Reject unsupported YAML tags in check-yaml

Cargo.toml

@@ -70,10 +70,10 @@ semver = { version = "1.0.24", features = ["serde"] }
 serde = { version = "1.0.210", features = ["derive"] }
 serde_json = { version = "1.0.132", features = ["preserve_order", "unbounded_depth"] }
 serde_stacker = { version = "0.1.12" }
-serde-saphyr = { version = "1.1.0", default-features = false, features = ["deserialize", "serialize"] }
+serde-saphyr = { version = "1.2.0", default-features = false, features = ["deserialize", "serialize"] }
 shlex = { version = "2.0.0" }
 globset = { version = "0.4.18" }
-granit-parser = { version = "1.1.0" }
+granit-parser = { version = "1.2.0" }
 similar = { version = "3.0.0" }
 ssl-certs = { version = "0.1.1" }
 strum = { version = "0.28.0", features = ["derive"] }

crates/prek/src/config/mod.rs

@@ -381,7 +381,7 @@ mod tests {
             ),
             (
                 r#"["ci\tslow"]"#,
-                "group name `ci\tslow` cannot contain whitespace",
+                "group name `ci\\tslow` cannot contain whitespace",
             ),
             (
                 r#"["@custom"]"#,

crates/prek/src/hooks/pre_commit_hooks/check_yaml.rs

@@ -75,6 +75,8 @@ fn check_loaded(filename: &Path, content: &[u8], allow_multi_docs: bool) -> Hook
         emit_comments: false,
         // Do not require `!!binary` scalars to decode as UTF-8. See #1102.
         ignore_binary_tag_for_string: true,
+        // Match ruamel.yaml's safe loader by rejecting tags without constructors. See #2604.
+        reject_unsupported_tags: true,
         // The scalar values are discarded, so only validate whether they are
         // legal YAML, not whether an untyped data model can represent them. See #2544.
         reject_non_finite_typeless_float: false,
@@ -307,6 +309,25 @@ key2: value2
         Ok(())
     }
 
+    #[test]
+    fn test_unknown_yaml_tag_requires_unsafe() {
+        let filename = Path::new("tagged.yaml");
+        let content = b"foo: !reference [.bar, script]\n";
+
+        let result = check_loaded(filename, content, false);
+        assert_eq!(result.exit_status, 1);
+        insta::assert_snapshot!(String::from_utf8_lossy(&result.output), @r#"
+        tagged.yaml: Failed to yaml decode (error: line 1 column 17: unsupported tag `!reference`
+         --> <input>:1:17
+          |
+        1 | foo: !reference [.bar, script]
+          |                 ^ unsupported tag `!reference`)
+        "#);
+
+        let result = check_syntax(filename, content);
+        assert_eq!((result.exit_status, result.output), (0, Vec::new()));
+    }
+
     #[tokio::test]
     async fn test_yaml_with_binary_scalar() -> Result<()> {
         let dir = tempdir()?;