v0.3.9

j178/prekv0.3.9Apr 13, 2026by github-actions[bot]

AI Summary

This release makes `prek auto-update` stricter about pinned revisions with better CI support, adds experimental .NET language support, and introduces several new builtin hooks and quality-of-life improvements.

Key Highlights

Auto-update now syncs `rev` and `# frozen:` comments and detects impostor commits
New `--check` flag fails on updates available, stale frozen comments, or invalid pinned SHAs
Experimental `language: dotnet` support added
New builtin hooks: `forbid-new-submodules` and `file-contents-sorter`
Added `prek run --no-fail-fast` to override config file settings

New Features

Check and sync frozen comments during auto-update
Handle impostor commits in auto-update
Experimental language: dotnet support
Honor repo and worktree core.hooksPath
Add prek run --no-fail-fast
Add forbid-new-submodules as builtin hook
Clean stale patch files in cache gc
Display auto-update results by config entry
Restrict patch directory permissions
Show tag names in auto-update --freeze output
Use a bitset for hook stages

Full Release Notes

## Release Notes

Released on 2026-04-13.

### Highlight

`prek auto-update` is now stricter about pinned revisions and more useful in CI.
It now keeps `rev` and `# frozen:` comments in sync, can detect
[impostor commits](https://docs.zizmor.sh/audits/#impostor-commit) when validating pinned SHAs,
and lets you use `prek auto-update --check` to fail on both available updates and frozen-ref
mismatches without rewriting the config.

Examples:

```console
$ prek auto-update
# updates revs and repairs stale `# frozen:` comments

$ prek auto-update --freeze
# writes frozen SHAs with matching `# frozen: <tag>` comments

$ prek auto-update --check
# exits non-zero when updates are available, a `# frozen:` comment is stale,
# or a pinned SHA does not belong to the fetched upstream refs
```

### Enhancements

- Check and sync frozen comments during auto-update ([#1896](https://github.com/j178/prek/pull/1896))
- Handle impostor commits in auto-update ([#1919](https://github.com/j178/prek/pull/1919))
- Add experimental `language: dotnet` support ([#1871](https://github.com/j178/prek/pull/1871))
- Honor repo and worktree `core.hooksPath` ([#1892](https://github.com/j178/prek/pull/1892))
- Add `prek run --no-fail-fast` to override config file ([#1859](https://github.com/j178/prek/pull/1859))
- Add `forbid-new-submodules` as builtin hook ([#1853](https://github.com/j178/prek/pull/1853))
- Clean stale patch files in `cache gc` ([#1877](https://github.com/j178/prek/pull/1877))
- Display auto-update results by config entry ([#1922](https://github.com/j178/prek/pull/1922))
- Restrict patch directory permissions ([#1876](https://github.com/j178/prek/pull/1876))
- Show tag names in `auto-update --freeze` output ([#1916](https://github.com/j178/prek/pull/1916))
- Use a bitset for hook stages ([#1860](https://github.com/j178/prek/pull/1860))

### Bug fixes

- Canonicalize CWD and GIT_ROOT paths ([#1878](https://github.com/j178/prek/pull/1878))
- Ensure quotes are added for non-string revisions in `auto-update` ([#1936](https://github.com/j178/prek/pull/1936))

### Documentation

- Update docs for case of hooks modifying files with a non-zero exit code ([#1879](https://github.com/j178/prek/pull/1879))

### Contributors

- @RicardoVercetti
- @nathanjmcdougall
- @renovate
- @sadjow
- @j178

## Install prek 0.3.9

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.3.9/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.3.9/prek-installer.ps1 | iex"
```

### Install prebuilt binaries via Homebrew

```sh
brew install prek
```

### Install prebuilt binaries into your npm project

```sh
npm install @j178/prek@0.3.9
```

## Download prek 0.3.9

|  File  | Platform | Checksum |
|--------|----------|----------|
| [prek-aarch64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-apple-darwin.tar.gz.sha256) |
| [prek-x86_64-apple-darwin.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-apple-darwin.tar.gz.sha256) |
| [prek-aarch64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-pc-windows-msvc.zip.sha256) |
| [prek-i686-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.3.9/prek-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-i686-pc-windows-msvc.zip.sha256) |
| [prek-x86_64-pc-windows-msvc.zip](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-pc-windows-msvc.zip.sha256) |
| [prek-aarch64-unknown-linux-gnu.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [prek-i686-unknown-linux-gnu.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-i686-unknown-linux-gnu.tar.gz.sha256) |
| [prek-riscv64gc-unknown-linux-gnu.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-riscv64gc-unknown-linux-gnu.tar.gz.sha256) |
| [prek-s390x-unknown-linux-gnu.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-s390x-unknown-linux-gnu.tar.gz.sha256) |
| [prek-x86_64-unknown-linux-gnu.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [prek-armv7-unknown-linux-gnueabihf.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-armv7-unknown-linux-gnueabihf.tar.gz.sha256) |
| [prek-aarch64-unknown-linux-musl.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [prek-i686-unknown-linux-musl.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-i686-unknown-linux-musl.tar.gz.sha256) |
| [prek-x86_64-unknown-linux-musl.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [prek-arm-unknown-linux-musleabihf.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-arm-unknown-linux-musleabihf.tar.gz.sha256) |
| [prek-armv7-unknown-linux-musleabihf.tar.gz](https://github.com/j178/prek/releases/download/v0.3.9/prek-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://github.com/j178/prek/releases/download/v0.3.9/prek-armv7-unknown-linux-musleabihf.tar.gz.sha256) |

## Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify):
```sh
gh attestation verify <file-path of downloaded artifact> --repo j178/prek
```

You can also download the attestation from [GitHub](https://github.com/j178/prek/attestations) and verify against that directly:
```sh
gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
```