chore(pre-commit): autoupdate hooks

[pre-commit-ci]

updates:

• github.com/compilerla/conventional-pre-commit: v4.2.0 → v4.4.0
• https://github.com/psf/black: 25.9.0 → github.com/psf/black-pre-commit-mirror: 26.1.0
• github.com/pycqa/bandit: 1.8.6 → 1.9.3
• github.com/pycqa/isort: 7.0.0 → 8.0.0
• github.com/pre-commit/mirrors-prettier: v2.7.1 → v4.0.0-alpha.8

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
benefits/core
mixins.py
session.py
benefits/core/admin
enrollment.py
benefits/core/models
enrollment.py
transit.py
benefits/eligibility
views.py
benefits/enrollment
enrollment.py
benefits/enrollment_littlepay
models.py
benefits/enrollment_switchio
models.py
views.py
Project Total

This report was generated by python-coverage-comment-action

[thekaveman]

This is annoying. It undid what @jgravois fixed in #3225. Is there a way to tell pre-commit-ci we don't want updates for certain hooks but we're OK with getting updates for others?

[jgravois]

Is there a way to tell pre-commit-ci we don't want updates for certain hooks but we're OK with getting updates for others?

not deep research by any means, but it doesn't look like it... pre-commit/pre-commit#1959

[thekaveman]

Is there a way to tell pre-commit-ci we don't want updates for certain hooks but we're OK with getting updates for others?

not deep research by any means, but it doesn't look like it... pre-commit/pre-commit#1959

Their docs seem to indicate this is now supported 🤔 https://pre-commit.ci/#configuration-skip

(And note this is specifically the pre-commit CI service, which builds on top of pre-commit the tool)

[Scotchester]

Is there a way to tell pre-commit-ci we don't want updates for certain hooks but we're OK with getting updates for others?

not deep research by any means, but it doesn't look like it... pre-commit/pre-commit#1959

Their docs seem to indicate this is now supported 🤔 https://pre-commit.ci/#configuration-skip

(And note this is specifically the pre-commit CI service, which builds on top of pre-commit the tool)

I believe that will actually skip running a hook in CI, not skip updating it, per this explanation in the last line of that section:

this is equivalent to running SKIP=pylint pre-commit ...

[thekaveman]

Is there a way to tell pre-commit-ci we don't want updates for certain hooks but we're OK with getting updates for others?

not deep research by any means, but it doesn't look like it... pre-commit/pre-commit#1959

Their docs seem to indicate this is now supported 🤔 https://pre-commit.ci/#configuration-skip
(And note this is specifically the pre-commit CI service, which builds on top of pre-commit the tool)

I believe that will actually skip running a hook in CI, not skip updating it, per this explanation in the last line of that section:

this is equivalent to running SKIP=pylint pre-commit ...

Ah, damn, you are right

[jgravois]

if push comes to shove, we could also figure out how to get the prettier VSCode extension to load the latest and greatest (or find another solution for auto-formatting CSS because i think those are the only files prettier is even in charge of...

[Scotchester]

if push comes to shove, we could also figure out how to get the prettier VSCode extension to load the latest and greatest

Yeah, that's probably the better path to take.

Per the prettier-vscode README, since we're not specifying it, it's falling back to the bundled version, which is inexplicably set to ^2.8.8 still.

The unfortunate thing is that we currently have the glorious situation of not needing any Node dependencies, and this would be the first. Node module is the only officially supported installation, though there might be someone who's created a Python adapter or something.

or find another solution for auto-formatting CSS because i think those are the only files prettier is even in charge of

Or that could be good, too. (We do also use it for JS, though.)

---

Sidenote: I don't love that pre-commit/mirrors-prettier is pushing us toward an an alpha version. I hope that might be configurable, at least…

[angela-tran]

Gonna put this in Draft until we figure out what we want to do here

[jgravois]

just to leave a breadcrumb...

i noticed in cal-itp/calitp.org#537 that migrating calitp.org from esbenp.prettier-vscode to prettier.prettier-vscode will get us to prettier@3x all on its own.

that might be enough to unblock this PR all on its own 😇

[thekaveman]

@jgravois want to rebase this one on your latest changes from #3520 so we can finally start getting pre-commit updates again?? 🙏

[jgravois]

@jgravois want to rebase this one

you got it. 🤙 i had forgotten all about this 😂

[jgravois]

done and done. i'm particularly excited about this 👇

https://github.com/psf/black-pre-commit-mirror
Using this repository in your pre-commit config makes Black twice as fast.

[jgravois]

lgtm but i've had my hand in the cookie jar.

i'll wait a bit before merging in case anyone else wants to take a look themselves.

[thekaveman]

Let's wait until #3509 is merged, so we can rebase on that and then re-apply the prettier cleanups.

#3509 is now merged and this branch has been rebased on top of main.