Skip to content

1.7.0 - 2026-10-11

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 22:53
v1.7.0
815b7f8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes

Security

  • The npm installer verifies the binary it downloads. The published
    @vericto/vericto-cli package carries the SHA-256 of every platform archive,
    taken from the release's checksums, and its installer refuses an archive that
    does not match, or one it has no checksum for, before extracting anything.
    Downloads and their redirects must be https://. The package is published
    with npm provenance.
  • Credentials go only to an https:// API. The CLI refuses to send an API
    key, login code or OIDC token to an http:// API URL other than localhost
    (an Auth error, which --allow-degraded does not bypass), and follows
    redirects only within the same origin.
  • The stored API key stays owner-only. vericto login narrows an existing
    config.toml to 0600 before writing the key (the mode used to apply only to
    a new file), and creates the config directory as 0700.
  • Only ID-token-shaped values are read as OIDC tokens. The variable named by
    --oidc-token-env / .vericto.toml oidc_token_env is used only when its
    value has the shape of a JWT, so a committed config cannot make the CLI send
    another CI secret to the API.
  • Docker base images pinned by digest; every GitHub Action pinned by SHA, including
    release and publish; CI adds cargo-deny, cargo-audit and gitleaks; Dependabot
    for Cargo, GitHub Actions and npm.

Added

  • vericto rules simulate <file>: runs a candidate rule change (new or
    edited custom rules, standard rules enabled, disabled or re-severitied)
    against up to 30 days of the workspace's recorded production traffic, waits
    for the result and prints the report: the headline ("Would have blocked 2
    legitimate flows (9,442 executions)"), newly blocked / flagged / no longer
    blocked flows with identities and masked samples, and engine drift apart.
    Exit 1 when legitimate flows would break (--fail-on-break, default 0; with
    --strict, also Inconclusive). Needs an API key with the rules:simulate
    scope (Builder or above). --format json prints the API response.

Install vericto-cli 1.7.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/vericto/vericto-cli/releases/download/v1.7.0/vericto-cli-installer.sh | sh

Install prebuilt binaries into your npm project

npm install @vericto/vericto-cli@1.7.0

Download vericto-cli 1.7.0

File Platform Checksum
vericto-cli-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
vericto-cli-x86_64-apple-darwin.tar.xz Intel macOS checksum
vericto-cli-x86_64-pc-windows-msvc.zip x64 Windows checksum
vericto-cli-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
vericto-cli-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo vericto/vericto-cli

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
Assets 18
Loading