Use --locked for Rust cargo install commands

[Copilot]

Rust hooks can break when dependency versions change between installations. cargo install without --locked will resolve dependencies freshly, potentially pulling incompatible versions even when Cargo.lock exists.

Changes

• Add --locked flag to both cargo install invocations in crates/prek/src/languages/rust/rust.rs:
  • Local package installation: cargo install --path . --locked
  • CLI dependencies: cargo install <package> --locked
• Document the behavior in docs/languages.md

Example

repos:
  - repo: https://github.com/example/rust-hook
    rev: v1.0.0
    hooks:
      - id: my-rust-hook
        # Now installs with exact Cargo.lock versions

Note: Packages without a Cargo.lock will have --locked ignored by cargo (not an error).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• mirrors.aliyun.com
  • Triggering command: /home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install-hooks -incompat bmemchr-1fe43bea993d3235.rlib breg�� bsyn-2136fc17f010f281.rlib 3pURqBq1pk3divZeIfIb/target/release/deps/prek_rust_echo_lib_deps-59bce7d6001d3263.prek_rust_echo-c 3pURqBq1pk3divZeIfIb/target/release/deps/prek_rust_echo_lib_deps-59bce7d6001d3263.e4dqohtw0l0ytrcore.useBuiltinFSMonitor=false lib 6ed2694.rlib 3pURqBq1pk3divZecommit.gpgsign=false b/rustlib/x86_64-c b/ru�� b/rustlib/x86_64-c b/rustlib/x86_64core.autocrlf=false b/rustlib/x86_64-c b/rustlib/x86_64/usr/bin/git b/rustlib/x86_64-c b/rustlib/x86_64core.useBuiltinFSMonitor=false b/rustlib/x86_64rev-parse (dns block)
  • Triggering command: /home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install --install-hooks /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.1nzs07cgjxiexpa7i3g2b01rt.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.24lsa75b6fov0tk3qt95numqq.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.27k9375t0pciii4hjcyuhgf4w.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2gbphvwl0vvhd1w9zm3ido74e.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2i6mzsq4vdcksvs36vquiynd0.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2mdk2h4p88ofn49ujd91zdlk0.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.30nea9p9x6pr2�� /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.33cvujd6pv5nrd021hs6r57ur.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.33svn44fanwynb1ljchzak5c5.1elqi5j.rcgu.o u.1.�� in.so /lto-wrapper 1.93-x86_64-REDACTED-linux-gnu/bi-c -f448dbb239ade73cc 0a5a4d1a26cf608--m64 orznfljxz.rcgu.o/tmp/rustcq8iZJY/symbols.o 1.93-x86_64-unkn/home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.0b78bzeosorigin (dns block)
  • Triggering command: `/home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install-hooks -I angecoder aZFf�� pi -I p/bin/as hemars_derive-8b/usr/bin/git hemars_derive-8b-c hemars_derive-8bcore.useBuiltinFSMonitor=false hemars_derive-8bdiff hema�� hemars_derive-8b--no-textconv hemars_derive-8b--ignore-submodules hemars_derive-8b-- hemars_derive-8bgit hemars_derive-8bcommit hemars_derive-8b-m hemars_derive-8bUpdate documentation for --locked flag usage

Co-authored-by: j178 <10510431+j17--eh-frame-hdr` (dns block)

• mirrors.cloud.tencent.com
  • Triggering command: /home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install-hooks -incompat bmemchr-1fe43bea993d3235.rlib breg�� bsyn-2136fc17f010f281.rlib 3pURqBq1pk3divZeIfIb/target/release/deps/prek_rust_echo_lib_deps-59bce7d6001d3263.prek_rust_echo-c 3pURqBq1pk3divZeIfIb/target/release/deps/prek_rust_echo_lib_deps-59bce7d6001d3263.e4dqohtw0l0ytrcore.useBuiltinFSMonitor=false lib 6ed2694.rlib 3pURqBq1pk3divZecommit.gpgsign=false b/rustlib/x86_64-c b/ru�� b/rustlib/x86_64-c b/rustlib/x86_64core.autocrlf=false b/rustlib/x86_64-c b/rustlib/x86_64/usr/bin/git b/rustlib/x86_64-c b/rustlib/x86_64core.useBuiltinFSMonitor=false b/rustlib/x86_64rev-parse (dns block)
  • Triggering command: /home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install --install-hooks /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.1nzs07cgjxiexpa7i3g2b01rt.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.24lsa75b6fov0tk3qt95numqq.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.27k9375t0pciii4hjcyuhgf4w.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2gbphvwl0vvhd1w9zm3ido74e.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2i6mzsq4vdcksvs36vquiynd0.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2mdk2h4p88ofn49ujd91zdlk0.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.30nea9p9x6pr2�� /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.33cvujd6pv5nrd021hs6r57ur.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.33svn44fanwynb1ljchzak5c5.1elqi5j.rcgu.o u.1.�� in.so /lto-wrapper 1.93-x86_64-REDACTED-linux-gnu/bi-c -f448dbb239ade73cc 0a5a4d1a26cf608--m64 orznfljxz.rcgu.o/tmp/rustcq8iZJY/symbols.o 1.93-x86_64-unkn/home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.0b78bzeosorigin (dns block)
  • Triggering command: `/home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install-hooks -I angecoder aZFf�� pi -I p/bin/as hemars_derive-8b/usr/bin/git hemars_derive-8b-c hemars_derive-8bcore.useBuiltinFSMonitor=false hemars_derive-8bdiff hema�� hemars_derive-8b--no-textconv hemars_derive-8b--ignore-submodules hemars_derive-8b-- hemars_derive-8bgit hemars_derive-8bcommit hemars_derive-8b-m hemars_derive-8bUpdate documentation for --locked flag usage

Co-authored-by: j178 <10510431+j17--eh-frame-hdr` (dns block)

• notexistentatallnevergonnahappen.com
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED est 2onf�� 70f92045177692.r-c unwind-35a18a198core.autocrlf=false -6d361988d845791-c ags)' ine-9a4df3979b2crev-parse 6a0d9f8e67558a02--show-toplevel -f448dbb239ade73-c dema�� tect-9b165106d41init own-0c83c3b51a9f5653.rlib cal/share/prek/tests/.tmp1lfoNL/-c oxide-ec844042f1/usr/bin/git -fa28e789c10e1e7rev-parse -REDACTED-linux-g--show-toplevel cal/share/prek/tests/.tmp1lfoNL/-c (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED est 2onf�� prek.dev 2onfp.rcgu.o k/_temp/ghcca-no-c ags)' 2onfp.rcgu.o .lld 2onfp.rcgu.o 2onf�� alse .lld e 2onfp.rcgu.o lse ip-0.0.17/src/licore.useBuiltinFSMonitor=false est (dns block)
• pypi.tuna.tsinghua.edu.cn
  • Triggering command: /home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install-hooks -incompat bmemchr-1fe43bea993d3235.rlib breg�� bsyn-2136fc17f010f281.rlib 3pURqBq1pk3divZeIfIb/target/release/deps/prek_rust_echo_lib_deps-59bce7d6001d3263.prek_rust_echo-c 3pURqBq1pk3divZeIfIb/target/release/deps/prek_rust_echo_lib_deps-59bce7d6001d3263.e4dqohtw0l0ytrcore.useBuiltinFSMonitor=false lib 6ed2694.rlib 3pURqBq1pk3divZecommit.gpgsign=false b/rustlib/x86_64-c b/ru�� b/rustlib/x86_64-c b/rustlib/x86_64core.autocrlf=false b/rustlib/x86_64-c b/rustlib/x86_64/usr/bin/git b/rustlib/x86_64-c b/rustlib/x86_64core.useBuiltinFSMonitor=false b/rustlib/x86_64rev-parse (dns block)
  • Triggering command: /home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install --install-hooks /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.1nzs07cgjxiexpa7i3g2b01rt.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.24lsa75b6fov0tk3qt95numqq.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.27k9375t0pciii4hjcyuhgf4w.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2gbphvwl0vvhd1w9zm3ido74e.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2i6mzsq4vdcksvs36vquiynd0.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.2mdk2h4p88ofn49ujd91zdlk0.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.30nea9p9x6pr2�� /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.33cvujd6pv5nrd021hs6r57ur.1elqi5j.rcgu.o /home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.33svn44fanwynb1ljchzak5c5.1elqi5j.rcgu.o u.1.�� in.so /lto-wrapper 1.93-x86_64-REDACTED-linux-gnu/bi-c -f448dbb239ade73cc 0a5a4d1a26cf608--m64 orznfljxz.rcgu.o/tmp/rustcq8iZJY/symbols.o 1.93-x86_64-unkn/home/REDACTED/work/prek/prek/target/debug/deps/install-cf41a32d524c5058.0b78bzeosorigin (dns block)
  • Triggering command: `/home/REDACTED/work/prek/prek/target/debug/prek /home/REDACTED/work/prek/prek/target/debug/prek install-hooks -I angecoder aZFf�� pi -I p/bin/as hemars_derive-8b/usr/bin/git hemars_derive-8b-c hemars_derive-8bcore.useBuiltinFSMonitor=false hemars_derive-8bdiff hema�� hemars_derive-8b--no-textconv hemars_derive-8b--ignore-submodules hemars_derive-8b-- hemars_derive-8bgit hemars_derive-8bcommit hemars_derive-8b-m hemars_derive-8bUpdate documentation for --locked flag usage

Co-authored-by: j178 <10510431+j17--eh-frame-hdr` (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add an option to allow installing Rust tools with --locked</issue_title>
<issue_description>Without the --locked option and without dependencies properly specified in the hook, a new version release of a dependency can cause the hook that previously worked to suddenly stop working. Therefore, I propose adding an option to use --locked, as propsed in pre-commit/pre-commit#3162 .

Alternatively, as proposed in #681, supporting cargo-binstall would also resolve this issue for users with limited security concerns.</issue_description>

Comments on the Issue (you are @copilot in this section)

@j178 I think we should probably always use `--locked`, would that be a breaking change? @j178 > would that be a breaking change?

Yeah. For crates that don’t ship a Cargo.lock, cargo install --locked will fail.</comment_new>

• Fixes Add an option to allow installing Rust tools with --locked #1567

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.78%. Comparing base (357f619) to head (195e2e0).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1661   +/-   ##
=======================================
  Coverage   91.78%   91.78%           
=======================================
  Files          96       96           
  Lines       19066    19067    +1     
=======================================
+ Hits        17499    17500    +1     
  Misses       1567     1567           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[prek-ci-bot]

📦 Cargo Bloat Comparison

Binary size change: +0.00% (23.8 MiB → 23.8 MiB)

Expand for cargo-bloat output

Head Branch Results

 File  .text    Size             Crate Name
 0.3%   0.7% 71.4KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.3%   0.7% 68.7KiB             prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.3%   0.6% 65.6KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.5% 51.2KiB annotate_snippets annotate_snippets::renderer::render::render
 0.2%   0.5% 50.5KiB              prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.2%   0.5% 47.4KiB              prek prek::identify::by_extension::{{closure}}
 0.2%   0.4% 41.6KiB              prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4% 39.0KiB              prek prek::run::{{closure}}
 0.1%   0.3% 32.0KiB             prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.3% 28.5KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2% 25.0KiB             prek? <prek::config::_::<impl serde_core::de::Deserialize for prek::config::Config>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 22.8KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2% 22.7KiB              prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.1KiB      clap_builder clap_builder::parser::parser::Parser::get_matches_with
 0.1%   0.2% 20.6KiB              prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 20.0KiB   cargo_metadata? <cargo_metadata::_::<impl serde_core::de::Deserialize for cargo_metadata::Package>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 19.5KiB              prek prek::archive::unzip::{{closure}}
 0.1%   0.2% 19.3KiB               std core::ptr::drop_in_place<prek::languages::<impl prek::config::Language>::install::{{closure}}>
 0.1%   0.2% 19.2KiB              prek <prek::languages::ruby::ruby::Ruby as prek::languages::LanguageImpl>::install::{{closure}}
 0.1%   0.2% 19.0KiB              prek prek::hook::HookBuilder::build::{{closure}}
38.5%  91.6%  9.2MiB                   And 21032 smaller methods. Use -n N to show more.
42.1% 100.0% 10.0MiB                   .text section size, the file size is 23.8MiB

Base Branch Results

 File  .text    Size             Crate Name
 0.3%   0.7% 71.4KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.3%   0.7% 68.7KiB             prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.3%   0.6% 65.6KiB              prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.5% 51.2KiB annotate_snippets annotate_snippets::renderer::render::render
 0.2%   0.5% 50.5KiB              prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.2%   0.5% 47.4KiB              prek prek::identify::by_extension::{{closure}}
 0.2%   0.4% 41.6KiB              prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4% 39.0KiB              prek prek::run::{{closure}}
 0.1%   0.3% 32.0KiB             prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.3% 28.5KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2% 25.0KiB             prek? <prek::config::_::<impl serde_core::de::Deserialize for prek::config::Config>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 22.8KiB      serde_saphyr saphyr_parser_bw::scanner::Scanner<T>::fetch_more_tokens
 0.1%   0.2% 22.7KiB              prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.1KiB      clap_builder clap_builder::parser::parser::Parser::get_matches_with
 0.1%   0.2% 20.6KiB              prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 20.0KiB   cargo_metadata? <cargo_metadata::_::<impl serde_core::de::Deserialize for cargo_metadata::Package>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 19.5KiB              prek prek::archive::unzip::{{closure}}
 0.1%   0.2% 19.3KiB               std core::ptr::drop_in_place<prek::languages::<impl prek::config::Language>::install::{{closure}}>
 0.1%   0.2% 19.2KiB              prek <prek::languages::ruby::ruby::Ruby as prek::languages::LanguageImpl>::install::{{closure}}
 0.1%   0.2% 19.0KiB              prek prek::hook::HookBuilder::build::{{closure}}
38.5%  91.6%  9.2MiB                   And 21032 smaller methods. Use -n N to show more.
42.1% 100.0% 10.0MiB                   .text section size, the file size is 23.8MiB