Bump prek from 0.4.11 to 0.4.14

[dependabot]

Bumps prek from 0.4.11 to 0.4.14.

Release notes

Sourced from prek's releases.

0.4.14

Release Notes

Released on 2026-08-17.

Enhancements

• Support check-yaml unsafe mode (#2546)

Performance

• Reuse allocations in common filters (#2548)

Bug fixes

• Accept non-finite floats in check-yaml (#2545)
• Allow comment-heavy YAML in check-yaml (#2554)
• Sanitize captured terminal output before replay (#2552)

Contributors

• @​j178

Install prek 0.4.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.4.14

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
prek-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.14

Released on 2026-08-17.

Enhancements

• Support check-yaml unsafe mode (#2546)

Performance

• Reuse allocations in common filters (#2548)

Bug fixes

• Accept non-finite floats in check-yaml (#2545)
• Allow comment-heavy YAML in check-yaml (#2554)
• Sanitize captured terminal output before replay (#2552)

Contributors

• @​j178

0.4.13

Released on 2026-08-10.

Highlights

Manage hook tools with mise

The new language: mise support lets hooks install tools using mise in an isolated environment:

repos:
  - repo: local
    hooks:
      - id: golangci-lint
        name: golangci-lint
        language: mise
        additional_dependencies: ["aqua:golangci/golangci-lint@2"]
        entry: golangci-lint run --fast-only ./...
        pass_filenames: false

Run commands in hook environments

The new prek exec subcommand can run an explicit command in a configured hook's prepared environment. For example, the hook above makes its managed binary available to this command:

... (truncated)

Commits

• 432eeb0 Bump version to 0.4.14 (#2571)
• 6b6d429 Update Rust crate ignore to v0.4.33 (#2564)
• 27d0cf8 Update prek hooks (#2555)
• aaf407b Update Rust crate aws-lc-rs to v1.18.0 (#2569)
• 3ddddfd Update Rust crate xml to v1.4.0 (#2570)
• fc90ec6 Update Rust crate similar to v3.1.2 (#2567)
• 50e60d4 Update Rust crate thiserror to v2.0.20 (#2568)
• 70a4c06 Update Rust crate liblzma to v0.4.8 (#2565)
• 7b8dcaa Update Rust crate globset to v0.4.20 (#2563)
• 3e075d3 Update Rust crate clap_complete to v4.6.9 (#2562)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[rtibblesbot]

🟡 Waiting for changes

Last updated: 2026-09-01 00:30 UTC

[rtibblesbot]

PR #237 — prek 0.4.11 → 0.4.14 (uv/PyPI), patch-level within 0.4.x, dev-only dependency (pyproject.toml [dependency-groups] dev, unconstrained). CI passing.

• Breaking changes: none across 0.4.12–0.4.14 — all entries are additive (language: mise, prek exec, --require-group), performance, or bug fixes.
• Deprecations: none.
• Security: no CVEs. Supply-chain hardening in 0.4.12 (verified uv release archive checksums, uv installed from Astral CDN) and output sanitization in 0.4.14.
• Peer/transitive deps: none — lockfile diff is the prek entry only (version, sdist, 16 wheels).
• Relevant to this repo: 0.4.14 fixes the builtin check-yaml fast-path (accept non-finite floats #2545, allow comment-heavy YAML #2554). Both loosen the check this repo's .pre-commit-config.yaml runs, so it can only remove false positives.
• Note: the lint job installs prek via j178/prek-action@v2.0.6 with no prek-version, so it defaults to latest; the green check exercises whatever is newest on the runner, not this pin. This bump aligns local dev with what CI has already been running.

No code changes required.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a dependency-update review pipeline over the version bump:

• Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
• Extracted the changelog and release notes across the version range
• Assessed compatibility with this project's usage and whether any code changes are required
• Treated CI as the primary safety net
• Scaled the review depth to the update's risk
• Chose the verdict from semver risk, changelog findings, and CI status