[jbampton]

The new version of codespell found a bunch of spelling mistakes

Tested with:

• prek run -a
• pre-commit run --all-files

[jimjag]

Why the change to .pre-commit-config.yaml

[jbampton]

Why the change to .pre-commit-config.yaml

To increase supply chain security mainly.

Apache Airflow and Apache Shiro both pin their hooks:

https://github.com/apache/airflow/blob/main/.pre-commit-config.yaml#L62

https://github.com/apache/shiro/blob/main/.pre-commit-config.yaml#L77

From Google below

---

Pinning pre-commit hooks to a full-length commit SHA instead of a mutable tag or branch name makes your development and CI/CD pipelines immutable, secure, and reproducible.

Key Reasons to Pin to SHA

• Immutability: Tags (like v1 or v3.19.1) are just movable pointers. A publisher can delete, overwrite, or re-target a tag to a brand-new commit at any time, whereas a 40-character commit SHA points to one exact, unchangeable snapshot of code.

• Supply-Chain Security: If an attacker compromises a third-party hook repository and pushes malicious code to an existing release tag, any developer or pipeline using that tag will automatically execute the malicious payload. SHA-pinning insulates you from this risk.

• Guaranteed Reproducibility: Using branch names or tags means the code can drift quietly over time, causing builds or lint checks that passed yesterday to fail or behave differently today. A SHA ensures every developer on the team and every CI runner executes the exact same code.

• Keeping Comments for Readability: You can pin the exact SHA while keeping the version tag as a comment for human readability

• Easy Automation: You don't have to look up SHAs manually. Running pre-commit autoupdate --freeze will automatically update your hooks and lock them to their latest commit SHAs.

[jimjag]

It's likely better to break that out into its own separate PR to keep things cleaner. Thx!