Skip to main content
Most of the time, upgrading is one command. When a Qlty security advisory asks you to upgrade, take the more careful steps in Upgrading after a security advisory.

​
Upgrade

Then confirm which qlty runs, and its version:
On Windows, run qlty upgrade from Command Prompt or Windows PowerShell, not PowerShell 7 (pwsh). From pwsh, releases up to v0.662.0 report success but keep the old version. The VS Code extension runs this upgrade each time it starts, unless qlty.autoUpdateCli is false.

​
Upgrading after a security advisory

Qlty security advisories name the first release that fixes each problem. Some problems affect the upgrade itself. qlty upgrade, the install script, and Homebrew download the new release with your machine’s own tools: curl, wget, git, or PowerShell. Those tools trust your operating system’s certificate store, so a flaw there can let an attacker swap the download. If the advisory gives steps for your platform, follow them. They take precedence over this page. Otherwise:
  1. Pause automatic upgrades. In VS Code, set qlty.autoUpdateCli to false, so the extension does not upgrade before you finish.
  2. Update your operating system. On macOS and Windows, install the latest OS updates. On Linux, update the certificate package, for example sudo apt-get update && sudo apt-get install -y ca-certificates on Debian and Ubuntu.
  3. Upgrade with verification. From v0.662.0 on macOS and Linux, run qlty upgrade --verify-attestations. It installs the release only after it confirms Qlty’s release pipeline built it, and needs the GitHub CLI (gh) 2.67.0 or later, signed in. On Windows, or on an older CLI, download and verify the release by hand with Integrity Verification. That check does not depend on your certificate store.
  4. Confirm the version. Run command -v qlty && qlty --version and compare it with the fixed release in the advisory.
  5. Check plugin runtimes. If the advisory names a plugin runtime, run qlty config show and look under runtimes:. See Plugin runtimes below.
  6. Turn automatic upgrades back on.

​
Plugin runtimes

A new release can update the Node, Python, and Java the CLI downloads to run plugins. The CLI reinstalls plugins on the new runtime the next time they run. A version set under [runtimes.enabled] keeps that runtime on the version you set, whatever the CLI release. A plugin source can set it too. To see the version in effect, run qlty config show and look under runtimes:. If the section shows enabled: {}, the CLI uses its own versions. See Runtimes.

​
CI

  • GitHub Actions: qltysh/qlty-action installs the CLI and verifies it. @v2 picks up new action releases.
  • Install script: curl https://qlty.sh | sh installs the latest release, or the version in QLTY_VERSION. After a security advisory, update the certificate package in the job or image first.
  • Docker layers: if a Dockerfile installs the CLI in a cached layer, change the version or build with --no-cache so the layer runs again.
See Continuous Integration.