pre-commit: pin dependencies with --freeze

20 Mar, 2025 • 257 words • 2 min • updated 03 Jan, 2026

⚠️ This post is over one year old. It may no longer be up to date or relevant. Opinions may have changed.

Today I learned: pre-commit autoupdate has a --freeze option that replaces git tags with SHAs (hashes) on upstream hooks (dependencies).

Here’s how to adopt them, using this blog as an example:

% pre-commit autoupdate --jobs $(nproc) --freeze
[https://github.com/lalten/check-gha-pinning] updating v1.3.0 -> v1.3.0 (frozen)
[https://github.com/google/keep-sorted] updating v0.6.0 -> v0.6.0 (frozen)
[https://github.com/sirosen/texthooks] updating 0.6.8 -> 0.6.8 (frozen)
[https://github.com/google/yamlfmt] updating v0.16.0 -> v0.16.0 (frozen)
[https://github.com/pre-commit/pre-commit-hooks] updating v5.0.0 -> v5.0.0 (frozen)
[https://github.com/shssoichiro/oxipng] updating v9.1.3 -> v9.1.4 (frozen)
[https://github.com/codespell-project/codespell] updating v2.4.1 -> v2.4.1 (frozen)
[https://github.com/gitleaks/gitleaks] updating v8.23.3 -> v8.24.0 (frozen)

The resulting diff (redacted one of the hooks for brevity):

     diff
     
   
diff --git .pre-commit-config.yaml .pre-commit-config.yaml
index 30aac4a2..841eac9b 100644
--- .pre-commit-config.yaml
+++ .pre-commit-config.yaml
@@ -23,7 +23,7 @@ repos:
       - id: check-hooks-apply
       - id: check-useless-excludes
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b  # frozen: v5.0.0
     hooks:
       - id: check-executables-have-shebangs
@@ -41,27 +41,27 @@ repos:
           - -D .codespell-dictionary.txt
           - -I .codespell-ignore-words.txt
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.23.3
+    rev: f565e4e10c6c8081e374235bb4e4bcb8c0c2fa63  # frozen: v8.24.0
     hooks:
       - id: gitleaks
   - repo: https://github.com/google/keep-sorted
-    rev: v0.6.0
+    rev: df93c2722b6126556183749880f16a9beb664bb4  # frozen: v0.6.0
     hooks:
       - id: keep-sorted
   - repo: https://github.com/google/yamlfmt
-    rev: v0.16.0
+    rev: ac76bb931851dda64a55ef746ca9b8bb41634b98  # frozen: v0.16.0
     hooks:
       - id: yamlfmt
   - repo: https://github.com/lalten/check-gha-pinning
-    rev: v1.3.0
+    rev: 225deee5dff16fae532978007ce6e37045e14c68  # frozen: v1.3.0
     hooks:
       - id: check-gha-pinning
   - repo: https://github.com/shssoichiro/oxipng
-    rev: v9.1.3
+    rev: bc8c36456858fe4678460bdea520a4ec0bc50dc4  # frozen: v9.1.4
     hooks:
       - id: oxipng
   - repo: https://github.com/sirosen/texthooks
-    rev: 0.6.8
+    rev: 13a42592dd28b6b688bb1c23fa769234984d4ca7  # frozen: 0.6.8
     hooks:
       - id: fix-ligatures
       - id: fix-smartquotes

This is useful to mitigate supply-chain attacks such as the recent tj-actions/changed-files one.

Backlinks

migrating from pre-commit to prek (Apr 20, 2026)

¬ just serendipity 🍀 (not just serendipity)