Veritas Kanban 6.1.4 is a focused security release that prevents repository publication from escaping the managed task worktree and its captured Git state. It also updates fast-uri to the patched 3.1.6 release. There are no API or database schema changes.
What changed
Pull-request publication now accepts only canonical Git branch names and requires durable authority for the exact task, managed worktree, repository, origin, branch, base, and captured commit. Pushes use the captured commit through an isolated Git transport, and pull-request lookup, creation, and readback stay bound to the configured repository.
Publication fails closed when the managed-worktree evidence is absent, stale, or mismatched. Existing valid hierarchical branch names remain supported, and existing remote task branches may advance only by safe fast-forward.
The existing fast-uri override now resolves to 3.1.6, which clears the high-severity production dependency audit threshold.
Install or upgrade
Back up the complete stopped-writer workspace before upgrading and retain the backup until the new runtime is accepted.
brew update
brew upgrade --cask bradgroux/tap/veritas-kanbanFor a first installation:
brew install --cask bradgroux/tap/veritas-kanbanThe Assets section provides signed and notarized macOS arm64 DMG and ZIP packages after the release workflow completes. Linux and Windows packages remain unsigned verification previews.
Compatibility and rollback
The public REST API remains v1, and this release adds no database migration. Valid 6.1.3 workspaces remain compatible. Roll back by reinstalling the previous complete application bundle; do not mix package or bundled runtime versions.
See the changelog for the concise change record.