Am I affected by nono-cli registry pack verification can fail open when provenance metadata is absent? What should I do?
nono-cli's registry pack verification can fail open when provenance metadata is absent.
Affected: nono-cli <= 0.61.2. Fixed in: 0.61.3. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/ghsa-hc4m-q9jh-xw4j-nono-cli (opens external site)
1 answer
Am I affected? Affected: nono-cli <= 0.61.2. Fixed in: 0.61.3.
- Check your version: run
cargo tree -i nono-cli. Versions <= 0.61.2 of nono-cli are affected.
What to do now
- Upgrade to the fixed version: run
cargo update -p nono-cli --precise 0.61.3(first patched version 0.61.3). - Reinstall with: nono pull / --force
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-hc4m-q9jh-xw4j (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/07/ghsa-hc4m-q9jh-xw4j-nono-cli (opens external site)
Did this work for you?- Check your version: run