> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qlty.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Upgrading the CLI

Most of the time, upgrading is one command. When a Qlty security advisory asks you to upgrade, take the more careful steps in [Upgrading after a security advisory](#upgrading-after-a-security-advisory).

## Upgrade

```shell macOS & Linux lines theme={"system"}
qlty upgrade
```

```shell Homebrew lines theme={"system"}
brew upgrade qlty
```

```shell Windows lines theme={"system"}
qlty upgrade
```

Then confirm which `qlty` runs, and its version:

```shell lines theme={"system"}
command -v qlty && qlty --version
```

On Windows, run `qlty upgrade` from Command Prompt or Windows PowerShell, not PowerShell 7 (`pwsh`). From `pwsh`, releases up to v0.662.0 report success but keep the old version.

The VS Code extension runs this upgrade each time it starts, unless `qlty.autoUpdateCli` is `false`.

## Upgrading after a security advisory

[Qlty security advisories](https://github.com/qltysh/qlty/security/advisories) name the first release that fixes each problem. Some problems affect the upgrade itself. `qlty upgrade`, the install script, and Homebrew download the new release with your machine's own tools: `curl`, `wget`, `git`, or PowerShell. Those tools trust your operating system's certificate store, so a flaw there can let an attacker swap the download.

If the advisory gives steps for your platform, follow them. They take precedence over this page. Otherwise:

1. **Pause automatic upgrades.** In VS Code, set `qlty.autoUpdateCli` to `false`, so the extension does not upgrade before you finish.
2. **Update your operating system.** On macOS and Windows, install the latest OS updates. On Linux, update the certificate package, for example `sudo apt-get update && sudo apt-get install -y ca-certificates` on Debian and Ubuntu.
3. **Upgrade with verification.** From v0.662.0 on macOS and Linux, run `qlty upgrade --verify-attestations`. It installs the release only after it confirms Qlty's release pipeline built it, and needs the GitHub CLI (`gh`) 2.67.0 or later, signed in. On Windows, or on an older CLI, download and verify the release by hand with [Integrity Verification](https://docs.qlty.sh/cli/integrity-verification.md). That check does not depend on your certificate store.
4. **Confirm the version.** Run `command -v qlty && qlty --version` and compare it with the fixed release in the advisory.
5. **Check plugin runtimes.** If the advisory names a plugin runtime, run `qlty config show` and look under `runtimes:`. See [Plugin runtimes](#plugin-runtimes) below.
6. **Turn automatic upgrades back on.**

## Plugin runtimes

A new release can update the Node, Python, and Java the CLI downloads to run plugins. The CLI reinstalls plugins on the new runtime the next time they run.

A version set under `[runtimes.enabled]` keeps that runtime on the version you set, whatever the CLI release. A plugin source can set it too. To see the version in effect, run `qlty config show` and look under `runtimes:`. If the section shows `enabled: {}`, the CLI uses its own versions. See [Runtimes](https://docs.qlty.sh/cli/concepts/runtimes.md).

## CI

* **GitHub Actions:** `qltysh/qlty-action` installs the CLI and verifies it. `@v2` picks up new action releases.
* **Install script:** `curl https://qlty.sh | sh` installs the latest release, or the version in `QLTY_VERSION`. After a security advisory, update the certificate package in the job or image first.
* **Docker layers:** if a Dockerfile installs the CLI in a cached layer, change the version or build with `--no-cache` so the layer runs again.

See [Continuous Integration](https://docs.qlty.sh/cli/ci.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.