@codacy/verity-cli 0.34.2 → 0.34.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +42 -0
- package/bin/verity.js +1001 -620
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -64,6 +64,48 @@ installs are untouched.
|
|
|
64
64
|
which is the ordinary case for someone whose first Verity install *is* the
|
|
65
65
|
plugin.
|
|
66
66
|
|
|
67
|
+
## [0.34.4] — 2026-10-26
|
|
68
|
+
|
|
69
|
+
**A formal finding is checked before it blocks a push, and formal looks for security bugs.**
|
|
70
|
+
|
|
71
|
+
### 🛡️ Formal verification
|
|
72
|
+
|
|
73
|
+
- **A reproduced counterexample is checked before it blocks.** A replay proves
|
|
74
|
+
that a failing order runs against stubs of your code. It does not prove that
|
|
75
|
+
the order can happen in production. Verity now investigates each reproduced
|
|
76
|
+
counterexample with the read-only tools of the agent review. It follows the
|
|
77
|
+
code to its entry point and looks for what prevents the order: a lock, a
|
|
78
|
+
unique constraint, a transaction, an idempotency key. Two independent checks
|
|
79
|
+
run, and the more cautious answer governs. A finding is lowered only when
|
|
80
|
+
every quote of the check appears in your code: PREVENTED and ARTIFACT show as
|
|
81
|
+
checked and never block, and REAL-LOW is reported without blocking. A check
|
|
82
|
+
that does not finish leaves the finding as it was.
|
|
83
|
+
`VERITY_FORMAL_VERIFY=off` turns the check off.
|
|
84
|
+
- **Formal looks for security bugs.** The ranker gives each target a lens
|
|
85
|
+
(security or reliability) and up to three concrete hypotheses. A security
|
|
86
|
+
target is modelled from the attacker's side: isolation between tenants,
|
|
87
|
+
revocation, flow binding, event order, and check-then-use.
|
|
88
|
+
- **Generation sees the push.** The lines that your push changed are marked in
|
|
89
|
+
the code that formal models, so it looks first for a bug that the change made.
|
|
90
|
+
|
|
91
|
+
## [0.34.3] — 2026-10-21
|
|
92
|
+
|
|
93
|
+
**`verity usage` shows the reviews of each member of your org.**
|
|
94
|
+
|
|
95
|
+
### ✨ New
|
|
96
|
+
|
|
97
|
+
- **`verity usage`** shows how many reviews you made in the current 6-hour
|
|
98
|
+
session and this week. Commit and push reviews are counted apart from turn
|
|
99
|
+
reviews. You also see your busiest session, how many commits or pushes were
|
|
100
|
+
blocked, and how long a commit or push review took (p50 and p90). It shows
|
|
101
|
+
the team total too. An admin of the org (admin on one of its repositories)
|
|
102
|
+
sees every member. When your org has a plan, each session count shows your
|
|
103
|
+
limit, for example `12 / 60`. On Pro and Fleet the weekly limit belongs to
|
|
104
|
+
the team: the week shows against the team's pool, for example
|
|
105
|
+
`92 / 1,200` for 4 members on Pro. The limits are for information: they are
|
|
106
|
+
not enforced before Nov 2. Use `--org <name>` outside a repository, and
|
|
107
|
+
`--json` for scripts. The dashboard shows the same numbers on the Seats page.
|
|
108
|
+
|
|
67
109
|
## [0.34.2] — 2026-10-12
|
|
68
110
|
|
|
69
111
|
**Commands you type keep their Claude Code session, and the version warning
|