Repository navigation
chore(deps): remove 6 unused dependencies - #1470
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
duncanista
changed the title
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues with the unused-dependency cleanup.
No open issues 🎉
What changed in this PR
Removes six unused direct dependencies from the Rust Lambda extension and prepares dependency metadata for the cargo-machete CI check planned in #1471.
Changes:
- Removes five regular dependencies and the
proptestdev-dependency. - Adds cargo-machete exclusions with comments explaining intentionally retained dependencies.
- Updates the lockfile and removes four third-party license entries.
| File | Description |
|---|---|
| bottlecap/LICENSE-3rdparty.csv | Removes license entries for bit-set, bit-vec, rusty-fork, and wait-timeout. |
| bottlecap/Cargo.toml | Removes six unused dependencies and documents cargo-machete exclusions. |
| bottlecap/Cargo.lock | Updates dependency references and removes unused package versions and dependency edges. |
Review effort: Balanced
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f36a2d7e5b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Keep the #1467 dependency pins without ddsketch-agent, regenerate Cargo.lock and LICENSE-3rdparty.csv, and list libddwaf-sys in the cargo-machete ignore list: it is a dependency only to enable its aws-lc-rs feature.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4d379ec88f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
**TL;DR:** Adds a CI job (cargo-machete) that fails when `Cargo.toml` lists a dependency that the code does not use. **Why:** The 6 unused dependencies that #1470 removes built up over time, because nothing caught them. ## Overview Jira: [SVLS-9975](https://datadoghq.atlassian.net/browse/SVLS-9975) Stacked on #1470 (`jordan.gonzalez/remove-unused-deps/feature`). Add the `Unused Dependencies` job: `cargo-machete` 0.9.2 through `taiki-e/install-action` v2.87.28. It is static analysis, with no build, so it is fast and deterministic. A crate used only through a string path or kept as a version bound goes in `[package.metadata.cargo-machete] ignored` (previous PR). It is not a required check. Size: 17 core lines, 17 lines in total. ## Testing - applies on the previous PR of the stack: pass - actionlint 1.7.12 with shellcheck 0.10.0 on the changed workflows: pass - `cargo machete`: pass [SVLS-9975]: https://datadoghq.atlassian.net/browse/SVLS-9975?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
TL;DR: Removes 6 dependencies that no code uses: indexmap, serde-aux, lazy_static, log, ddsketch-agent and proptest.
Why: Less to compile, audit and keep up to date. The next PR (#1471) adds a CI check so that unused dependencies do not come back.
Overview
Jira: SVLS-9975
Based on
main(#1469 is merged).indexmap,serde-aux,lazy_static,log,ddsketch-agentand the dev-dependencyproptest. The lock drops the 4 packages that onlyproptestpulled in:bit-set0.8,bit-vec0.8,rusty-forkandwait-timeout.Older
bit-set(0.5) andbit-vec(0.6) stay in the lock, through thehttpmockdevdependency.
LICENSE-3rdparty.csvdrops the same 4 rows, so the required"Valid LICENSE-3rdparty.csv" check passes.
[package.metadata.cargo-machete] ignoredlists the 5 crates that stay on purpose, with thereason in a comment: version bounds on transitive crates,
aws-lc-rsreached throughrustls::crypto,serde_bytesused in a#[serde(with)]string, andlibddwaf-sys, whichis listed only to enable its
aws-lc-rsfeature ([SVLS-9963] chore(bottlecap): upgrade libddwaf, zstd, and serverless-components #1467). The next PR (ci: add a cargo-machete gate for unused dependencies #1471) adds the CIjob that reads it.
Size: about 16 core lines; the rest is
Cargo.lockandLICENSE-3rdparty.csv.Testing
cargo metadata --locked: passcargo deny --locked check: passcargo machete: passdd-rust-license-tool check: passcargo clippy --workspace --all-targets --features default -- -D warnings: passcargo clippy --workspace --all-targets --features default,test-mode -- -D warnings: passcompile_bottlecap.sh, arm64, FIPS=1).