Are we OK with the security implications of recommending this for every contributor's machine?
cc@sethmlarson

We're currently using tags asrev for our config, so that would allow any compromised pre-commit repo to instantly execute code by rewriting the tag on a repo. To mitigate this we could adopt using git commit SHAs instead of git tags in therev field, I believe that pre-commit supports this use-case?

It's obviously an extra support burden to upgrade and maintain these, but it removes the risk of a single compromise to a repository elsewhere from allowing RCE on all contributor machines.

To mitigate this we could adopt using git commit SHAs instead of git tags in the rev field, I believe that pre-commit supports this use-case?

Yes, by using--freeze with either of these commands:

prek autoupdate --freezepre-commit autoupdate --freeze

I'll remove it from here for now, and open an issue when this is merged.

Freezing the hooks inpython/cpython#140682.

This is a “soft redirect” for people who have#status-of-python-branches bookmarked. Can we keep it?

I think ~4 years is long enough.

Thinking of the old flow:

• Click my bookmark
• Taken tohttps://devguide.python.org/#status-of-python-branches
• Click "Moved toStatus of Python versions"
• Taken tohttps://devguide.python.org/versions/#versions

If someone has still been going through all that rigmarole for 4 years and hasn't updated their bookmarks, I think removing this is a good prompt.

I agree with Hugo, I'll remove it unless you feel strongly about keeping it.

We could add a redirect, but it would be quite messy, as such I don't think its worth it.

I think ~4 years is long enough.

Thinking of the old flow:

• Click my bookmark
• Taken tohttps://devguide.python.org/#status-of-python-branches
• Click "Moved toStatus of Python versions"
• Taken tohttps://devguide.python.org/versions/#versions

If someone has still been going through all that rigmarole for 4 years and hasn't updated their bookmarks, I think removing this is a good prompt.