What shipped, version by version.

0.8.0 — 2026-07-20

Changed

• Attestations are now standard DSSE / in-toto envelopes (schema veriskit/attestation@2), so a veris attest result is verifiable by cosign and the wider supply-chain ecosystem — not just VerisKit's own verifier. Signing moves behind a pluggable backend; the built-in ed25519 backend (zero-dependency, VERISKIT_SIGNING_KEY/--key) signs the DSSE payload directly. veris gate verifies @2 attestations and still reads legacy @1 ones. Keyless signing via cosign (Fulcio + Rekor transparency log) is coming next — the format and signing interface are now in place for it.

Security

• Hardened the attestation reader against a parser-differential: the @1/@2 format is decided strictly by the schema field, and the same statement that a signature covers is the one used for the verdict/subject/coverage — a crafted attestation can no longer have its signature checked over one payload while its verdict is read from another.

0.7.2 — 2026-07-20

Added

• Programmatic attestProject(root, opts) and gateProject(root, opts) in the library API, so attestation and gating can be driven without the CLI (the veris attest/veris gate commands now wrap them). Attestation and policy types are exported too.

Fixed

• veris attest no longer refuses just because a previous attestation file is sitting untracked under .veris/attestations/ — the dirty-tree check now shares gate's exemption for that directory (a real source change still blocks it), so you can attest repeatedly without committing in between.
• veris attest now refuses when the latest verification's evidence is for a different commit than HEAD (stale evidence), telling you to re-run veris verify instead of producing an attestation that would fail the gate anyway.

0.7.1 — 2026-07-20

Changed

• Skip/fail reasons in a verdict are now language-qualified (for example unit (python) skipped …) when a run spans more than one language, matching the per-check display. Single-language (including JavaScript-only) runs are unchanged.

Fixed

• pylint is now run with --recursive=y so it lints the whole project tree, not just the top level.
• Python/Go tool detection now requires an actual executable file: a non-executable file — or a directory — that happens to share a tool's name no longer counts as "installed."

0.7.0 — 2026-07-20

Added

• Polyglot verification. veris now detects Python (pyproject.toml/setup.py/setup.cfg/requirements.txt) and Go (go.mod) alongside JavaScript/TypeScript, runs each language's own tools — pytest, mypy/pyright, ruff/flake8/pylint for Python; go test, go build, golangci-lint/go vet for Go — and merges everything into one verdict and one evidence record. Tool choice is presence-first with a preference order, overridable in .veris/config.json (languages to enable/disable a language, tools to force a specific tool per capability). doctor shows the language of each capability, and the verification report qualifies each check with its language when a run spans more than one. JavaScript-only projects are unaffected.
• Provable verification. veris attest packages the latest veris verify into a portable, Ed25519-signed in-toto attestation of the exact commit; veris gate blocks unless a valid attestation meets .veris/policy.json (integrity of the record, freshness against HEAD with a clean tree, the required verdict, required capabilities×languages, and — when require.signers is set — a trusted signer). Without require.signers a gate is integrity-only and does not establish authorship; set signers and sign (VERISKIT_SIGNING_KEY/--key) for a real trust gate. No new dependencies. Keyless/Sigstore signing is planned.

0.6.1 — 2026-07-17

Changed

• Evidence check ids are now namespaced by language (for example unit:js instead of unit), and per-check log files are renamed to match (unit-js.log). This is the groundwork for polyglot verification — running each language's own test tools under one verdict. Terminal output and exit codes are unchanged.

0.6.0 — 2026-07-14

Added

• veriskit-mcp, a Model Context Protocol server exposing VerisKit over stdio with seven tools (doctor, scan, plan, log, evidence_verify, verify, affected), publishable to the MCP registry. The veriskit CLI keeps its two runtime dependencies; the MCP SDK lives only in veriskit-mcp.
• veriskit now has a programmatic API (verifyProject, affectedProject, and the core detect/graph/history/evidence functions), so it can be used as a library.

0.5.1 — 2026-07-13

Changed

• --github publish errors now include GitHub's own message (for example "Resource not accessible by integration" when the workflow token lacks pull-requests: write or checks: write), so a failed publish is diagnosable. The token still never appears in any error.
• homepage now points to the VerisKit product page.

0.5.0 — 2026-07-13

Added

• Publish to GitHub. veris verify --github posts and updates one sticky PR comment with the verdict and report, and creates a Check Run (verified passes, failed fails, partial is neutral). Token read from GITHUB_TOKEN; publishing never changes the verdict or exit code. veris badge writes a shields.io endpoint JSON. GitHub API over built-in fetch, no new dependency.
• Browser tests. A real Playwright runner, opt-in with veris verify --browser (or a browser entry in .veris/config.json). Detected Playwright now shows as an available capability.
• veris log lists past runs from the stored evidence records, and veris log --flaky flags checks that both passed and failed across recent runs. Local per-machine history.

0.4.1 — 2026-07-10

Added

• Signed evidence. veris evidence keygen creates an Ed25519 keypair (via Node's built-in crypto, no new dependency); veris evidence sign <evidence.json> writes a detached signature; veris evidence verify checks a sibling signature automatically and can assert the signer with --pubkey or --key-id. Bundles carry the signature. Signing is opt-in; unsigned evidence still verifies for integrity. VERISKIT_SIGNING_KEY supplies the key in CI.

Changed

• veris init now gitignores keys/.

0.4.0 — 2026-07-10

Added

• Evidence System. Every veris verify and veris affected run writes a canonical, git-anchored .veris/runs/<id>/evidence.json (schema veriskit/evidence@1) with a sha256 integrity digest over the whole record and a sha256 of each per-check log. No new runtime dependencies.
• veris evidence verify <file> recomputes and checks a record or a bundle, and states plainly what an integrity digest does and does not prove.
• veris evidence bundle packages the latest run (record, report, and logs, each digested) into one portable proof file under .veris/evidence/.
• veris evidence show prints the latest record's key facts.

Changed

• The report and terminal output now show the git commit and whether the tree was clean, plus the evidence digest in the report.
• evidence.json replaces the older metadata.json. veris init now also gitignores evidence/.

Show 3 older releases

0.3.0 — 2026-07-10

Added

• veris scan — import-graph map + untested areas, built from the project's own TypeScript (with a dep-free scanner fallback); writes .veris/graph.json.
• veris plan — prioritized recommendations (high-impact untested files, weak verification, risky changes). Analysis only — no code generation.

Changed

• veris affected / veris watch are now graph-based: the unit run is narrowed to only the test files that transitively import your changes, with a conservative full-suite fallback (config/global change, unresolved file, or untested change) so an affected test is never skipped. No new runtime dependencies.

0.2.0 — 2026-07-09

Added

• veris affected — run only the checks relevant to changed files (coarse: no import graph yet). --base <ref> for PR/CI diffs.
• veris watch — re-run affected checks as files change, using native fs.watch (no new dependency) with a --poll fallback and cross-tick cached results.
• Honest scoped verdicts: affected/watch runs never report a bare "Verified"; unaffected capabilities are shown as "not affected by changes".

Changed

• Extracted the runner base (Runner/RunContext/localBin/runViaExec) into src/runners/base.ts to eliminate an adapter import cycle.

0.1.0 — 2026-07-08

Added

• veris init, doctor, test, verify, report.
• Zero-config detection: package manager, TypeScript, Vitest, Jest, node:test, ESLint, Biome, Playwright (detected, not run).
• Parallel check orchestration with a three-state verdict (verified / failed / partial).
• Local evidence store under .veris/ and Markdown verification reports.
• CI-correct exit codes (0 verified, 1 failed, 2 partial; --partial-ok overrides).