Skip to content

1.6.0 - 2026-10-08

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 17:09
v1.6.0
fde42e3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes

Minor rather than patch: a new flag (--allow-unsanitized) and two exit-code
changes a CI script may depend on (a failed config read exits 4 without sending
SQL; an exhausted allowance exits 3).

Security

  • Fail closed when the workspace config can't be read. If GET /ci/config
    failed, check, baseline and baseline prune sent the SQL unsanitized,
    even in a workspace that requires sanitized mode. They now send nothing and
    exit 4; --allow-unsanitized (VERICTO_ALLOW_UNSANITIZED) opts out.
  • Sanitization handles backslash escapes. In MySQL and in Postgres
    E'...' strings, \' doesn't end a literal; the sanitizer treated it as
    the end, and the rest of the literal was sent verbatim.

Fixed

  • An exhausted monthly allowance exits 3, as the exit-code table says
    ("plan not entitled"), instead of being retried as a rate limit and
    exiting 4.
  • The pre-commit hook checks the staged content (git show :path), not
    the working-tree file, and handles paths with spaces.

Documentation

  • The README said the receipt-signing public key is bundled; none is yet, so
    verify-receipt needs --public-key (from
    GET /api/v1/meta/export-signing-key).

Install vericto-cli 1.6.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/vericto/vericto-cli/releases/download/v1.6.0/vericto-cli-installer.sh | sh

Install prebuilt binaries into your npm project

npm install @vericto/vericto-cli@1.6.0

Download vericto-cli 1.6.0

File Platform Checksum
vericto-cli-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
vericto-cli-x86_64-apple-darwin.tar.xz Intel macOS checksum
vericto-cli-x86_64-pc-windows-msvc.zip x64 Windows checksum
vericto-cli-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
vericto-cli-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo vericto/vericto-cli

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
Assets 18
Loading