Version flag outputs version string
Why it matters
Automation scripts, CI pipelines, and package managers all query --version to verify which release is installed before running. Without a working version flag, a script cannot confirm it's using the correct build, which leads to silent version mismatches in production. A hardcoded version string that drifts from package.json (or pyproject.toml / Cargo.toml) compounds the problem: tools report a version they are not. ISO 25010:2011 usability.learnability directly penalizes discoverable interfaces that omit this basic contract.
Severity rationale
High because a missing or stale `--version` flag breaks automated upgrade checks and CI gating, causing silent version drift in production.
Remediation
Wire the version flag directly to your package manifest so it can never drift. In commander, read from package.json at startup:
import { readFileSync } from 'fs'
const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
program.version(pkg.version, '-v, --version')
In click, pull from importlib.metadata:
from importlib.metadata import version
@click.group()
@click.version_option(version=version('my-tool'))
def cli(): pass
In cobra, set the version at build time via ldflags so it never needs a runtime read:
var rootCmd = &cobra.Command{Version: version}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the CLI Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · usability.learnability — Usability — Learnability
Taxons
History
- 2026-04-18·v1.0.0·Initial import from cli-quality·automated