1.5.2 - 2026-10-04

Release Notes

Security

• rustls 0.23.41 → 0.23.45 (RUSTSEC-2026-0285) and h2 0.4.15 → 0.4.19
  (RUSTSEC-2026-0258). rustls accepted TLS 1.3 handshake messages across
  encryption-level boundaries; h2 did not bound empty DATA frames. The CLI is a
  client that only talks to the Vericto API, so the exposure was low, but every
  HTTPS call goes through both crates. chacha20 0.10.1, a yanked version, is
  also updated. Dependency-only release: no behaviour change; cargo audit
  reports no vulnerabilities and no warnings.

Documentation

• Verifying attestations: the README now downloads the artifact before
  gh attestation verify, which checks a local file and failed with
  "no such file or directory" when run as written.

Install vericto-cli 1.5.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/vericto/vericto-cli/releases/download/v1.5.2/vericto-cli-installer.sh | sh

Install prebuilt binaries into your npm project

npm install @vericto/vericto-cli@1.5.2

Download vericto-cli 1.5.2

File	Platform	Checksum
vericto-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
vericto-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
vericto-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
vericto-cli-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
vericto-cli-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo vericto/vericto-cli

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>