Bump pre-commit from 4.6.1 to 4.6.2

[dependabot]

Bumps pre-commit from 4.6.1 to 4.6.2.

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Commits

• 9767b6c v4.6.2
• 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
• 3056619 fix language: node for hooks with build scripts and npm 11.x
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Review

This is a routine Dependabot dependency bump: pre-commit 4.6.1 → 4.6.2 in requirements/local.txt (+1/-1, dev-only tooling dependency).

• Code quality / bugs / security: N/A — no application code, config, or logic changes. pre-commit is a dev/CI tool, not a runtime dependency, so there's no production security surface here.
• Change content: The 4.6.2 release is a bugfix-only patch (fixes language: node hooks with "scripts": {"build": ...} under npm 11.x, per the linked changelog) — a strict improvement over 4.6.1 with low regression risk.
• Test coverage: No tests needed for a lockfile-style version bump; CI running pre-commit itself is sufficient verification.

LGTM — safe to merge.

[claude]

Review

Straightforward Dependabot patch bump: pre-commit 4.6.1 → 4.6.2 in requirements/local.txt.

• Scope: pre-commit is a dev-only tool (pre-commit hook runner), not part of the application runtime — no production code paths are affected.
• Change content: The 4.6.2 release is a narrow bugfix (fixes language: node hooks with npm 11.x "scripts": {"build": ...}, regressed in 4.6.1). No breaking changes noted in the release notes.
• Risk: Minimal — patch version, single line diff, no lockfile/transitive dependency changes visible in the diff.
• Tests: No test coverage needed for a tooling version bump; nothing in the app's behavior changes.

No concerns. Safe to merge.

[claude]

Review

Routine Dependabot bump (pre-commit 4.6.1 → 4.6.2, a patch release fixing language: node hooks with npm 11.x) plus two follow-up commits pinning flake8-isort/isort versions in .pre-commit-config.yaml. No production code is touched.

Code quality / correctness

• The added additional_dependencies pins (flake8-isort==7.0.0, isort==6.0.1) are internally consistent: flake8-isort==7.0.0 matches requirements/local.txt:32, and isort==6.0.1 matches the standalone isort hook's rev (.pre-commit-config.yaml:49). The comment block explaining why (unpinned additional_dependencies float independently of rev on rebuild, so the two isort resolutions silently diverged and produced conflicting I001/I005 verdicts) is exactly the kind of load-bearing rationale that's easy to lose — good call documenting it inline rather than just fixing it silently.
• Minor, pre-existing and unrelated to this PR: the flake8 hook is still pinned to rev: 7.2.0 (.pre-commit-config.yaml:54) while requirements/local.txt:31 specifies flake8==7.3.0. Not something to fix here, but worth a follow-up so local flake8 runs and the pre-commit hook stay on the same version.

Scope note

• The two non-Dependabot commits (d096f99, 0ac7a13) are unrelated to the version bump itself — they're a cherry-pick of a CI fix from Unbreak the linter job: pin flake8-isort/isort, and sync the mypy hook's stub pins #2281 to unblock this PR's own lint job. The commit messages explain this clearly and note it "no-ops once main carries the same change," which is a reasonable pragmatic call given Dependabot won't otherwise get past a red, unrelated CI failure. Just flagging for visibility in case a reviewer expects this diff to be bump-only — worth double-checking there's no conflict/duplication when Unbreak the linter job: pin flake8-isort/isort, and sync the mypy hook's stub pins #2281 actually merges.

Tests / security / performance

• Config-only change (.pre-commit-config.yaml, requirements/local.txt); no test coverage needed and no security or performance implications.

Overall: low risk, well-justified. LGTM.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[JSv4]

Picked this up as part of a batch pass over the open PRs. The review above had no open items ("LGTM — safe to merge"), and nothing about the bump itself needed changing. Two things happened to the branch:

main merged in to bring it up to date (it was based on 5ca0a1f).

One cherry-picked fix. linter was failing here for a reason unrelated to this bump: 10 I001/I005 findings in opencontractserver/llms/agents/pydantic_ai_agents.py and opencontractserver/utils/compact_pawls.py, neither of which this PR touches. It reproduces identically on a clean main — the flake8 hook's additional_dependencies: [flake8-isort] carried no version, and pre-commit re-resolves those on every hook-env rebuild, so flake8-isort floated to isort 9.0.1 while the standalone isort hook stayed rev-pinned to 6.0.1. The two disagree about repeated from X import (...) statements, so isort kept writing a layout flake8 rejected.

Fix is in #2281 and cherry-picked here so this PR can go green without waiting on it; it no-ops once #2281 merges.

Also confirmed the CLA check now passes — dependabot[bot] is on the cla.yml allowlist, so the earlier CLAAssistant failure was just a stale run from before that landed.

Current state: all checks green — linter, pytest, redis-integration, CodeQL, CLAAssistant, backend-ci-gate, and all three codecov/patch statuses.

---

Generated by Claude Code