jdx/hk v2.11.0

v2.11.0: Structured diagnostics from clippy, ruff, eslint, tsc, shellcheck and more builtins

on GitHub

In hk 2.11.0, many more builtins report structured diagnostics (file, line, column, rule and message), so --sarif, JSON output and the MCP dashboard now show them. It also fixes pre-commit checks that ran while a file deleted from the worktree was still staged in the index.

Added

• Diagnostics for more builtins (#1791, @jdx). Before this release, hk check --sarif, the diagnostics arrays in --format json/jsonl and the MCP dashboard were empty for many popular builtins. You got a failed step and a block of raw text. hk now parses the output these tools print by default, without changing any builtin's command:

  diagnostic_format	builtins
  rustc	cargo_clippy, cargo_check, ruff (0.12+), ty
  rustfmt	rustfmt, cargo_fmt (diff hunks reported as warnings)
  stylish	eslint, stylelint
  tsc	tsc, tsserver
  shellcheck	shellcheck
  pyright	pyright
  biome	biome
  gcc-paren	golangci_lint, staticcheck

  $ hk check --all --format json | jq -c '.steps[].diagnostics[]'
  {"step":"cargo_clippy","tool":"cargo_clippy","severity":"warning","message":"length comparison to zero","path":"src/main.rs","range":{"start":{"line":4,"column":8}},"rule":"clippy::len_zero","help_url":"https://rust-lang.github.io/rust-clippy/beta/index.html#len_zero"}

  You can also set these formats on your own steps with diagnostic_format. Before parsing, hk strips terminal colour codes. Lines it doesn't recognise appear as parse_warnings only when hk finds no diagnostics in the output, so tool crashes and configuration errors still show up. Ruff versions before 0.12 use an older output format, so their findings appear as a parse warning. yamllint still has no default format because its output changes under GitHub Actions. Outside Actions, you can set diagnostic_format = "stylish" on a yamllint step yourself.

• Install instructions in the builtins docs (#1785, @jdx). Each builtin that needs an external tool now has an Install line on the built-in linters page, such as mise use shfmt or mise use npm:eslint. Tools that mise doesn't provide link to their project page instead.

Fixed

• Unstaged deletions with stash = "git" (#1789, @jdx). If you deleted a tracked file from the worktree but didn't stage the deletion, the file stayed missing while pre-commit checks ran, even though the commit would include it. As a result, checks could fail on a valid commit, or skip a file because it looked absent. hk now puts back the indexed version of the file while the hook runs, then deletes it again afterwards, still unstaged. If a step stages the deletion itself, hk removes the file afterwards. If the step also writes new contents to that path, hk keeps them, reports the path as not restored and keeps the stash entry.
• Build-time security advisory (#1793, @jdx). libz-sys is updated to 1.1.31 to fix RUSTSEC-2026-0418. In 1.1.30, the build script printed the full build environment, which could leak secrets into target/ caches when building hk from source.

Full Changelog: v2.10.0...v2.11.0

💚 Sponsor hk

hk is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If hk speeds up your pre-commit loop or makes linting less painful, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep hk fast, free, and independent.