Skip to content

Handle impostor commits in auto-update#1919

Merged
j178 merged 2 commits into
masterfrom
auto-update-impostor-checks
Apr 11, 2026
Merged

Handle impostor commits in auto-update#1919
j178 merged 2 commits into
masterfrom
auto-update-impostor-checks

Conversation

@j178

@j178 j178 commented Apr 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Detect pinned commits without lazy fetching during auto-update.

  • check commit presence with git --no-lazy-fetch cat-file -e
  • avoid treating branch-only or GitHub impostor commits as present

Closes #1864

Copilot AI review requested due to automatic review settings April 9, 2026 09:46
@codecov

codecov Bot commented Apr 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 93.75000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.07%. Comparing base (f2cc974) to head (e9ef05f).
⚠️ Report is 3 commits behind head on master.

Files with missing lines Patch % Lines
crates/prek/src/cli/auto_update.rs 93.75% 4 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #1919      +/-   ##
==========================================
- Coverage   92.09%   92.07%   -0.02%     
==========================================
  Files         112      112              
  Lines       22913    22936      +23     
==========================================
+ Hits        21101    21119      +18     
- Misses       1812     1817       +5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Apr 9, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e57b84a550

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/prek/src/cli/auto_update.rs
Copilot AI reviewed Apr 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Improves prek auto-update’s handling of pinned commit SHAs by detecting whether the commit is actually present in the locally fetched (partial) repository view, preventing “impostor”/branch-only commits from being treated as available during auto-update evaluation.

Changes:

  • Add a commit-presence check using git --no-lazy-fetch cat-file -e to avoid partial-clone lazy fetching during auto-update diagnostics.
  • Adjust frozen-comment mismatch diagnostics to reflect “present vs not present” semantics and remove dry-run-specific phrasing from warning notes.
  • Update and extend integration tests/snapshots, including a new branch-only pinned commit case.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
crates/prek/src/cli/auto_update.rs Implements commit presence detection without lazy fetching and updates frozen-comment warning rendering.
crates/prek/tests/auto_update.rs Updates snapshots for new warning text and adds coverage for branch-only pinned commits.

@prek-ci-bot

prek-ci-bot Bot commented Apr 9, 2026 •
edited
Loading

Copy link
Copy Markdown

📦 Cargo Bloat Comparison

Binary size change: +0.00% (25.7 MiB → 25.7 MiB)

Expand for cargo-bloat output

Head Branch Results

 File  .text     Size             Crate Name
 1.3%   2.6% 332.0KiB        aws_lc_sys aws_lc_0_39_1_aes_gcm_encrypt_avx512
 1.3%   2.6% 332.0KiB        aws_lc_sys aws_lc_0_39_1_aes_gcm_decrypt_avx512
 0.3%   0.7%  88.1KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.3%   0.7%  84.1KiB             prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.3%   0.6%  81.3KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.4%  57.0KiB              prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.2%   0.4%  52.5KiB annotate_snippets annotate_snippets::renderer::render::render
 0.2%   0.4%  45.3KiB              prek prek::run::{{closure}}
 0.2%   0.3%  41.9KiB              prek prek::cli::run::run::run::{{closure}}
 0.1%   0.3%  32.4KiB             prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.2%  30.0KiB             prek? <prek::config::_::<impl serde_core::de::Deserialize for prek::config::Config>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2%  28.0KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_39_1_edwards25519_scalarmuldouble_alt
 0.1%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_39_1_edwards25519_scalarmuldouble
 0.1%   0.2%  27.0KiB              prek prek::cli::try_repo::try_repo::{{closure}}
 0.1%   0.2%  26.8KiB               std core::ptr::drop_in_place<prek::languages::<impl prek::config::Language>::install::{{closure}}>
 0.1%   0.2%  22.8KiB              prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2%  22.6KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2%  22.3KiB         [Unknown] Lp384_montjscalarmul_alt_p384_montjadd
 0.1%   0.2%  21.5KiB      clap_builder clap_builder::parser::parser::Parser::get_matches_with
41.8%  86.2%  10.7MiB                   And 24053 smaller methods. Use -n N to show more.
48.5% 100.0%  12.5MiB                   .text section size, the file size is 25.7MiB

Base Branch Results

 File  .text     Size             Crate Name
 1.3%   2.6% 332.0KiB        aws_lc_sys aws_lc_0_39_1_aes_gcm_encrypt_avx512
 1.3%   2.6% 332.0KiB        aws_lc_sys aws_lc_0_39_1_aes_gcm_decrypt_avx512
 0.3%   0.7%  87.6KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.3%   0.6%  81.3KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.3%   0.6%  70.9KiB             prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.2%   0.4%  57.0KiB              prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.2%   0.4%  52.5KiB annotate_snippets annotate_snippets::renderer::render::render
 0.2%   0.4%  45.3KiB              prek prek::run::{{closure}}
 0.2%   0.3%  42.0KiB              prek prek::cli::run::run::run::{{closure}}
 0.1%   0.3%  32.6KiB             prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.2%  30.0KiB             prek? <prek::config::_::<impl serde_core::de::Deserialize for prek::config::Config>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2%  28.0KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_39_1_edwards25519_scalarmuldouble_alt
 0.1%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_39_1_edwards25519_scalarmuldouble
 0.1%   0.2%  27.1KiB              prek prek::cli::try_repo::try_repo::{{closure}}
 0.1%   0.2%  26.8KiB               std core::ptr::drop_in_place<prek::languages::<impl prek::config::Language>::install::{{closure}}>
 0.1%   0.2%  22.8KiB              prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2%  22.6KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2%  22.3KiB         [Unknown] Lp384_montjscalarmul_alt_p384_montjadd
 0.1%   0.2%  21.5KiB      clap_builder clap_builder::parser::parser::Parser::get_matches_with
41.9%  86.3%  10.8MiB                   And 24034 smaller methods. Use -n N to show more.
48.5% 100.0%  12.5MiB                   .text section size, the file size is 25.7MiB

@prek-ci-bot

prek-ci-bot Bot commented Apr 9, 2026 •
edited
Loading

Copy link
Copy Markdown

⚡️ Hyperfine Benchmarks

Summary: 0 regressions, 0 improvements above the 10% threshold.

Environment
  • OS: Linux 6.17.0-1010-azure
  • CPU: 4 cores
  • prek version: prek 0.3.8+43 (db762f4 2026-04-10)
  • Rust version: rustc 1.94.1 (e408947bf 2026-03-25)
  • Hyperfine version: hyperfine 1.20.0
CLI Commands

Benchmarking basic commands in the main repo:

prek --version

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base --version 2.2 ± 0.1 2.1 2.5 1.03 ± 0.05
prek-head --version 2.2 ± 0.1 2.0 2.4 1.00

prek list

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base list 9.1 ± 0.3 8.6 10.0 1.02 ± 0.05
prek-head list 9.0 ± 0.4 8.5 10.7 1.00

prek validate-config .pre-commit-config.yaml

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base validate-config .pre-commit-config.yaml 3.2 ± 0.1 3.0 3.4 1.07 ± 0.04
prek-head validate-config .pre-commit-config.yaml 3.0 ± 0.1 2.8 3.2 1.00

prek sample-config

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base sample-config 2.5 ± 0.1 2.4 2.6 1.03 ± 0.03
prek-head sample-config 2.5 ± 0.1 2.4 2.7 1.00
Cold vs Warm Runs

Comparing first run (cold) vs subsequent runs (warm cache):

prek run --all-files (cold - no cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --all-files 142.4 ± 5.3 137.4 153.6 1.01 ± 0.05
prek-head run --all-files 141.3 ± 3.8 135.2 146.1 1.00

prek run --all-files (warm - with cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --all-files 141.2 ± 3.5 135.7 146.6 1.00
prek-head run --all-files 143.2 ± 2.8 138.8 150.2 1.01 ± 0.03
Full Hook Suite

Running the builtin hook suite on the benchmark workspace:

prek run --all-files (full builtin hook suite)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --all-files 141.4 ± 3.4 133.3 148.1 1.01 ± 0.03
prek-head run --all-files 140.3 ± 3.4 133.1 147.4 1.00
Individual Hook Performance

Benchmarking each hook individually on the test repo:

prek run trailing-whitespace --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run trailing-whitespace --all-files 20.7 ± 0.8 19.7 22.9 1.00
prek-head run trailing-whitespace --all-files 21.0 ± 1.0 19.3 23.2 1.02 ± 0.06

prek run end-of-file-fixer --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run end-of-file-fixer --all-files 33.9 ± 20.9 23.8 109.7 1.28 ± 0.80
prek-head run end-of-file-fixer --all-files 26.4 ± 2.1 23.4 30.4 1.00

prek run check-json --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-json --all-files 11.6 ± 0.5 10.8 12.9 1.03 ± 0.05
prek-head run check-json --all-files 11.2 ± 0.3 10.7 11.9 1.00

prek run check-yaml --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-yaml --all-files 11.2 ± 0.5 10.7 13.5 1.02 ± 0.05
prek-head run check-yaml --all-files 11.0 ± 0.2 10.7 11.7 1.00

prek run check-toml --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-toml --all-files 11.3 ± 0.6 10.7 13.8 1.01 ± 0.06
prek-head run check-toml --all-files 11.1 ± 0.3 10.6 11.8 1.00

prek run check-xml --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-xml --all-files 11.6 ± 0.8 10.9 15.3 1.05 ± 0.07
prek-head run check-xml --all-files 11.0 ± 0.3 10.6 11.7 1.00

prek run detect-private-key --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run detect-private-key --all-files 17.4 ± 1.2 15.4 20.2 1.02 ± 0.10
prek-head run detect-private-key --all-files 17.2 ± 1.2 15.5 20.1 1.00

prek run fix-byte-order-marker --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run fix-byte-order-marker --all-files 22.5 ± 1.5 19.4 24.7 1.03 ± 0.10
prek-head run fix-byte-order-marker --all-files 21.9 ± 1.6 19.2 24.7 1.00
Installation Performance

Benchmarking hook installation (fast path hooks skip Python setup):

prek install-hooks (cold - no cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base install-hooks 4.5 ± 0.1 4.4 4.6 1.03 ± 0.02
prek-head install-hooks 4.4 ± 0.1 4.3 4.5 1.00

prek install-hooks (warm - with cache)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base install-hooks 4.6 ± 0.1 4.5 4.7 1.05 ± 0.02
prek-head install-hooks 4.4 ± 0.0 4.3 4.4 1.00
File Filtering/Scoping Performance

Testing different file selection modes:

prek run (staged files only)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run 49.0 ± 1.2 47.1 51.4 1.01 ± 0.04
prek-head run 48.7 ± 1.3 46.9 51.5 1.00

prek run --files '*.json' (specific file type)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --files '*.json' 8.3 ± 0.1 8.1 8.6 1.00
prek-head run --files '*.json' 8.3 ± 0.1 8.0 8.5 1.00 ± 0.02
Workspace Discovery & Initialization

Benchmarking hook discovery and initialization overhead:

prek run --dry-run --all-files (measures init overhead)

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run --dry-run --all-files 13.1 ± 0.5 12.7 14.4 1.02 ± 0.04
prek-head run --dry-run --all-files 12.9 ± 0.2 12.5 13.4 1.00
Meta Hooks Performance

Benchmarking meta hooks separately:

prek run check-hooks-apply --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-hooks-apply --all-files 13.1 ± 0.2 12.8 13.7 1.00
prek-head run check-hooks-apply --all-files 13.2 ± 0.2 12.8 13.4 1.00 ± 0.02

prek run check-useless-excludes --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run check-useless-excludes --all-files 12.8 ± 0.7 11.7 13.8 1.09 ± 0.06
prek-head run check-useless-excludes --all-files 11.8 ± 0.1 11.6 12.1 1.00

prek run identity --all-files

Command Mean [ms] Min [ms] Max [ms] Relative
prek-base run identity --all-files 10.4 ± 0.1 10.2 10.5 1.00
prek-head run identity --all-files 10.5 ± 0.2 10.1 10.9 1.02 ± 0.02

@j178 j178 added the bug Something isn't working label Apr 9, 2026
@shaanmajid

shaanmajid commented Apr 10, 2026

Copy link
Copy Markdown
Collaborator

Unsure of the performance impact of this, but just an idea -- it would be ideal if this check could automatically happen during hook installation. Most folks probably won't manually execute this to check if they have a malicious config file, but if it's surfaced during normal workflows, everyone will reap the benefit.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Apr 10, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9ef05f849

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/prek/src/cli/auto_update.rs
Comment on lines +793 to +796
if no_lazy_fetch_unsupported(&output.stderr) {
let _ = GIT_SUPPORTS_NO_LAZY_FETCH.set(false);
return Ok(CommitPresence::Unknown);
}

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve frozen-comment checks when no-lazy-fetch is unsupported

On Git versions like 2.43, git --no-lazy-fetch ... returns unknown option, and this branch forces CommitPresence::Unknown; that flows into collect_frozen_mismatches as FrozenMismatch::NoReplacement, so stale frozen comments for valid, untagged pinned SHAs are no longer removed and --check can pass even when the frozen marker is stale. I verified the command behavior locally on Git 2.43 and traced it to this return path, so this is not just theoretical compatibility drift.

Useful? React with 👍 / 👎.

@j178

j178 commented Apr 10, 2026

Copy link
Copy Markdown
Owner Author

@shaanmajid Good idea. I started with auto-update because the repo-fetching model there is quite different from installation.

During installation we currently use shallow clones (--depth=1), while auto-update uses a blob-less fetch. Detecting impostor commits reliably would likely require fetching a much larger commit graph, which would be a fairly invasive change to the installation path.

Adding the check in auto-update first is a more contained change, and it lets us validate the approach before expanding it further. If this works well, we can definitely explore bringing the same protection to installation later.

@j178 j178 merged commit 7899b90 into master Apr 11, 2026
55 of 56 checks passed
@j178 j178 deleted the auto-update-impostor-checks branch April 11, 2026 14:50
@BrewTestBot BrewTestBot mentioned this pull request Apr 13, 2026
Merged
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request May 8, 2026
build(deps): update prek to v0.3.13
c03b3be 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [prek](https://github.com/j178/prek) | patch | `0.3.1` → `0.3.13` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>j178/prek (prek)</summary>

### [`v0.3.13`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#0313)

[Compare Source](j178/prek@v0.3.12...v0.3.13)

Released on 2026-05-06.

##### Bug fixes

- Respect hook filters for message files ([#&#8203;2049](j178/prek#2049))

##### Documentation

- Add Godot Engine to users in README ([#&#8203;2047](j178/prek#2047))

##### Contributors

- [@&#8203;j178](https://github.com/j178)
- [@&#8203;Calinou](https://github.com/Calinou)

### [`v0.3.12`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#0312)

[Compare Source](j178/prek@v0.3.11...v0.3.12)

Released on 2026-05-05.

##### Highlights

`auto_update.cooldown_days` is now available in both the user-level global
config (`~/.config/prek/prek.toml` on Linux and macOS, or
`$XDG_CONFIG_HOME/prek/prek.toml` when set; `%APPDATA%\prek\prek.toml` on
Windows) and project config. Set a user default for `prek auto-update`, then
override it per project when a repository needs a different update cadence.

```toml
[auto_update]
cooldown_days = 7
```

##### Enhancements

- Add global auto-update cooldown config ([#&#8203;2041](j178/prek#2041))
- Add project auto-update cooldown config ([#&#8203;2044](j178/prek#2044))
- Support `language: dart` ([#&#8203;1146](j178/prek#1146))

##### Bug fixes

- Pass commit message file to workspace hooks ([#&#8203;2043](j178/prek#2043))
- Preserve non-UTF8 filenames from git ([#&#8203;2023](j178/prek#2023))
- ruby: put resolved Ruby's bin dir on `$PATH` for `gem` invocations ([#&#8203;2021](j178/prek#2021))

##### Documentation

- Update docs with the new logo and icon ([#&#8203;2025](j178/prek#2025))
- Point schema docs to SchemaStore ([#&#8203;2039](j178/prek#2039))

##### Contributors

- [@&#8203;j178](https://github.com/j178)
- [@&#8203;xiaoyanli-lyft](https://github.com/xiaoyanli-lyft)
- [@&#8203;Lutra-Fs](https://github.com/Lutra-Fs)

### [`v0.3.11`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#0311)

[Compare Source](j178/prek@v0.3.10...v0.3.11)

Released on 2026-04-27.

##### Highlights

Hook entries now have an explicit `shell` option for shell snippets. Set
`shell: sh`, `bash`, `pwsh`, `powershell`, or `cmd` when an entry should be
evaluated by that shell; leaving it unset keeps prek's direct argv execution.

`prek auto-update` can now filter tag candidates before choosing an update.
Both options take glob patterns: use `--include-tag` to only consider matching
tag names, and `--exclude-tag` to skip matching tags such as moving tags or
prereleases.

##### Enhancements

- Add `auto-update --exclude-repo <repo>` to skip repos ([#&#8203;1983](j178/prek#1983))
- Add `auto-update --exit-code` to exit with non-zero on updates ([#&#8203;2002](j178/prek#2002))
- Add `auto-update --include-tag <pattern>`/`--exclude-tag <pattern>` to filter tags ([#&#8203;1984](j178/prek#1984))
- Adds an explicit `shell` hook option for entries that should run as shell source ([#&#8203;2004](j178/prek#2004))
- Make `--hook-dir` optional for hook-impl ([#&#8203;1989](j178/prek#1989))
- Skip shim warning when `--script-version` is missing ([#&#8203;1990](j178/prek#1990))

##### Bug fixes

- Install Ruby executable in gem bin ([#&#8203;2017](j178/prek#2017))
- Use dedicated Android npm package ([#&#8203;1982](j178/prek#1982))
- Use stable repo keys without breaking cached clones ([#&#8203;1995](j178/prek#1995))

##### Documentation

- Explain prek name ([#&#8203;1980](j178/prek#1980))
- Clarify `pass_filenames` concurrency docs ([#&#8203;1999](j178/prek#1999))
- Reorganize documentation references ([#&#8203;2005](j178/prek#2005))
- Clarify hook author manifest env docs ([#&#8203;1991](j178/prek#1991))
- docs: add Sentry to users list ([#&#8203;1981](j178/prek#1981))

##### Contributors

- [@&#8203;j178](https://github.com/j178)

### [`v0.3.10`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#0310)

[Compare Source](j178/prek@v0.3.9...v0.3.10)

Released on 2026-04-21.

##### Enhancements

- Disallow rev for non-remote repos in schema ([#&#8203;1964](j178/prek#1964))
- Hide up-to-date output in non-verbose mode ([#&#8203;1942](j178/prek#1942))
- Improve merge conflict marker detection ([#&#8203;1937](j178/prek#1937))
- Keep finished hooks visible ([#&#8203;1967](j178/prek#1967))
- Preserve frozen comment spacing in auto-update ([#&#8203;1945](j178/prek#1945))
- Reimplement `@j178/prek` npm package ([#&#8203;1973](j178/prek#1973))

##### Bug fixes

- Prefer stable Rust toolchains ([#&#8203;1974](j178/prek#1974))

##### Documentation

- Add `SKILL.md` for prek ([#&#8203;1950](j178/prek#1950))
- Document `gh skill install j178/prek prek` to install prek skill for agents ([#&#8203;1951](j178/prek#1951))
- Improve compatibility and migration docs ([#&#8203;1940](j178/prek#1940))

##### Other changes

- Sync latest identify tags ([#&#8203;1947](j178/prek#1947))

##### Contributors

- [@&#8203;github-actions](https://github.com/github-actions)
- [@&#8203;renovate](https://github.com/renovate)
- [@&#8203;j178](https://github.com/j178)

### [`v0.3.9`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#039)

[Compare Source](j178/prek@v0.3.8...v0.3.9)

Released on 2026-04-13.

##### Highlight

`prek auto-update` is now stricter about pinned revisions and more useful in CI.
It now keeps `rev` and `# frozen:` comments in sync, can detect
[impostor commits](https://docs.zizmor.sh/audits/#impostor-commit) when validating pinned SHAs,
and lets you use `prek auto-update --check` to fail on both available updates and frozen-ref
mismatches without rewriting the config.

Examples:

```console
$ prek auto-update

# updates revs and repairs stale `# frozen:` comments

$ prek auto-update --freeze

# writes frozen SHAs with matching `# frozen: <tag>` comments

$ prek auto-update --check

# exits non-zero when updates are available, a `# frozen:` comment is stale,
# or a pinned SHA does not belong to the fetched upstream refs
```

##### Enhancements

- Check and sync frozen comments during auto-update ([#&#8203;1896](j178/prek#1896))
- Handle impostor commits in auto-update ([#&#8203;1919](j178/prek#1919))
- Add experimental `language: dotnet` support ([#&#8203;1871](j178/prek#1871))
- Honor repo and worktree `core.hooksPath` ([#&#8203;1892](j178/prek#1892))
- Add `prek run --no-fail-fast` to override config file ([#&#8203;1859](j178/prek#1859))
- Add `forbid-new-submodules` as builtin hook ([#&#8203;1853](j178/prek#1853))
- Clean stale patch files in `cache gc` ([#&#8203;1877](j178/prek#1877))
- Display auto-update results by config entry ([#&#8203;1922](j178/prek#1922))
- Restrict patch directory permissions ([#&#8203;1876](j178/prek#1876))
- Show tag names in `auto-update --freeze` output ([#&#8203;1916](j178/prek#1916))
- Use a bitset for hook stages ([#&#8203;1860](j178/prek#1860))

##### Bug fixes

- Canonicalize CWD and GIT\_ROOT paths ([#&#8203;1878](j178/prek#1878))
- Ensure quotes are added for non-string revisions in `auto-update` ([#&#8203;1936](j178/prek#1936))

##### Documentation

- Update docs for case of hooks modifying files with a non-zero exit code ([#&#8203;1879](j178/prek#1879))

##### Contributors

- [@&#8203;RicardoVercetti](https://github.com/RicardoVercetti)
- [@&#8203;nathanjmcdougall](https://github.com/nathanjmcdougall)
- [@&#8203;renovate](https://github.com/renovate)
- [@&#8203;sadjow](https://github.com/sadjow)
- [@&#8203;j178](https://github.com/j178)

### [`v0.3.8`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#038)

[Compare Source](j178/prek@v0.3.6...v0.3.8)

Released on 2026-03-23.

##### Enhancements

- Add experimental `language: deno` support ([#&#8203;1516](j178/prek#1516))
- Add `pretty-format-json` as builtin hook ([#&#8203;915](j178/prek#915))
- Add `check-vcs-permalinks` as builtin hook ([#&#8203;1842](j178/prek#1842))
- Add `check-illegal-windows-names` as builtin hook ([#&#8203;1841](j178/prek#1841))
- Add `check-shebang-scripts-are-executable` builtin hook ([#&#8203;1847](j178/prek#1847))
- Add `destroyed-symlinks` builtin hook ([#&#8203;1851](j178/prek#1851))
- Add `file-contents-sorter` as builtin hook ([#&#8203;1846](j178/prek#1846))
- Add `--all` flag to `prek uninstall` ([#&#8203;1817](j178/prek#1817))
- Improve file pattern parse errors ([#&#8203;1829](j178/prek#1829))
- Validate `uv` binary after download ([#&#8203;1825](j178/prek#1825))

##### Bug fixes

- Fix workspace-relative added file paths ([#&#8203;1852](j178/prek#1852))
- Relax alias-anchor ratio check for check-yaml ([#&#8203;1839](j178/prek#1839))

##### Contributors

- [@&#8203;j178](https://github.com/j178)
- [@&#8203;shaanmajid](https://github.com/shaanmajid)
- [@&#8203;mvanhorn](https://github.com/mvanhorn)
- [@&#8203;feliblo](https://github.com/feliblo)
- [@&#8203;Tiryoh](https://github.com/Tiryoh)

### [`v0.3.6`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#036)

[Compare Source](j178/prek@v0.3.5...v0.3.6)

Released on 2026-03-16.

##### Enhancements

- Allow selectors for hook ids containing colons ([#&#8203;1782](j178/prek#1782))
- Rename `prek install-hooks` to `prek prepare-hooks` and `prek install --install-hooks` to `prek install --prepare-hooks` ([#&#8203;1766](j178/prek#1766))
- Retry auth-failed repo clones with terminal prompts enabled ([#&#8203;1761](j178/prek#1761))

##### Performance

- Optimize `detect_private_key` by chunked reading and using aho-corasick ([#&#8203;1791](j178/prek#1791))
- Optimize `fix_byte_order_marker` by shifting file contents in place ([#&#8203;1790](j178/prek#1790))

##### Bug fixes

- Align stage defaulting behavior with pre-commit ([#&#8203;1788](j178/prek#1788))
- Make sure child output is drained in the PTY subprocess ([#&#8203;1768](j178/prek#1768))
- fix(golang): use `GOTOOLCHAIN=local` when probing system go ([#&#8203;1797](j178/prek#1797))

##### Documentation

- Disambiguate “hook” terminology by renaming "Git hooks" to "Git shims" ([#&#8203;1776](j178/prek#1776))
- Document compatibility with pre-commit ([#&#8203;1767](j178/prek#1767))
- Update configuration.md with TOML 1.1 notes ([#&#8203;1764](j178/prek#1764))

##### Other changes

- Sync latest identify tags ([#&#8203;1798](j178/prek#1798))

##### Contributors

- [@&#8203;github-actions](https://github.com/github-actions)
- [@&#8203;j178](https://github.com/j178)
- [@&#8203;pcastellazzi](https://github.com/pcastellazzi)
- [@&#8203;deadnews](https://github.com/deadnews)
- [@&#8203;copilot-swe-agent](https://github.com/copilot-swe-agent)

### [`v0.3.5`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#035)

[Compare Source](j178/prek@v0.3.4...v0.3.5)

Released on 2026-03-09.

##### Enhancements

- Add automatic Ruby download support using rv binaries ([#&#8203;1668](j178/prek#1668))
- Adjust open file limit on process startup ([#&#8203;1705](j178/prek#1705))
- Allow parallel gem retry ([#&#8203;1732](j178/prek#1732))
- Enable system-proxy feature on reqwest ([#&#8203;1738](j178/prek#1738))
- Expose `--git-dir` to force hook installation target ([#&#8203;1723](j178/prek#1723))
- Pass `--quiet`, `--verbose`, and `--no-progress` through `prek install` into generated hook scripts ([#&#8203;1753](j178/prek#1753))
- Respect `core.sharedRepository` for hook permissions ([#&#8203;1755](j178/prek#1755))
- Support legacy mode hook script ([#&#8203;1706](j178/prek#1706))
- rust: support `cli:` git dependency 4th segment package disambiguation ([#&#8203;1747](j178/prek#1747))

##### Bug fixes

- Fix Python `__main__.py` entry ([#&#8203;1741](j178/prek#1741))
- python: strip `UV_SYSTEM_PYTHON` from `uv venv` and `pip install` commands ([#&#8203;1756](j178/prek#1756))

##### Other changes

- Sync latest identify tags ([#&#8203;1733](j178/prek#1733))

##### Contributors

- [@&#8203;Dev-iL](https://github.com/Dev-iL)
- [@&#8203;tennox](https://github.com/tennox)
- [@&#8203;shaanmajid](https://github.com/shaanmajid)
- [@&#8203;is-alnilam](https://github.com/is-alnilam)
- [@&#8203;github-actions](https://github.com/github-actions)
- [@&#8203;j178](https://github.com/j178)

### [`v0.3.4`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#034)

[Compare Source](j178/prek@v0.3.3...v0.3.4)

Released on 2026-02-28.

##### Enhancements

- Allow `pass_filenames` to accept a positive integer ([#&#8203;1698](j178/prek#1698))
- Install and compile gems in parallel ([#&#8203;1674](j178/prek#1674))
- Sync identify file-type mappings with pre-commit identify ([#&#8203;1660](j178/prek#1660))
- Use `--locked` for Rust `cargo install` commands ([#&#8203;1661](j178/prek#1661))
- Add `PREK_MAX_CONCURRENCY` environment variable for configuring maximum concurrency ([#&#8203;1697](j178/prek#1697))
- Add `PREK_LOG_TRUNCATE_LIMIT` environment variable for configuring log truncation ([#&#8203;1679](j178/prek#1679))
- Add support for `python -m prek` ([#&#8203;1686](j178/prek#1686))

##### Bug fixes

- Skip invalid Rust toolchains instead of failing ([#&#8203;1699](j178/prek#1699))

##### Performance

- Bitset-based TagSet refactor: precompute tag masks and speed up hook type filtering ([#&#8203;1665](j178/prek#1665))

##### Documentation

- Document `winget install j178.Prek` ([#&#8203;1670](j178/prek#1670))

##### Contributors

- [@&#8203;uplsh580](https://github.com/uplsh580)
- [@&#8203;Svecco](https://github.com/Svecco)
- [@&#8203;dbast](https://github.com/dbast)
- [@&#8203;drichardson](https://github.com/drichardson)
- [@&#8203;JP-Ellis](https://github.com/JP-Ellis)
- [@&#8203;j178](https://github.com/j178)
- [@&#8203;is-alnilam](https://github.com/is-alnilam)
- [@&#8203;copilot-swe-agent](https://github.com/copilot-swe-agent)

### [`v0.3.3`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#033)

[Compare Source](j178/prek@v0.3.2...v0.3.3)

Released on 2026-02-15.

##### Enhancements

- Read Python version specifier from hook repo `pyproject.toml` ([#&#8203;1596](j178/prek#1596))
- Add `#:schema` directives to generated prek.toml ([#&#8203;1597](j178/prek#1597))
- Add `prek util list-builtins` command ([#&#8203;1600](j178/prek#1600))
- Expand install source detection to `mise`, `uv tool`, `pipx`, and `asdf` ([#&#8203;1605](j178/prek#1605), [#&#8203;1607](j178/prek#1607))
- Add progress bar to `cache clean` and show removal summary ([#&#8203;1616](j178/prek#1616))
- Make `yaml-to-toml` CONFIG argument optional ([#&#8203;1593](j178/prek#1593))
- `prek uninstall` removes legacy scripts too ([#&#8203;1622](j178/prek#1622))

##### Bug fixes

- Fix underflow when formatting summary output ([#&#8203;1626](j178/prek#1626))
- Match `files/exclude` filter against relative path of nested project ([#&#8203;1624](j178/prek#1624))
- Select `musllinux` wheel tag for uv on musl-based distros ([#&#8203;1628](j178/prek#1628))

##### Documentation

- Clarify `prek list` description ([#&#8203;1604](j178/prek#1604))

##### Contributors

- [@&#8203;ichoosetoaccept](https://github.com/ichoosetoaccept)
- [@&#8203;shaanmajid](https://github.com/shaanmajid)
- [@&#8203;soraxas](https://github.com/soraxas)
- [@&#8203;9999years](https://github.com/9999years)
- [@&#8203;j178](https://github.com/j178)

### [`v0.3.2`](https://github.com/j178/prek/blob/HEAD/CHANGELOG.md#032)

[Compare Source](j178/prek@v0.3.1...v0.3.2)

Released on 2026-02-06.

##### Highlights

- **`prek.toml` is here!**

  You can now use `prek.toml` as an alternative to `.pre-commit-config.yaml` for configuring prek. `prek.toml` mirrors the structure of `.pre-commit-config.yaml`, but TOML is less error-prone. Your existing `.pre-commit-config.yaml` will continue to work, but for new users and new projects, `prek.toml` may make more sense. If you want to switch, run `prek util yaml-to-toml` to convert YAML configs to `prek.toml`. See [configuration docs](configuration.md) for details.

  For example, this config:

  ```yaml
  repos:
    - repo: https://github.com/pre-commit/pre-commit-hooks
      rev: v6.0.0
      hooks:
        - id: check-yaml
  ```

  Can be written as `prek.toml` like this:

  ```toml
  [[repos]]
  repo = "https://github.com/pre-commit/pre-commit-hooks"
  rev = "v6.0.0"
  hooks = [ { id = "check-yaml" } ]
  ```

- **`serde-yaml` has been replaced with `serde-saphyr`**

  We replaced the long-deprecated `serde-yaml` crate with [`serde-saphyr`](https://crates.io/crates/serde-saphyr) for YAML parsing. It is written in safe Rust and has better error messages, performance, and security. This lets us provide precise location information for configuration parsing errors, which should make it easier to fix config issues.

  For example, this invalid config:

  ```yaml
  repos:
    - repo: https://github.com/crate-ci/typos
      hooks:
        - id: typos
  ```

  Before:

  ```console
  $ prek run
  error: Failed to parse `.pre-commit-config.yaml`
    caused by: Invalid remote repo: missing field `rev`
  ```

  Now:

  ```console
  $ prek run
  error: Failed to parse `.pre-commit-config.yaml`
  caused by: error: line 2 column 5: missing field `rev` at line 2, column 5
  --> <input>:2:5
    |
  1 | repos:
  2 |   - repo: https://github.com/crate-ci/typos
    |     ^ missing field `rev` at line 2, column 5
  3 |     hooks:
  4 |       - id: typos
    |
  ```

- **`prek util` subcommands**

  We added a new `prek util` top-level command for miscellaneous utilities that don't fit into other categories. The first two utilities are:

  - `prek util identify`: shows the identification tags of files that prek uses for file filtering, which can be useful for debugging and writing `types/types_or/exclude_types` filters.
  - `prek util yaml-to-toml`: converts `.pre-commit-config.yaml` to `prek.toml`.

  We also moved `prek init-template-dir` under `prek util` for better organization. The old `prek init-template-dir` command is still available (hidden) as an alias for backward compatibility.

##### Enhancements

- Add `prek util identify` subcommand ([#&#8203;1554](j178/prek#1554))
- Add `prek util yaml-to-toml` to convert `.pre-commit-config.yaml` to `prek.toml` ([#&#8203;1584](j178/prek#1584))
- Detect install source for actionable upgrade hints ([#&#8203;1540](j178/prek#1540))
- Detect prek installed by the standalone installer ([#&#8203;1545](j178/prek#1545))
- Implement `serialize_yaml_scalar` using `serde-saphyr` ([#&#8203;1534](j178/prek#1534))
- Improve max cli arguments length calculation ([#&#8203;1518](j178/prek#1518))
- Move `identify` and `init-template-dir` under the `prek util` top-level command ([#&#8203;1574](j178/prek#1574))
- Replace serde-yaml with serde-saphyr (again) ([#&#8203;1520](j178/prek#1520))
- Show precise location for config parsing error ([#&#8203;1530](j178/prek#1530))
- Support `Julia` language ([#&#8203;1519](j178/prek#1519))
- Support `prek.toml` ([#&#8203;1271](j178/prek#1271))
- Added `PREK_QUIET` environment variable support ([#&#8203;1513](j178/prek#1513))
- Remove upper bound constraint of uv version ([#&#8203;1588](j178/prek#1588))

##### Bug fixes

- Do not make the child a session leader ([#&#8203;1586](j178/prek#1586))
- Fix FilePattern schema to accept plain strings ([#&#8203;1564](j178/prek#1564))
- Use semver fallback sort when tag timestamps are equal ([#&#8203;1579](j178/prek#1579))

##### Documentation

- Add `OpenClaw` to the list of users ([#&#8203;1517](j178/prek#1517))
- Add `cachix/devenv`, `apache/lucene`, `copper-project/copper-rs` as projects using prek ([#&#8203;1531](j178/prek#1531), [#&#8203;1514](j178/prek#1514), [#&#8203;1569](j178/prek#1569))
- Add document about authoring remote hooks ([#&#8203;1571](j178/prek#1571))
- Add `llms.txt` generation for LLM-friendly documentation ([#&#8203;1553](j178/prek#1553))
- Document using `--refresh` to pick up `.prekignore` changes ([#&#8203;1575](j178/prek#1575))
- Fix PowerShell completion instruction syntax ([#&#8203;1568](j178/prek#1568))
- Update quick start to use `prek.toml` ([#&#8203;1576](j178/prek#1576))

##### Other changes

- Include `prek.toml` in run hint for config filename ([#&#8203;1578](j178/prek#1578))

##### Contributors

- [@&#8203;fatelei](https://github.com/fatelei)
- [@&#8203;domenkozar](https://github.com/domenkozar)
- [@&#8203;makeecat](https://github.com/makeecat)
- [@&#8203;fllesser](https://github.com/fllesser)
- [@&#8203;j178](https://github.com/j178)
- [@&#8203;copilot-swe-agent](https://github.com/copilot-swe-agent)
- [@&#8203;oopscompiled](https://github.com/oopscompiled)
- [@&#8203;rmuir](https://github.com/rmuir)
- [@&#8203;shaanmajid](https://github.com/shaanmajid)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjguNSIsInVwZGF0ZWRJblZlciI6IjQzLjE2OC41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6cGF0Y2giXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat: add utility to check hashes and frozen: tags match

3 participants

@j178 @shaanmajid