2026-09-10 prek 0.5 Silently Disabled the Hook Cooldown

What I set out to do

Figure out the warnings printed by the dotfiles update -c run: a failed “Updating pre-commit hook revisions” step, unknown flake output warnings from nix flake check, and a maturin --auditwheel=repair warning while building litellm 1.98.0.

What I actually did

  • Traced the hook-revision failure to prek 0.5.0, which removed prek auto-update in favor of prek update (#2619). prek parses an unknown subcommand as a hook selector, so nix/scripts/prek-update printed selector 'auto-update' did not match any hooks and bumped nothing.
  • Found a second, quieter break: 0.5 also reads the global ~/.config/prek/prek.toml cooldown only from [update], not [auto_update]. The old table was dropped with just a stderr warning, so the 3-day release cooldown had not been applied since prek moved to 0.5.
  • Wrote the tests first. The prek stub in test_prek_update.py now rejects any argv except update, and the new nix/tests/prek-config flake check runs the deployed prek’s prek update --dry-run over the rendered toml and fails on Ignored unexpected keys. Both failed before the fix.
  • Fixed nix/scripts/prek-update and nix/home-manager/modules/prek.nix, then updated docs/reference/update.md. After hm switch, 25 bumps were pending with the cooldown and 35 with --cooldown-days 0, so the policy is live again. Commit 7cb8316.
  • Checked the rest and found nothing to fix: the debug/allSystems outputs come from flake-parts debug = true (already documented in nix/flake.nix), the dirty-tree warning is the regenerated mcpvault lock waiting to be committed, and the auditwheel notice comes from litellm’s new Rust extension linking /nix/store libiconv, which Nix keeps as a runtime dependency.

What was striking

Both halves of the break were silent in different ways. The subcommand rename turned into a hook-selector no-op, and the config rename turned into a warning that only shows when prek runs, in a file nothing else reads. The earlier memory note that “prek.toml ignores unknown keys” was the right suspicion. The part that made it testable in the Nix sandbox was that prek update --dry-run over an empty repos: [] reads the global settings without touching the network.