Reapply "Reject unsupported YAML tags in check-yaml (#2656)"

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -27,7 +27,7 @@ body:
 
   - type: input
     attributes:
-      label: "Version (current: 0.5.2)"
+      label: "Version (current: 0.5.1)"
       description: What version of prek are you using? (see `prek -V`)
       placeholder: e.g., prek 0.2.3 (7fe75a86d 2025-09-29)
     validations:

CHANGELOG.md

@@ -1,17 +1,5 @@
 # Changelog
 
-## 0.5.2
-
-Released on 2026-09-01.
-
-### Bug fixes
-
-- Revert unsupported YAML tag rejection in `check-yaml`, fixing validation failures for MkDocs configurations that use application-specific tags such as `!!python/object/apply:pymdownx.slugs.slugify` ([#2670](https://github.com/j178/prek/pull/2670))
-
-### Contributors
-
-- @j178
-
 ## 0.5.1
 
 Released on 2026-09-01.

Cargo.toml

@@ -3,17 +3,17 @@ members = ["crates/*"]
 resolver = "3"
 
 [workspace.package]
-version = "0.5.2"
+version = "0.5.1"
 edition = "2024"
 rust-version = "1.96"
 repository = "https://github.com/j178/prek"
 homepage = "https://prek.j178.dev/"
 license = "MIT"
 
 [workspace.dependencies]
-prek-consts = { path = "crates/prek-consts", version = "0.5.2" }
-prek-identify = { path = "crates/prek-identify", version = "0.5.2" }
-prek-pty = { path = "crates/prek-pty", version = "0.5.2" }
+prek-consts = { path = "crates/prek-consts", version = "0.5.1" }
+prek-identify = { path = "crates/prek-identify", version = "0.5.1" }
+prek-pty = { path = "crates/prek-pty", version = "0.5.1" }
 
 aho-corasick = { version = "1.1.4" }
 annotate-snippets = { version = "0.12.13" }

README.md

@@ -59,7 +59,7 @@ On Linux and macOS:
 <!-- --8<-- [start: linux-standalone-install] -->
 
 ```bash
-curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh | sh
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.1/prek-installer.sh | sh
 ```
 
 <!-- --8<-- [end: linux-standalone-install] -->
@@ -69,7 +69,7 @@ On Windows:
 <!-- --8<-- [start: windows-standalone-install] -->
 
 ```powershell
-powershell -ExecutionPolicy ByPass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 | iex"
+powershell -ExecutionPolicy ByPass -c "irm https://github.com/j178/prek/releases/download/v0.5.1/prek-installer.ps1 | iex"
 ```
 
 <!-- --8<-- [end: windows-standalone-install] -->

crates/prek/src/hooks/pre_commit_hooks/check_yaml.rs

@@ -75,6 +75,11 @@ fn check_loaded(filename: &Path, content: &[u8], allow_multi_docs: bool) -> Hook
         emit_comments: false,
         // Do not require `!!binary` scalars to decode as UTF-8. See #1102.
         ignore_binary_tag_for_string: true,
+        // A YAML tag identifies a node's type or application-specific semantics.
+        // `%TAG` directives map tag handles to prefixes. The predefined `!!`
+        // handle expands to `tag:yaml.org,2002:`, while `!` is the local tag handle.
+        // Match ruamel.yaml's safe loader by rejecting tags without constructors. See #2604.
+        reject_unsupported_tags: true,
         // The scalar values are discarded, so only validate whether they are
         // legal YAML, not whether an untyped data model can represent them. See #2544.
         reject_non_finite_typeless_float: false,
@@ -87,10 +92,9 @@ fn check_loaded(filename: &Path, content: &[u8], allow_multi_docs: bool) -> Hook
     match result {
         Ok(()) => HookOutput::unchanged(0, Vec::new()),
         Err(e) => {
-            let formatter = &serde_saphyr::UserMessageFormatter;
             let err = e.render_with_options(serde_saphyr::render_options! {
                 snippets: serde_saphyr::SnippetMode::Off,
-                formatter: formatter,
+                formatter: &serde_saphyr::UserMessageFormatter,
             });
             let error_message = format!("{}: Failed to yaml decode ({err})\n", filename.display());
             HookOutput::unchanged(1, error_message.into_bytes())
@@ -311,6 +315,19 @@ key2: value2
         Ok(())
     }
 
+    #[test]
+    fn test_unknown_yaml_tag_requires_unsafe() {
+        let filename = Path::new("tagged.yaml");
+        let content = b"foo: !reference [.bar, script]\n";
+
+        let result = check_loaded(filename, content, false);
+        assert_eq!(result.exit_status, 1);
+        insta::assert_snapshot!(String::from_utf8_lossy(&result.output), @"tagged.yaml: Failed to yaml decode (unsupported tag `!reference` at line 1, column 17)");
+
+        let result = check_syntax(filename, content);
+        assert_eq!((result.exit_status, result.output), (0, Vec::new()));
+    }
+
     #[tokio::test]
     async fn test_yaml_with_binary_scalar() -> Result<()> {
         let dir = tempdir()?;

docs/integrations.md

@@ -28,21 +28,21 @@ A common pattern is to copy the binary into your own image:
 
 ```dockerfile
 FROM debian:bookworm-slim
-COPY --from=ghcr.io/j178/prek:0.5.2 /prek /usr/local/bin/prek
+COPY --from=ghcr.io/j178/prek:0.5.1 /prek /usr/local/bin/prek
 ```
 
 If you prefer, you can also run the distroless image directly:
 
 ```bash
-docker run --rm ghcr.io/j178/prek:0.5.2 --version
+docker run --rm ghcr.io/j178/prek:0.5.1 --version
 ```
 
 ### Alpine
 
 The Alpine variant includes `prek`, Git, CA certificates, a shell, and the Alpine package manager.
 
 ```bash
-docker run --rm ghcr.io/j178/prek:0.5.2-alpine --version
+docker run --rm ghcr.io/j178/prek:0.5.1-alpine --version
 ```
 
 Use `X.Y.Z-alpine3.24` to pin both the prek and Alpine versions, or `alpine3.24` to pin only the
@@ -69,7 +69,7 @@ Loaded 1 attestation from GitHub API
 
 !!! tip
 
-    Use a specific version tag (e.g., `ghcr.io/j178/prek:0.5.2`) or image
+    Use a specific version tag (e.g., `ghcr.io/j178/prek:0.5.1`) or image
     digest rather than `latest` for verification.
 
 ## GitHub Actions

prek.toml

@@ -16,7 +16,7 @@ repo = "builtin"
 hooks = [
   { id = "trailing-whitespace", exclude = { glob = "CHANGELOG.md" } },
   { id = "mixed-line-ending" },
-  # { id = "check-yaml" }, # disabled temporarily
+  { id = "check-yaml", args = ["--unsafe"] },
   { id = "check-toml" },
   { id = "end-of-file-fixer" },
 ]

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "prek"
-version = "0.5.2"
+version = "0.5.1"
 description = "A fast Git hook manager written in Rust, designed as a drop-in alternative to pre-commit, reimagined."
 authors = [{ name = "j178", email = "hi@j178.dev" }]
 requires-python = ">=3.8"