1.7.2 - 2026-10-14

Release Notes

Security

• rustls 0.23.45 → 0.23.46 for RUSTSEC-2026-0346 (Debug output of client
  session values exposes TLS secrets), RUSTSEC-2026-0347 (buffered data sent to
  the outer server after an ECH rejection), RUSTSEC-2026-0348 (Brotli
  certificate decompression can allocate up to 1 GiB before authentication)
  and RUSTSEC-2026-0349 (an unauthenticated ServerHello can downgrade later
  connections to classical key exchange). rustls is the TLS stack of the CLI's
  requests to the Vericto API.
• quinn-proto 0.11.16 → 0.11.18 (merged after 1.7.1) for RUSTSEC-2026-0338
  to RUSTSEC-2026-0343 (panics and memory-exhaustion guards in the QUIC
  implementation).

Lockfile only: no code or behaviour changes.

Install vericto-cli 1.7.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/vericto/vericto-cli/releases/download/v1.7.2/vericto-cli-installer.sh | sh

Install prebuilt binaries into your npm project

npm install @vericto/vericto-cli@1.7.2

Download vericto-cli 1.7.2

File	Platform	Checksum
vericto-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
vericto-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
vericto-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
vericto-cli-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
vericto-cli-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo vericto/vericto-cli

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>