feat: vendor dependencies and aggressively reduce crate count#1361
Open
heapwolf wants to merge 4 commits into
Open
feat: vendor dependencies and aggressively reduce crate count#1361heapwolf wants to merge 4 commits into
heapwolf wants to merge 4 commits into
Conversation
Remove smol, futures, indicatif, once_cell, dirs, and rand from production dependencies. Replace with tokio equivalents, std::sync::LazyLock, inline implementations, and getrandom respectively. Vendor all remaining dependencies for fully offline, air-gapped builds with zero network fetches. Crate count reduced from 449 to 312. Vendor size 497MB. Removed crates: - smol (replaced by tokio which was already present) - futures (replaced by tokio + small inline join_all/catch_unwind) - indicatif (replaced by 30-line inline spinner) - once_cell (replaced by std::sync::LazyLock) - dirs (replaced by inline home_dir/config_dir using env vars) - rand (replaced by getrandom for prod, kept as dev-dep for tests) - ratatui (dead code, zero usage) - crossterm (dead code, zero usage) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All Rust dependencies are now vendored in vendor/ for fully offline builds. No network access required at build time. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace ureq with a minimal HTTP/1.1 client using native-tls directly, eliminating the entire url→idna→ICU dependency chain (27 crates). Trim feature flags on clap, chrono, flate2, and zip for further savings. Total crate count: 449 → 259 (190 crates eliminated, 42% reduction). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Eliminates all 20+ gix-* crates by replacing gix-index binary index parsing with `git ls-files --stage -z` and gix-config file parsing with `git config` CLI calls. Reduces vendor from 249 to 213 crates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Aggressive dependency reduction to minimize supply-chain risk and enable fully air-gapped builds. Zero network fetches required at build time.
Results: 449 → 213 crates (53% reduction), vendor size 620MB → 469MB
What changed
Crates removed entirely (replaced with inline implementations or stdlib)
native-tls+TcpStreamstd::sync::LazyLock(stable in Rust 1.80+)$HOME/$USERPROFILE/XDG logicgetrandomfor the two call sites that needed randomnessget_all_staged_file_blob_oidswithgit ls-files --stage -zgit configCLI callsFeature flags trimmed
clap: disabled default features, kept onlyderive,std,help,usage,error-contextchrono: disabled default features, enabled onlyserde,now,stdflate2: switched tozlib-rsbackend onlyzip:deflate-flate2feature onlyArchitecture changes
src/http.rs— complete rewrite: minimal HTTP/1.1 client with TLS, chunked transfer-encoding, DNS resolution viaToSocketAddrssrc/utils.rs— addedblock_on,join_all,catch_unwind(smol replacements) +dirsmodulesrc/git/repository.rs— config operations now usegit configCLI instead of in-process parsing;remotes_with_urls()usesgit remote -vsrc/daemon/git_backend.rs— alias cache usesgit config --get-regexpinstead of gix-config file iterationsrc/commands/git_hook_handlers.rs— hooks path read/write/unset viagit config --fileVendoring
vendor/with.cargo/config.tomlsource replacementCARGO_NET_OFFLINE=true cargo buildsucceedsTest plan
task build— compiles cleanlytask lint— no clippy warningstask fmt— formattedtask test— all 1495 unit tests passtask test— all 3037 integration tests passCARGO_NET_OFFLINE=true)🤖 Generated with Claude Code