprint — e.g. baselining one DELETE without WHERE let any later one
  in the same file pass. Suppression is now decided per result.
• Per-statement baselines (format v2). With a backend that returns
  statement_hash, vericto baseline keys each entry on the statement's text
  as well (re-indenting a statement keeps its entry; changing its SQL does
  not), and records the line for reviewers. v1 baselines are still matched as
  before, with a note recommending vericto baseline to upgrade.
• Inline ignores apply to their statement. In per-statement mode,
  -- vericto:ignore[RULE] reason covers the statement it sits on or directly
  above — not every statement in the file, as the failure hint already
  described. Results that cover a whole file keep the file-wide behaviour.
• baseline and baseline prune honor sanitized mode. They skipped the
  GET /ci/config preflight and sent raw SQL even when the workspace requires
  literals to be normalized client-side; they now sanitize exactly like check
  (which also keeps baseline keys consistent with the SQL check sends).

Install vericto-cli 1.5.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/vericto/vericto-cli/releases/download/v1.5.0/vericto-cli-installer.sh | sh

Install prebuilt binaries into your npm project

npm install @vericto/vericto-cli@1.5.0

Download vericto-cli 1.5.0

File	Platform	Checksum
vericto-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
vericto-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
vericto-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
vericto-cli-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
vericto-cli-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum