Add a knob that rejects transitive hook packages that are less than X days old

[whoschek]

Summary

prek (and pre-commit) is essentially a meta package manager that runs both on local dev boxes and in CI. Its hooks pull in transitive dependencies and supply chain risk immediately applies. For some background see https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html

So far I have worked around my particular supply chain risk/cooldown concern (in pre-commit) like so:

COOLDOWN_DAYS=7 
export PIP_UPLOADED_PRIOR_TO="$(python3 -c "from datetime import datetime, timedelta, timezone; print((datetime.now(timezone.utc) - timedelta(days=$COOLDOWN_DAYS)).strftime('%Y-%m-%dT%H:%M:%SZ'))")"
#export PIP_UPLOADED_PRIOR_TO="P${COOLDOWN_DAYS}D"  # requires pip >= 26.1
export UV_EXCLUDE_NEWER="$COOLDOWN_DAYS days"
export NPM_CONFIG_MIN_RELEASE_AGE=$COOLDOWN_DAYS  # requires npm >= 11.11.0 e.g. via pre-commit default_language_version: node: lts 
pre-commit <whatever>

It would be great for the prek UX to offer a cooldown config knob that it automatically translates to, and passes down to, the underlying package managers.

Is this something you guys would consider adding?

If prek would have something like this I'd finally move from pre-commit to prek, for good.

Willing to submit a PR?

• Yes — I’m willing to open a PR to fix this.

Platform

any

Version

any

.pre-commit-config.yaml

See https://github.com/whoschek/bzfs/blob/main/.pre-commit-config.yaml

Log file

[danielhoherd]

I think this was solved by #1765

# .pre-commit-config.yaml
---
auto_update:
  cooldown_days: 7
repos:
  ...