[shaanmajid]

Summary

See https://emudhra.we-have-a-problem.com/ for more info.

By default, without PREK_NATIVE_TLS, prek trusts only the roots compiled in from webpki-root-certs and does no revocation checks. OS and browser blocks therefore don't protect prek's own downloads, such as toolchains.

(For reference, uv documented their response with GHSA-hq85-5cpj-mr62, merging astral-sh/uv#22760 and astral-sh/uv#22762, and immediately cutting a 0.13.4 release).

This PR:

• Bumps webpki-root-certs 1.0.9 -> 1.0.10, which drops the AAA Certificate Services and emSign ECC Root CA - G3 roots that the compromised intermediates chain to.
• Bumps rustls-webpki 0.103.15 -> 0.103.16, the patched release.
• Updates the managed uv from 0.13.0 -> 0.13.4, uv's patched release. uv also uses bundled webpki roots by default when installing hook dependencies.

I would recommend releasing this ASAP.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T19:26:44.803268Z	8649db1	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.84%. Comparing base (5b66378) to head (8649db1).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2919      +/-   ##
==========================================
- Coverage   94.41%   93.84%   -0.57%     
==========================================
  Files         145      145              
  Lines       30940    30940              
==========================================
- Hits        29212    29037     -175     
- Misses       1728     1903     +175     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1dbaa626ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[prek-ci-bot]

📦 Cargo Bloat Comparison

.text size change: +0.00% (12.8 MiB → 12.8 MiB)

Expand for cargo-bloat output

Head Branch Results

File  .text     Size             Crate Name
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_encrypt_avx512
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_decrypt_avx512
0.0%   0.7%  91.8KiB              prek <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
0.0%   0.4%  50.3KiB annotate_snippets annotate_snippets::renderer::render::render
0.0%   0.4%  47.5KiB              prek <<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.4%  47.2KiB              prek prek::run::{closure#0}
0.0%   0.3%  45.0KiB              prek <<prek::config::Config as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.3%  40.0KiB              prek <prek::cli::RunOptions as clap_builder::derive::Args>::augment_args
0.0%   0.2%  29.5KiB      serde_saphyr <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
0.0%   0.2%  29.0KiB              toml <toml::de::deserializer::value::ValueDeserializer as serde_core::de::Deserializer>::deserialize_any::<<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor>
0.0%   0.2%  28.2KiB              prek <prek::languages::ruby::installer::RubyInstaller>::install::{closure#0}
0.0%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble_alt
0.0%   0.2%  27.5KiB              prek prek::cli::run::run::run::{closure#0}
0.0%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble
0.0%   0.2%  27.4KiB              prek prek::cli::cache_gc::cache_gc::{closure#0}
0.0%   0.2%  26.5KiB              prek prek::cli::hook_impl::hook_impl::{closure#0}
0.0%   0.2%  25.3KiB      serde_saphyr <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
0.0%   0.2%  25.2KiB              prek <prek::workspace::Project>::init_hooks::{closure#0}
0.0%   0.2%  23.6KiB              prek prek::cli::try_repo::try_repo::{closure#0}
0.0%   0.2%  23.3KiB              prek <prek::cli::UpdateArgs as clap_builder::derive::Args>::augment_args
4.0%  87.2%  11.2MiB                   And 20735 smaller methods. Use -n N to show more.
4.6% 100.0%  12.8MiB                   .text section size, the file size is 277.5MiB

Base Branch Results

File  .text     Size             Crate Name
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_encrypt_avx512
0.1%   2.5% 332.0KiB        aws_lc_sys aws_lc_0_45_0_aes_gcm_decrypt_avx512
0.0%   0.7%  91.8KiB              prek <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
0.0%   0.4%  50.3KiB annotate_snippets annotate_snippets::renderer::render::render
0.0%   0.4%  47.5KiB              prek <<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.4%  47.2KiB              prek prek::run::{closure#0}
0.0%   0.3%  45.0KiB              prek <<prek::config::Config as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<&mut <serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
0.0%   0.3%  40.0KiB              prek <prek::cli::RunOptions as clap_builder::derive::Args>::augment_args
0.0%   0.2%  29.5KiB      serde_saphyr <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
0.0%   0.2%  29.0KiB              toml <toml::de::deserializer::value::ValueDeserializer as serde_core::de::Deserializer>::deserialize_any::<<prek::config::hook::HookWire as serde_core::de::Deserialize>::deserialize::__Visitor>
0.0%   0.2%  28.2KiB              prek <prek::languages::ruby::installer::RubyInstaller>::install::{closure#0}
0.0%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble_alt
0.0%   0.2%  27.5KiB              prek prek::cli::run::run::run::{closure#0}
0.0%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_45_0_edwards25519_scalarmuldouble
0.0%   0.2%  27.4KiB              prek prek::cli::cache_gc::cache_gc::{closure#0}
0.0%   0.2%  26.5KiB              prek prek::cli::hook_impl::hook_impl::{closure#0}
0.0%   0.2%  25.3KiB      serde_saphyr <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
0.0%   0.2%  25.2KiB              prek <prek::workspace::Project>::init_hooks::{closure#0}
0.0%   0.2%  23.6KiB              prek prek::cli::try_repo::try_repo::{closure#0}
0.0%   0.2%  23.3KiB              prek <prek::cli::UpdateArgs as clap_builder::derive::Args>::augment_args
4.0%  87.2%  11.2MiB                   And 20714 smaller methods. Use -n N to show more.
4.6% 100.0%  12.8MiB                   .text section size, the file size is 277.4MiB

[prek-ci-bot]

⚡️ Hyperfine Benchmarks

Summary: 0 regressions, 1 improvements above the 10% threshold.

Environment

• OS: Linux 7.0.0-1017-azure
• CPU: 4 cores
• prek version: prek 0.5.6+9 (f70353a 2026-10-20)
• Rust version: rustc 1.99.1 (58cf8f9c3 2026-10-13)
• Hyperfine version: hyperfine 2.0.0

CLI Commands

Benchmarking basic commands in the main repo:

prek --version

Command	Mean Wall Time [ms]	Change	Factor
prek-base --version	2.5 ± 0.1
prek-head --version	2.3 ± 0.1	-7.6%

prek list

Command	Mean Wall Time [ms]	Change	Factor
prek-base list	9.9 ± 0.6
prek-head list	9.5 ± 0.2	-4.0%

prek validate-config .pre-commit-config.yaml

⏭️ Skipped: .pre-commit-config.yaml not found

prek sample-config

Command	Mean Wall Time [ms]	Change	Factor
prek-base sample-config	3.0 ± 0.1
prek-head sample-config	2.9 ± 0.7	-3.6%

Cold vs Warm Runs

Comparing first run (cold) vs subsequent runs (warm cache):

prek run --all-files (cold - no cache)

Command	Mean Wall Time [ms]	Change	Factor
prek-base run --all-files	18.0 ± 0.6
prek-head run --all-files	17.8 ± 0.7	-1.6%

prek run --all-files (warm - with cache)

Command	Mean Wall Time [ms]	Change	Factor
prek-base run --all-files	17.8 ± 0.4
prek-head run --all-files	17.6 ± 0.3	-1.1%

Full Hook Suite

Running the builtin hook suite on the benchmark workspace:

prek run --all-files (full builtin hook suite)

Command	Mean Wall Time [ms]	Change	Factor
prek-base run --all-files	17.8 ± 0.4
prek-head run --all-files	17.7 ± 0.5	-1.0%

Individual Hook Performance

Benchmarking each hook individually on the test repo:

prek run trailing-whitespace --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run trailing-whitespace --all-files	9.1 ± 0.2
prek-head run trailing-whitespace --all-files	8.7 ± 0.4	-4.8%

prek run end-of-file-fixer --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run end-of-file-fixer --all-files	8.2 ± 0.1
prek-head run end-of-file-fixer --all-files	7.8 ± 0.1	-4.7%

prek run check-json --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run check-json --all-files	7.7 ± 1.3
prek-head run check-json --all-files	7.4 ± 1.4	-4.4%

prek run check-yaml --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run check-yaml --all-files	7.7 ± 0.4
prek-head run check-yaml --all-files	7.2 ± 0.2	-5.7%

prek run check-toml --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run check-toml --all-files	7.4 ± 0.1
prek-head run check-toml --all-files	7.0 ± 0.1	-4.4%

prek run check-xml --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run check-xml --all-files	7.5 ± 0.1
prek-head run check-xml --all-files	7.2 ± 0.1	-4.5%

prek run detect-private-key --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run detect-private-key --all-files	7.9 ± 0.1
prek-head run detect-private-key --all-files	7.6 ± 0.3	-4.0%

prek run fix-byte-order-marker --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run fix-byte-order-marker --all-files	7.9 ± 0.1
prek-head run fix-byte-order-marker --all-files	7.7 ± 0.2	-3.6%

Installation Performance

Benchmarking hook installation (fast path hooks skip Python setup):

prek install-hooks (cold - no cache)

Command	Mean Wall Time [ms]	Change	Factor
prek-base install-hooks	5.4 ± 0.7
prek-head install-hooks	4.8 ± 0.1	-10.2%

✅ Performance improvement for prek install-hooks (cold - no cache): 10.2200% faster

prek install-hooks (warm - with cache)

Command	Mean Wall Time [ms]	Change	Factor
prek-base install-hooks	5.2 ± 0.1
prek-head install-hooks	4.7 ± 0.1	-8.3%

File Filtering/Scoping Performance

Testing different file selection modes:

prek run (staged files only)

Command	Mean Wall Time [ms]	Change	Factor
prek-base run	11.2 ± 0.7
prek-head run	10.8 ± 0.2	-3.4%

prek run --files '*.json' (specific file type)

Command	Mean Wall Time [ms]	Change	Factor
prek-base run --files '*.json'	5.8 ± 0.2
prek-head run --files '*.json'	5.4 ± 0.1	-7.7%

Workspace Discovery & Initialization

Benchmarking hook discovery and initialization overhead:

prek run --dry-run --all-files (measures init overhead)

Command	Mean Wall Time [ms]	Change	Factor
prek-base run --dry-run --all-files	7.6 ± 0.1
prek-head run --dry-run --all-files	7.3 ± 0.1	-4.1%

Meta Hooks Performance

Benchmarking meta hooks separately:

prek run check-hooks-apply --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run check-hooks-apply --all-files	9.3 ± 1.6
prek-head run check-hooks-apply --all-files	8.7 ± 0.2	-7.2%

prek run check-useless-excludes --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run check-useless-excludes --all-files	9.1 ± 0.4
prek-head run check-useless-excludes --all-files	8.7 ± 0.2	-4.0%

prek run identity --all-files

Command	Mean Wall Time [ms]	Change	Factor
prek-base run identity --all-files	7.9 ± 0.8
prek-head run identity --all-files	7.4 ± 0.1	-7.4%

[j178]

🤯🤯

[shaanmajid]

@j178 I think it's worth considering updating the min floor for managed uv installs to force a reinstall, but that'd be a breaking change. What are your thoughts?