diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc6c60a..a621466 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,11 @@ jobs:
   test:
     name: Test Suite
     runs-on: ubuntu-latest
+    # beta/nightly are informational: a toolchain regression upstream should not
+    # gate merges, but we still want to see it.
+    continue-on-error: ${{ matrix.rust != 'stable' }}
     strategy:
+      fail-fast: false
       matrix:
         rust:
           - stable
@@ -52,6 +56,20 @@ jobs:
           path: target
           key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.rust }}
 
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-nextest
+
+      # The integration harness shells out to git; give it a committer identity.
+      - name: Setup git
+        run: |
+          git config --global user.email "ci@example.com"
+          git config --global user.name "CI"
+
+      - name: Run tests
+        run: cargo nextest run --all-features --no-fail-fast
+
   lint:
     name: lint
     runs-on: ubuntu-latest
@@ -80,12 +98,20 @@ jobs:
             pkl = "latest"
             typos = { version = "latest", depends = ["rust"] }
     
-      - name: Run hk ci workflow
+      # mise installs the toolchain without optional components, so cargo_fmt and
+      # cargo_clippy have no binary to call.
+      - name: Add rustfmt and clippy components
+        run: rustup component add rustfmt clippy
+
+      # --all: hk defaults to staged/changed files, which on a fresh CI checkout
+      # leaves most steps with nothing to do. --skip-step cargo_test: the test
+      # job above owns running the suite. --no-fail-fast: report every lint
+      # problem in one run instead of aborting the rest on the first failure.
+      - name: Run hk check
         env:
           HK_MISE: 1
           MISE_YES: 1
-        run: |
-          hk check || cd ../ && hk check
+        run: hk check --all --skip-step cargo_test --no-fail-fast
 
   security_audit:
     name: Security Audit
@@ -98,7 +124,9 @@ jobs:
       - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN || github.token }}
-          ignore: RUSTSEC-2024-0364,RUSTSEC-2024-0436
+          # Keep in sync with the `ignore` list in deny.toml, which documents why
+          # each of these is accepted.
+          ignore: RUSTSEC-2024-0364,RUSTSEC-2024-0436,RUSTSEC-2026-0044,RUSTSEC-2026-0048
 
   coverage:
     name: Code Coverage
diff --git a/Cargo.lock b/Cargo.lock
index 5cddd12..3038f31 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -84,9 +84,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arc-swap"
@@ -451,9 +451,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1225,7 +1225,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b305d85504de270ad3525d726a6b69cc59ee7b2269b014387651107ab9f0755b"
 dependencies = [
  "bstr",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
diff --git a/README.md b/README.md
index 52863c7..245ac91 100644
--- a/README.md
+++ b/README.md
@@ -319,7 +319,7 @@ submod completeme bash > ~/.bash_completion.d/submod
 
 ```zsh "zsh"
 # zsh has an fpath array with possible function directories. You can
-# put your competions in any of these; we use the first one here:
+# put your completions in any of these; we use the first one here:
 ZSH_DEFAULT="${XDG_DATA_HOME:-~/.local/share}/zsh/site-functions"
 ZFUNCDIR=""${fpath[1]:-$ZSH_DEFAULT}"
 mkdir -p "$ZFUNCDIR"
diff --git a/_typos.toml b/_typos.toml
index 1ec392d..5064868 100755
--- a/_typos.toml
+++ b/_typos.toml
@@ -7,7 +7,7 @@ locale = "en-us"
 check-file = true
 check-filename = true
 extend-ignore-re = [
-  "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on"
+  "(?s)(#|//|<!--)\\s*spellchecker:off.*?\\n\\s*(#|//|<!--)\\s*spellchecker:on"
 ]
 extend-ignore-identifiers-re = [
   "iif",
@@ -30,5 +30,6 @@ extend-exclude = [
   ".venv/",
   ".git/",
   "target/",
-  "docs/"
+  "docs/",
+  "CHANGELOG.md",
 ]
diff --git a/deny.toml b/deny.toml
index cfeee2e..9deb94d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -83,6 +83,14 @@ feature-depth = 1
 ignore = [
   "RUSTSEC-2024-0364", # gitoxide-core does not neutralize special characters for terminals. No patched version available.
   "RUSTSEC-2024-0436", # paste is unmaintained; it is a transitive dependency via rustls-ffi -> macro_rules_attribute and has no patched version or security impact.
+  # aws-lc-sys 0.38.0 X.509 issues, both patched in >=0.39.0, but we cannot reach it:
+  # aws-lc-rs pins aws-lc-sys exactly, and it arrives transitively via
+  # gix[blocking-http-transport-curl-rustls] -> curl-sys -> rustls-ffi -> rustls -> aws-lc-rs.
+  # submod does not enable CRL checking and does not do its own certificate validation;
+  # it fetches from standard WebPKI hosts, whose certs carry dNSName SANs (the case both
+  # advisories call out as unaffected). Revisit when aws-lc-rs ships a bump.
+  "RUSTSEC-2026-0044", # AWS-LC X.509 name constraints bypass via wildcard/Unicode CN.
+  "RUSTSEC-2026-0048", # AWS-LC CRL distribution point scope check logic error.
   # "RUSTSEC-0000-0000",
   # { id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
   # "a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish
diff --git a/hk.pkl b/hk.pkl
index 1b2b76d..aeed609 100644
--- a/hk.pkl
+++ b/hk.pkl
@@ -4,15 +4,20 @@
  * SPDX-License-Identifier: LicenseRef-PlainMIT OR MIT
 */
 
-amends "package://github.com/jdx/hk/releases/download/v1.2.0/hk@1.2.0#/Config.pkl"
-import "package://github.com/jdx/hk/releases/download/v1.2.0/hk@1.2.0#/Builtins.pkl"
+amends "package://github.com/jdx/hk/releases/download/v1.48.0/hk@1.48.0#/Config.pkl"
+import "package://github.com/jdx/hk/releases/download/v1.48.0/hk@1.48.0#/Builtins.pkl"
 
 local linters = new Mapping<String, Step> {
 
     ["cargo_deny"] = new Step {
         workspace_indicator = "Cargo.toml"
         glob = "Cargo.lock"
-        check = "cargo deny --all-features --manifest-path {{ workspace_indicator }} -f json -L warn check --audit-compatible-output --exclude-dev --hide-inclusion-graph | jq -e '.[].vulnerabilities | length == 0' || exit 1"
+        // Gate on vulnerabilities only, letting cargo-deny's own exit code decide.
+        // (The previous `-f json ... | jq -e '.[].vulnerabilities | length == 0'`
+        // pipeline no longer parses: with `-f json` cargo-deny streams one object
+        // per diagnostic, not an array, so jq failed with exit 5 on every run.)
+        // --exclude-dev is a top-level flag; it moved off the `check` subcommand.
+        check = "cargo deny --all-features --manifest-path {{ workspace_indicator }} --exclude-dev -L warn check advisories --hide-inclusion-graph -A unsound -A unmaintained -A yanked -A notice"
     }
     ["cargo_fmt"] = Builtins.cargo_fmt
     ["cargo_clippy"] = Builtins.cargo_clippy
@@ -29,9 +34,13 @@ local linters = new Mapping<String, Step> {
     // Spellchecker
     ["typos"] = new Step {
         workspace_indicator = "_typos.toml"
-        glob = List( "*README", "*.{.login,astro,bash,bash_logout,bashrc,browserlistrc,conf,config,csh,css,cts,fish,gitattributes,gitmodules,html,htmx,ini,j2,jinja,jinja2,json,json5,jsonc,jsonl,ksh,md,mdown,mdtext,mdtxt,mdwn,mdx,mk,mkd,mts,nix,nu,pkl,profile,quokka,sass,scss,sh,sh,shellcheckrc,sql,sqlite,stylelintrc,svelte,tcsh,toml,ts,tsx,txt,yaml,yml,zlogin,zlogout,zprofile,zsh,zshenv,zshrc}", "*Dockerfile*", "*Makefile*", "*makefile*", "CHANGELOG*", "CODE_OF_CONDUCT*", "CONTRIBUTING*", "HACKING*", "LICENSE", "README*", "SECURITY*", "UNLICENSE")
-        check = "typos -j 8 --config {{ workspace_indicator }} {{ files }}"
-        fix = "typos --write-changes --config {{ workspace_indicator }} {{ files }}"
+        glob = List( "*README", "*.{.login,astro,bash,bash_logout,bashrc,browserlistrc,conf,config,csh,css,cts,fish,gitattributes,gitmodules,html,htmx,ini,j2,jinja,jinja2,json,json5,jsonc,jsonl,ksh,md,mdown,mdtext,mdtxt,mdwn,mdx,mk,mkd,mts,nix,nu,pkl,profile,quokka,sass,scss,sh,sh,shellcheckrc,sql,sqlite,stylelintrc,svelte,tcsh,toml,ts,tsx,txt,yaml,yml,zlogin,zlogout,zprofile,zsh,zshenv,zshrc}", "*Dockerfile*", "*Makefile*", "*makefile*", "CODE_OF_CONDUCT*", "CONTRIBUTING*", "HACKING*", "LICENSE", "README*", "SECURITY*", "UNLICENSE")
+        // CHANGELOG.md is generated by git-cliff from commit subjects; abbreviated
+        // commit hashes trip the spellchecker. _typos.toml also excludes it, but that
+        // only applies when typos walks a directory — hk passes explicit file paths.
+        exclude = "CHANGELOG.md"
+        check = "typos -j 8 {{ files }}"
+        fix = "typos --write-changes {{ files }}"
     }
 
 
@@ -68,12 +77,9 @@ hooks {
         steps = linters
     }
     ["test"] {
-        steps =  linters
-                    .toMap()
-                    .filter(
-                        (name, _) -> name == "cargo_test")
-                    .toMapping()
-
+        steps = new Mapping<String, Step> {
+            ["cargo_test"] = linters["cargo_test"]
+        }
     }
 
     ["ci"] {
diff --git a/mise.toml b/mise.toml
index d6fd602..c7343cd 100644
--- a/mise.toml
+++ b/mise.toml
@@ -16,7 +16,7 @@ cargo-binstall = "latest"
 "cargo:cargo-nextest" = "latest" # For running tests in parallel.
 "cargo:cargo-smart-release" = "latest" # For automating releases.
 "cargo:cargo-watch" = "latest" # For watching files and rerunning commands.
-hk = "latest"  # Handles git hooks, like pre-commit.
+hk = "1.48"  # Handles git hooks, like pre-commit. Pinned to match CI; hk.pkl targets the 1.48 schema.
 jq = "latest"
 pkl = "latest"  # pkl for `hk`, which handles git hooks
 rust = "1.96"
diff --git a/src/commands.rs b/src/commands.rs
index b589787..6660afb 100644
--- a/src/commands.rs
+++ b/src/commands.rs
@@ -125,7 +125,7 @@ pub enum Commands {
             num_args = 0..=1,
             value_parser = clap::value_parser!(bool),
             default_missing_value = "true",
-            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behaviour instead. When set, the `!/*` prefix is NOT prepended automatically."
+            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behavior instead. When set, the `!/*` prefix is NOT prepended automatically."
         )]
         use_git_default_sparse_checkout: Option<bool>,
 
@@ -180,7 +180,7 @@ pub enum Commands {
             num_args = 0..=1,
             value_parser = clap::value_parser!(bool),
             default_missing_value = "true",
-            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behaviour instead."
+            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behavior instead."
         )]
         use_git_default_sparse_checkout: Option<bool>,
 
@@ -248,7 +248,7 @@ pub enum Commands {
             num_args = 0..=1,
             value_parser = clap::value_parser!(bool),
             default_missing_value = "true",
-            help = "Set the global default for sparse-checkout mode. When true, all submodules use git's built-in behaviour instead of submod's deny-all-by-default model (unless overridden per-submodule)."
+            help = "Set the global default for sparse-checkout mode. When true, all submodules use git's built-in behavior instead of submod's deny-all-by-default model (unless overridden per-submodule)."
         )]
         use_git_default_sparse_checkout: Option<bool>,
     },
diff --git a/src/config.rs b/src/config.rs
index c25c593..3ef26d6 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -174,7 +174,7 @@ pub struct SubmoduleDefaults {
     pub fetch_recurse: Option<SerializableFetchRecurse>,
     /// [`Update`][SerializableUpdate] setting for submodules
     pub update: Option<SerializableUpdate>,
-    /// When `true`, use git's built-in sparse-checkout behaviour (no `!/*` prefix is
+    /// When `true`, use git's built-in sparse-checkout behavior (no `!/*` prefix is
     /// prepended). Defaults to `false`, which uses submod's deny-all-by-default model.
     /// Individual submodules can override this per-entry.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -471,7 +471,7 @@ pub struct SubmoduleEntry {
     /// Sparse checkout paths for this submodule (optional)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub sparse_paths: Option<Vec<String>>,
-    /// When `true`, use git's built-in sparse-checkout behaviour instead of submod's
+    /// When `true`, use git's built-in sparse-checkout behavior instead of submod's
     /// deny-all-by-default model.  Overrides the global `[defaults]` setting.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub use_git_default_sparse_checkout: Option<bool>,
diff --git a/src/git_manager.rs b/src/git_manager.rs
index 3e25b10..ae28fb3 100644
--- a/src/git_manager.rs
+++ b/src/git_manager.rs
@@ -320,8 +320,7 @@ impl GitManager {
         // Check if submodule has its own submodules
         let has_submodules = submodule_repo
             .submodules()
-            .map(|subs| subs.is_some_and(|mut iter| iter.next().is_some()))
-            .unwrap_or(false);
+            .is_ok_and(|subs| subs.is_some_and(|mut iter| iter.next().is_some()));
 
         Ok(SubmoduleStatus {
             path: submodule_path.to_string(),
@@ -406,8 +405,13 @@ impl GitManager {
         no_init: bool,
         use_git_default_sparse_checkout: Option<bool>,
     ) -> Result<(), SubmoduleError> {
-        let repo_root = self.git_ops.workdir().ok_or(SubmoduleError::RepositoryError)?;
-        if let Err(e) = crate::utilities::validate_submodule_path(repo_root, std::path::Path::new(&path)) {
+        let repo_root = self
+            .git_ops
+            .workdir()
+            .ok_or(SubmoduleError::RepositoryError)?;
+        if let Err(e) =
+            crate::utilities::validate_submodule_path(repo_root, std::path::Path::new(&path))
+        {
             return Err(SubmoduleError::InvalidPath(e.to_string()));
         }
 
@@ -531,7 +535,7 @@ impl GitManager {
     ///
     /// By default (`use_git_default = false`) the deny-all-by-default model is applied:
     /// `!/*` is prepended so only the explicitly listed `patterns` are checked out, and a
-    /// one-time informational message is printed to help users understand the behaviour and
+    /// one-time informational message is printed to help users understand the behavior and
     /// opt out if needed.
     ///
     /// When `use_git_default = true` the patterns are written as-is, matching git's own
@@ -552,7 +556,7 @@ impl GitManager {
                 eprintln!(
                     "ℹ️  submod uses a deny-all-by-default sparse-checkout model: `!/*` is \
                      automatically prepended so only the paths you list are checked out.\n\
-                     To use git's default behaviour instead, set \
+                     To use git's default behavior instead, set \
                      `use_git_default_sparse_checkout = true` in your submod.toml (globally \
                      under `[defaults]` or per submodule) or pass \
                      `--use-git-default-sparse-checkout`."
@@ -589,7 +593,7 @@ impl GitManager {
     ///
     /// This implements the "modified cone pattern" approach: all paths are denied by
     /// default and only the explicitly listed patterns are checked out. This makes the
-    /// intent clear and avoids surprises from git's default include-everything behaviour.
+    /// intent clear and avoids surprises from git's default include-everything behavior.
     ///
     /// Blank entries (empty or whitespace-only strings) are stripped before processing.
     /// If no non-blank include patterns remain after normalization, an empty list is
@@ -1477,7 +1481,7 @@ impl GitManager {
                 entries
                     .submodule_iter()
                     .find(|(_, e)| e.path.as_deref() == Some(path.as_str()))
-                    .map(|(n, _)| n.to_string())
+                    .map(|(n, _)| n.clone())
             };
 
             if let Some(gm_name) = gitmodules_name {
@@ -1876,7 +1880,7 @@ mod tests {
     use tempfile::tempdir;
 
     // Helper to create a `GitManager` for tests that need to call methods such as
-    // `check_sparse_checkout_status`. It initialises a real git repository in `repo_dir`
+    // `check_sparse_checkout_status`. It initializes a real git repository in `repo_dir`
     // via `git2` so that `GitOpsManager` can open it without depending on the caller's
     // working directory being inside a git repo.
     fn create_test_manager(repo_dir: &Path, config_path: PathBuf) -> GitManager {
diff --git a/src/git_ops/git2_ops.rs b/src/git_ops/git2_ops.rs
index 0194f7e..4a802c5 100644
--- a/src/git_ops/git2_ops.rs
+++ b/src/git_ops/git2_ops.rs
@@ -208,7 +208,9 @@ impl GitOperations for Git2Operations {
         ))
     }
     fn write_gitmodules(&mut self, config: &SubmoduleEntries) -> Result<()> {
-        let workdir = self.repo.workdir()
+        let workdir = self
+            .repo
+            .workdir()
             .ok_or_else(|| anyhow::anyhow!("Repository has no working directory"))?;
         let gitmodules_path = workdir.join(".gitmodules");
 
@@ -239,10 +241,16 @@ impl GitOperations for Git2Operations {
                 gitmodules_config.set_str(&format!("{section}.ignore"), &ignore.to_gitmodules())?;
             }
             if let Some(fetch_recurse) = &entry.fetch_recurse {
-                gitmodules_config.set_str(&format!("{section}.fetchRecurseSubmodules"), &fetch_recurse.to_gitmodules())?;
+                gitmodules_config.set_str(
+                    &format!("{section}.fetchRecurseSubmodules"),
+                    &fetch_recurse.to_gitmodules(),
+                )?;
             }
             if let Some(active) = entry.active {
-                gitmodules_config.set_str(&format!("{section}.active"), if active { "true" } else { "false" })?;
+                gitmodules_config.set_str(
+                    &format!("{section}.active"),
+                    if active { "true" } else { "false" },
+                )?;
             }
 
             // 2. Sync to local repository config (.git/config) if the submodule exists in the repository
diff --git a/src/git_ops/gix_ops.rs b/src/git_ops/gix_ops.rs
index 3ae6e6c..8fc7c8b 100644
--- a/src/git_ops/gix_ops.rs
+++ b/src/git_ops/gix_ops.rs
@@ -500,7 +500,7 @@ impl GitOperations for GixOperations {
         let submodule_name = entries
             .submodule_iter()
             .find(|(_, entry)| entry.path.as_ref() == Some(&path.to_string()))
-            .map(|(name, _)| name.to_string())
+            .map(|(name, _)| name.clone())
             .ok_or_else(|| anyhow::anyhow!("Submodule '{path}' not found in .gitmodules"))?;
 
         // 3. Remove from .gitmodules
@@ -583,7 +583,7 @@ impl GitOperations for GixOperations {
         let submodule_name = entries
             .submodule_iter()
             .find(|(_, entry)| entry.path.as_ref() == Some(&path.to_string()))
-            .map(|(name, _)| name.to_string())
+            .map(|(name, _)| name.clone())
             .ok_or_else(|| anyhow::anyhow!("Submodule '{path}' not found in .gitmodules"))?;
         self.clone().try_gix_operation_mut(|repo| {
             // 1. Get the submodule directory
diff --git a/src/git_ops/simple_gix.rs b/src/git_ops/simple_gix.rs
index d0fb74c..6a5189a 100644
--- a/src/git_ops/simple_gix.rs
+++ b/src/git_ops/simple_gix.rs
@@ -26,7 +26,7 @@ pub fn setup_line_renderer_range(
         prodash::render::line::Options {
             level_filter: Some(levels),
             frames_per_second: 6.0,
-            initial_delay: Some(std::time::Duration::from_millis(1000)),
+            initial_delay: Some(std::time::Duration::from_secs(1)),
             timestamp: true,
             throughput: true,
             hide_cursor: true,
diff --git a/src/options.rs b/src/options.rs
index 9b1bd47..cc39ce3 100644
--- a/src/options.rs
+++ b/src/options.rs
@@ -462,7 +462,7 @@ impl GitmodulesConvert for SerializableBranch {
     fn to_gitmodules(&self) -> String {
         match self {
             Self::CurrentInSuperproject => ".".to_string(),
-            Self::Name(name) => name.to_string(),
+            Self::Name(name) => name.clone(),
         }
     }
 
diff --git a/src/utilities.rs b/src/utilities.rs
index 8839fce..8ebfd83 100644
--- a/src/utilities.rs
+++ b/src/utilities.rs
@@ -227,12 +227,17 @@ pub fn get_name(
 
 /// Validate a submodule path to ensure it is not absolute and does not escape
 /// the repository root via directory traversal (`..`) or symbolic links.
-pub fn validate_submodule_path(repo_root: &std::path::Path, path: &std::path::Path) -> Result<(), anyhow::Error> {
+pub fn validate_submodule_path(
+    repo_root: &std::path::Path,
+    path: &std::path::Path,
+) -> Result<(), anyhow::Error> {
     if path.is_absolute() {
         return Err(anyhow::anyhow!("Submodule path cannot be absolute"));
     }
 
-    let repo_root = repo_root.canonicalize().unwrap_or_else(|_| repo_root.to_path_buf());
+    let repo_root = repo_root
+        .canonicalize()
+        .unwrap_or_else(|_| repo_root.to_path_buf());
 
     let mut current = repo_root.clone();
     for component in path.components() {
@@ -247,9 +252,9 @@ pub fn validate_submodule_path(repo_root: &std::path::Path, path: &std::path::Pa
                     } else {
                         current.parent().unwrap().join(target)
                     };
-                    let canonical_resolved = resolved.canonicalize().unwrap_or_else(|_| {
-                        normalize_path_only(&resolved)
-                    });
+                    let canonical_resolved = resolved
+                        .canonicalize()
+                        .unwrap_or_else(|_| normalize_path_only(&resolved));
                     if !canonical_resolved.starts_with(&repo_root) {
                         return Err(anyhow::anyhow!(
                             "Submodule path escapes repository root via symlink: {}",
@@ -267,17 +272,21 @@ pub fn validate_submodule_path(repo_root: &std::path::Path, path: &std::path::Pa
             }
             std::path::Component::CurDir => {}
             std::path::Component::Prefix(_) | std::path::Component::RootDir => {
-                return Err(anyhow::anyhow!("Submodule path cannot contain root or prefix components"));
+                return Err(anyhow::anyhow!(
+                    "Submodule path cannot contain root or prefix components"
+                ));
             }
         }
     }
 
     // Also check the final resolved path
-    let final_canonical = current.canonicalize().unwrap_or_else(|_| {
-        normalize_path_only(&current)
-    });
+    let final_canonical = current
+        .canonicalize()
+        .unwrap_or_else(|_| normalize_path_only(&current));
     if !final_canonical.starts_with(&repo_root) {
-        return Err(anyhow::anyhow!("Submodule path resolves outside repository root"));
+        return Err(anyhow::anyhow!(
+            "Submodule path resolves outside repository root"
+        ));
     }
 
     Ok(())
diff --git a/tests/config_tests.rs b/tests/config_tests.rs
index 8499b52..5d53939 100644
--- a/tests/config_tests.rs
+++ b/tests/config_tests.rs
@@ -341,17 +341,18 @@ sparse_paths = ["src/**", "docs/*", "*.{md,txt,rst}"]
 
     #[test]
     fn test_public_surface_coverage() {
-        use submod::config::{SubmoduleUpdateOptions, SubmoduleEntry, OtherSubmoduleSettings, SubmoduleGitOptions, SubmoduleEntries};
-        use submod::options::{SerializableUpdate, SerializableFetchRecurse, SerializableIgnore, SerializableBranch};
-        use submod::git_ops::Git2Operations;
         use std::collections::HashMap;
+        use submod::config::{
+            OtherSubmoduleSettings, SubmoduleEntries, SubmoduleEntry, SubmoduleGitOptions,
+            SubmoduleUpdateOptions,
+        };
+        use submod::git_ops::Git2Operations;
+        use submod::options::{
+            SerializableBranch, SerializableFetchRecurse, SerializableIgnore, SerializableUpdate,
+        };
 
         // 1. Test SubmoduleUpdateOptions methods
-        let update_opts = SubmoduleUpdateOptions::new(
-            SerializableUpdate::Rebase,
-            true,
-            false,
-        );
+        let update_opts = SubmoduleUpdateOptions::new(SerializableUpdate::Rebase, true, false);
         assert_eq!(update_opts.strategy, SerializableUpdate::Rebase);
         assert!(update_opts.recursive);
         assert!(!update_opts.force);
@@ -395,18 +396,22 @@ sparse_paths = ["src/**", "docs/*", "*.{md,txt,rst}"]
             no_init: true,
         };
 
-        let entry_from_opts = SubmoduleEntry::from_options_and_settings(
-            git_opts.clone(),
-            other_settings.clone(),
+        let entry_from_opts =
+            SubmoduleEntry::from_options_and_settings(git_opts.clone(), other_settings.clone());
+        assert_eq!(
+            entry_from_opts.url.as_deref(),
+            Some("https://example.com/repo-new.git")
         );
-        assert_eq!(entry_from_opts.url.as_deref(), Some("https://example.com/repo-new.git"));
         assert_eq!(entry_from_opts.path.as_deref(), Some("lib/test-new"));
         assert_eq!(entry_from_opts.active, Some(false));
         assert_eq!(entry_from_opts.shallow, Some(true));
         assert_eq!(entry_from_opts.no_init, Some(true));
 
         let updated_entry = entry.update_with_settings(other_settings);
-        assert_eq!(updated_entry.url.as_deref(), Some("https://example.com/repo-new.git"));
+        assert_eq!(
+            updated_entry.url.as_deref(),
+            Some("https://example.com/repo-new.git")
+        );
         assert_eq!(updated_entry.path.as_deref(), Some("lib/test-new"));
         assert_eq!(updated_entry.active, Some(false));
         assert_eq!(updated_entry.shallow, Some(true));
@@ -417,18 +422,37 @@ sparse_paths = ["src/**", "docs/*", "*.{md,txt,rst}"]
         let entry_to_insert = SubmoduleEntry::new(
             Some("https://example.com/repo.git".to_string()),
             Some("lib/test".to_string()),
-            None, None, None, None, Some(true), Some(false), Some(false)
+            None,
+            None,
+            None,
+            None,
+            Some(true),
+            Some(false),
+            Some(false),
         );
         entries.update_entry("test-sub".to_string(), entry_to_insert);
-        
+
         // Test set_sparse_paths_for when paths is not empty
         entries.set_sparse_paths_for("test-sub", vec!["src/".to_string(), "docs/".to_string()]);
-        let stored_entry = entries.iter().find(|(name, _)| *name == "test-sub").unwrap().1.0;
-        assert_eq!(stored_entry.sparse_paths, Some(vec!["src/".to_string(), "docs/".to_string()]));
+        let stored_entry = entries
+            .iter()
+            .find(|(name, _)| *name == "test-sub")
+            .unwrap()
+            .1
+            .0;
+        assert_eq!(
+            stored_entry.sparse_paths,
+            Some(vec!["src/".to_string(), "docs/".to_string()])
+        );
 
         // Test set_sparse_paths_for when paths is empty
         entries.set_sparse_paths_for("test-sub", vec![]);
-        let stored_entry_empty = entries.iter().find(|(name, _)| *name == "test-sub").unwrap().1.0;
+        let stored_entry_empty = entries
+            .iter()
+            .find(|(name, _)| *name == "test-sub")
+            .unwrap()
+            .1
+            .0;
         assert_eq!(stored_entry_empty.sparse_paths, None);
 
         // 4. Test Config loading and sync methods using a real test harness
@@ -455,11 +479,14 @@ active = true
         assert_eq!(config.defaults.ignore, Some(SerializableIgnore::Dirty));
 
         // Test sync_with_git_config and load_with_git_sync
-        let mut git_ops = Git2Operations::new(Some(&harness.work_dir)).expect("Failed to open git_ops");
-        
+        let mut git_ops =
+            Git2Operations::new(Some(&harness.work_dir)).expect("Failed to open git_ops");
+
         // Initially, config has a submodule but gitmodules has nothing.
         // We sync config with git config, which should write the submodule to .gitmodules
-        config.sync_with_git_config(&mut git_ops).expect("Failed to sync_with_git_config");
+        config
+            .sync_with_git_config(&mut git_ops)
+            .expect("Failed to sync_with_git_config");
 
         // Verify .gitmodules was written
         let gitmodules_content = harness.gitmodules_entries();
@@ -469,6 +496,9 @@ active = true
         let loaded_sync_config = submod::Config::default()
             .load_with_git_sync(&config_path, &mut git_ops, submod::Config::default())
             .expect("Failed to load_with_git_sync");
-        assert_eq!(loaded_sync_config.defaults.ignore, Some(SerializableIgnore::Dirty));
+        assert_eq!(
+            loaded_sync_config.defaults.ignore,
+            Some(SerializableIgnore::Dirty)
+        );
     }
 }
diff --git a/tests/error_handling_tests.rs b/tests/error_handling_tests.rs
index 8aeb1e0..2de5b28 100644
--- a/tests/error_handling_tests.rs
+++ b/tests/error_handling_tests.rs
@@ -139,7 +139,9 @@ mod tests {
             assert_eq!(output.status.code(), Some(1));
             let stderr = String::from_utf8_lossy(&output.stderr);
             assert!(
-                stderr.contains("Failed to add submodule") || stderr.contains("Not a directory") || stderr.contains("not a directory"),
+                stderr.contains("Failed to add submodule")
+                    || stderr.contains("Not a directory")
+                    || stderr.contains("not a directory"),
                 "Expected directory collision/IO failure message, got: {stderr}"
             );
         } else {
@@ -396,7 +398,9 @@ active = true
             assert_eq!(output.status.code(), Some(1));
             let stderr = String::from_utf8_lossy(&output.stderr);
             assert!(
-                stderr.contains("Failed to add submodule") || stderr.contains("space") || stderr.contains("disk"),
+                stderr.contains("Failed to add submodule")
+                    || stderr.contains("space")
+                    || stderr.contains("disk"),
                 "Expected failure message containing space/disk details, got: {stderr}"
             );
         }
@@ -540,7 +544,9 @@ active = true
             assert_eq!(output.status.code(), Some(1));
             let stderr = String::from_utf8_lossy(&output.stderr);
             assert!(
-                stderr.contains("Is a directory") || stderr.contains("Failed to save config") || stderr.contains("is a directory"),
+                stderr.contains("Is a directory")
+                    || stderr.contains("Failed to save config")
+                    || stderr.contains("is a directory"),
                 "Expected directory write/config save failure message, got: {stderr}"
             );
 
diff --git a/tests/performance_tests.rs b/tests/performance_tests.rs
index fcac9c0..494a15f 100644
--- a/tests/performance_tests.rs
+++ b/tests/performance_tests.rs
@@ -23,7 +23,6 @@ static ALLOCATED: AtomicUsize = AtomicUsize::new(0);
 static PEAK_ALLOCATED: AtomicUsize = AtomicUsize::new(0);
 
 unsafe impl GlobalAlloc for TrackingAllocator {
-
     unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
         let ptr = unsafe { System.alloc(layout) };
         if !ptr.is_null() {
@@ -32,7 +31,11 @@ unsafe impl GlobalAlloc for TrackingAllocator {
             let current = prev + size;
             loop {
                 let peak = PEAK_ALLOCATED.load(Ordering::Relaxed);
-                if current <= peak || PEAK_ALLOCATED.compare_exchange_weak(peak, current, Ordering::Relaxed, Ordering::Relaxed).is_ok() {
+                if current <= peak
+                    || PEAK_ALLOCATED
+                        .compare_exchange_weak(peak, current, Ordering::Relaxed, Ordering::Relaxed)
+                        .is_ok()
+                {
                     break;
                 }
             }
@@ -461,7 +464,10 @@ ignore = "all"
         std::env::set_current_dir(orig_dir).ok();
 
         println!("Large operations in-process time: {duration:?}");
-        println!("Peak memory usage during large operations: {} KB", net_peak / 1024);
+        println!(
+            "Peak memory usage during large operations: {} KB",
+            net_peak / 1024
+        );
 
         // Assert memory usage is within reasonable bounds (e.g. less than 20 MB)
         assert!(
@@ -598,16 +604,21 @@ active = true
             .expect("Failed to create remote 2");
         let remote_url2 = format!("file://{}", remote_repo2.display());
 
-        let output = harness.run_submod(&[
-            "add",
-            &remote_url2,
-            "--name",
-            "lock-sub2",
-            "--path",
-            "lib/lock-sub2",
-        ]).expect("Failed to run submod");
+        let output = harness
+            .run_submod(&[
+                "add",
+                &remote_url2,
+                "--name",
+                "lock-sub2",
+                "--path",
+                "lib/lock-sub2",
+            ])
+            .expect("Failed to run submod");
 
-        assert!(!output.status.success(), "Command should fail when index is locked");
+        assert!(
+            !output.status.success(),
+            "Command should fail when index is locked"
+        );
         let stderr = String::from_utf8_lossy(&output.stderr);
         assert!(
             stderr.contains("index.lock") || stderr.contains("lock") || stderr.contains("failed"),
@@ -618,17 +629,20 @@ active = true
         fs::remove_file(&super_lock_path).expect("Failed to remove lock file");
 
         // Now it should succeed
-        harness.run_submod_success(&[
-            "add",
-            &remote_url2,
-            "--name",
-            "lock-sub2",
-            "--path",
-            "lib/lock-sub2",
-        ]).expect("Failed to add submodule after lock release");
+        harness
+            .run_submod_success(&[
+                "add",
+                &remote_url2,
+                "--name",
+                "lock-sub2",
+                "--path",
+                "lib/lock-sub2",
+            ])
+            .expect("Failed to add submodule after lock release");
 
         // Lock the submodule's index
-        let sub_git_dir = harness.get_sparse_checkout_file_path("lib/lock-sub")
+        let sub_git_dir = harness
+            .get_sparse_checkout_file_path("lib/lock-sub")
             .parent() // info
             .unwrap()
             .parent() // gitdir root
@@ -638,8 +652,13 @@ active = true
         fs::write(&sub_lock_path, "locked").expect("Failed to create submodule lock file");
 
         // Run reset which modifies the submodule index, and verify failure
-        let output2 = harness.run_submod(&["reset", "lock-sub"]).expect("Failed to run reset");
-        assert!(!output2.status.success(), "Reset should fail when submodule index is locked");
+        let output2 = harness
+            .run_submod(&["reset", "lock-sub"])
+            .expect("Failed to run reset");
+        assert!(
+            !output2.status.success(),
+            "Reset should fail when submodule index is locked"
+        );
 
         // Clean up lock
         fs::remove_file(&sub_lock_path).expect("Failed to remove submodule lock");
diff --git a/tests/security_tests.rs b/tests/security_tests.rs
index e2f57b0..ad375b8 100644
--- a/tests/security_tests.rs
+++ b/tests/security_tests.rs
@@ -216,14 +216,16 @@ mod tests {
         let remote_url = format!("file://{}", remote_repo.display());
 
         // 1. Check direct path traversal escape
-        let result_traversal = harness.run_submod(&[
-            "add",
-            &remote_url,
-            "--name",
-            "escaped-sub",
-            "--path",
-            "../escaped-path",
-        ]).expect("Failed to run submod");
+        let result_traversal = harness
+            .run_submod(&[
+                "add",
+                &remote_url,
+                "--name",
+                "escaped-sub",
+                "--path",
+                "../escaped-path",
+            ])
+            .expect("Failed to run submod");
 
         assert!(!result_traversal.status.success());
         let stderr = String::from_utf8_lossy(&result_traversal.stderr);
@@ -239,7 +241,7 @@ mod tests {
 
         // Create a symlink in the repository pointing to the outside directory
         let symlink_path = harness.work_dir.join("lib_escaped");
-        
+
         #[cfg(unix)]
         {
             std::os::unix::fs::symlink(&outside_dir, &symlink_path)
@@ -252,14 +254,16 @@ mod tests {
         }
 
         // Try to add submodule that goes through this symlink
-        let result_symlink = harness.run_submod(&[
-            "add",
-            &remote_url,
-            "--name",
-            "symlink-sub",
-            "--path",
-            "lib_escaped/submodule",
-        ]).expect("Failed to run submod");
+        let result_symlink = harness
+            .run_submod(&[
+                "add",
+                &remote_url,
+                "--name",
+                "symlink-sub",
+                "--path",
+                "lib_escaped/submodule",
+            ])
+            .expect("Failed to run submod");
 
         assert!(!result_symlink.status.success());
         let stderr = String::from_utf8_lossy(&result_symlink.stderr);