prek review
prek 0.4.14 is a Rust Git-hook manager that reads pre-commit configurations, installs each hook's environment, selects files, and runs hooks before commits or in CI. It can also install its own Git shim, manage Python, Node, Bun, Go, Rust, and Ruby toolchains, execute built-in Rust checks, and discover nested projects in a monorepo. The PyPI project delivers a compiled executable rather than a Python framework. Release 0.4.14 adds unsafe mode to its built-in YAML check, accepts non-finite floats and comment-heavy YAML there, reuses filter allocations, and sanitizes captured terminal output before replaying it.
prek 0.4.14 installed in 0.5 seconds as one 1 MB package and imported in 0.02 seconds in our sandbox, with zero audit findings; its real product is the compiled hook command. Adopt it when pre-commit environment cost or monorepo scheduling is measurable, and stay upstream when exact compatibility matters more than new builtins and workspace features.
We installed it
| Install | ✓ · 0.5s | 1 package on disk · 1 MB |
| Import | ✓ | import prek in 0.02s · compiled extensions · requires Python >=3.8 |
| Known vulns | 0 | (pip-audit) |
Answers from our run
Does prek install cleanly?
Yes. In a fresh container with an empty cache, pip install prek finished in 0.5s, leaving 1 package and 1 MB on disk. pip-audit reported no known vulnerabilities.
What does prek need to run?
Python >=3.8, and a platform wheel with compiled extensions. In our run import prek succeeded in 0.02s.
prek or pre-commit: which should you use?
pre-commit: Choose the original manager when configuration portability and exact upstream semantics matter more than startup speed. prek 0.4.14 installed in 0.5 seconds as one 1 MB package and imported in 0.02 seconds in our sandbox, with zero audit findings; its real product is the compiled hook command.
When should you not use prek?
Exact pre-commit behavior is a release requirement. prek documents differences in file identification, omits the hazmat API, and adds TOML, builtins, globs, groups, and workspaces that upstream cannot read.
Use it if
- An existing `.pre-commit-config.yaml` spends noticeable time creating environments or starting hooks.
- A polyglot repository wants one compiled manager to provision hook runtimes without requiring Python on every developer machine.
- Nested projects need workspace selection and parallel execution while retaining separate hook configurations.
- Common checks should run from built-in Rust implementations without cloning a remote hook repository.
- Exact pre-commit behavior is a release requirement. prek documents differences in file identification, omits the hazmat API, and adds TOML, builtins, globs, groups, and workspaces that upstream cannot read.
- Developer tooling must already have a stable 1.x interface. The current release is 0.4.14 and minor versions continue to add commands, managed runtimes, cache formats, and compatibility behavior.
- The current hooks already run quickly and reliably. Replacing the Git shim, CI command, cache, and every developer installation has no automatic payoff.
- Repository configuration may not trigger downloads or executable code. Remote hooks clone code and can install several managed language toolchains on first use.
- A Node-only project merely needs package scripts on staged files. `lint-staged` uses the existing package manager and avoids a cross-language hook repository model.
Setup reality
We installed prek 0.4.14 from PyPI in a clean Python 3.12 sandbox in 0.5 seconds. The result was one package and 1 MB on disk with zero direct Python dependencies; import prek worked in 0.02 seconds. The installed package requires Python 3.8 or newer, contains compiled .so code, has no py.typed marker, and did not expose a license value in our package check. pip-audit reported zero known vulnerabilities. Treat the import as packaging machinery around the executable, not a typed library API.
PyPI publishes wheels across Linux, macOS, and Windows targets, and the project also documents uv, pipx, Homebrew, npm, Cargo, Nix, Conda, Scoop, Winget, and standalone installers. Git remains mandatory. A first hook run can clone repositories, resolve revisions, download managed runtimes, and build environments under the prek cache directory. Pin reviewed revisions because a hook repository is executable supply-chain input.
Existing pre-commit YAML often works unchanged, but inspect the compatibility and differences pages before switching CI. prek install -f replaces an existing managed Git hook; read that file before forcing ownership. A plain prek run focuses on staged files, while CI usually needs --all-files or an explicit range. Formatting hooks can modify files and return nonzero, requiring the developer to inspect and stage the result.
Workspace discovery caches nested project information, so a new project can require refresh. Parent and child configurations may both select the same path unless workspace boundaries say otherwise. Independent hooks can run concurrently; hooks that mutate shared lockfiles or caches should be serialized. Cache keys in CI need the operating system, architecture, prek version, and configuration, especially because earlier 0.4 releases invalidated stored environments after identity-schema changes.
Patterns
Validate and run an existing configuration reuse-precommit-yaml
prek validate-config .pre-commit-config.yaml
prek run --all-filesSyntax compatibility does not guarantee identical file selection. Test the repository's actual hooks before replacing the CI command.
Declare hooks in prek's TOML format configure-prek-toml
[[repos]]
repo = "https://github.com/pre-commit/pre-commit-hooks"
rev = "v6.0.0"
hooks = [
{ id = "check-yaml" },
{ id = "end-of-file-fixer" },
]`prek.toml` is specific to prek. Keep `.pre-commit-config.yaml` if users must be able to return to pre-commit.
Connect prek to Git commits install-git-shim
prek installIf another manager already owns the hook, inspect it first. `prek install -f` deliberately replaces the existing shim.
Remove prek from the repository hook uninstall-git-shim
prek uninstallUninstalling the shim does not erase downloaded hook repositories, toolchains, or environments from the cache.
Check the files staged for commit run-staged-changes
git add src tests
prek runA fixer may edit a staged path and exit nonzero. Review the change and stage the updated file before retrying the commit.
Run the complete repository in CI check-all-tracked-files
prek run --all-filesA bare run is designed around staged changes. `--all-files` is the usual first adoption pass and CI baseline.
Target one hook and selected paths run-one-hook-on-files
prek run check-yaml --files config/app.yml .github/workflows/ci.ymlThe hook's own file, exclude, and type filters still decide whether each supplied path is eligible.
Show work without executing hooks preview-hook-selection
prek run --all-files --dry-runDry-run helps explain hook and file selection. It does not download environments or prove that the commands themselves pass.
Run common checks without a remote repository use-native-builtins
repos:
- repo: builtin
hooks:
- id: trailing-whitespace
- id: check-merge-conflict
- id: detect-private-key`repo: builtin` avoids a clone and separate hook environment, but upstream pre-commit cannot interpret it.
Detect outdated hook revisions in CI check-revision-updates
prek update --checkCheck mode reports available updates without rewriting configuration, leaving review and pin changes to a separate step.
Run one nested project select-workspace-project
prek run frontend/ --skip frontend:formatThe trailing slash identifies a workspace project. Without it, the same token is interpreted as a hook ID.
Review cached environments before cleanup inspect-and-prune-cache
prek cache dir
prek cache size
prek cache gc --dry-run
prek cache gcGarbage collection removes unused repositories, toolchains, and hook environments. Preview it before changing a shared CI cache.
Alternatives
| Package | Registry | Pick it when |
|---|---|---|
| pre-commit | PyPI | Choose the original manager when configuration portability and exact upstream semantics matter more than startup speed. |
| lefthook | PyPI | Use it for a compiled hook runner with its own configuration when pre-commit repository compatibility is unnecessary. |
| lint-staged | npm | Choose it for JavaScript repositories that only need existing package commands applied to staged paths. |
More cli & tooling guides
chalk · commander · typescript · esbuild · yargs · click · the whole shelf →
How this guide is made: grounded in the library's documentation, release notes, changelog, and issue history, on a fixed rubric — not a hands-on install of every release. The 50 most-downloaded entries are additionally install-verified in clean containers. Corrections: contact the desk.