Drop five unused direct dependencies - #100
Merged
Merged
Conversation
None of these crates are referenced anywhere in the codebase (verified by grep across src/ and tests/); the default build and the full test suite pass without them: - ed25519-dalek: Ed25519 keygen/signing goes through ic-agent's BasicIdentity::from_raw_key, never this crate. - p256, ic-signature-verification: the server never verifies delegation signatures itself; the replica verifies every hop at redeem. - ic-representation-independent-hash: unreferenced. - schemars 0.8: vestigial. Every JsonSchema derive resolves through `use rmcp::schemars` (rmcp's re-exported 1.x); the top-level 0.8 dep is never bound. rmcp's own schemars re-export is untouched. Removing the declarations drops ic-signature-verification and ic-representation-independent-hash (plus their unique transitive deps ic-canister-sig-creation and ic0) from the default build closure. ed25519-dalek and p256 remain in the tree transitively via ic-agent, and schemars 0.8 remains via the optional pocket-ic (e2e feature) dep, so removing those three declarations is direct-dependency hygiene rather than closure reduction. Cargo.lock updated minimally (removals only, no version bumps). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014T9N8USDfNK5yzznPGg7Ym
There was a problem hiding this comment.
Pull request overview
This PR removes five unused direct Rust dependencies from Cargo.toml and updates Cargo.lock accordingly, reducing direct-dependency surface area while keeping the build graph correct via existing transitive/optional dependencies (e.g., via ic-agent and optional pocket-ic).
Changes:
- Removed unused direct deps from
[dependencies]:ed25519-dalek,p256,ic-signature-verification,ic-representation-independent-hash,schemars = "0.8". - Pruned now-unreachable crates from
Cargo.lock(includingic0andic-canister-sig-creation) and removed the dropped crates from this workspace package’s dependency list in the lockfile.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Cargo.toml | Drops unused direct dependency declarations while leaving transitive/optional sources intact. |
| Cargo.lock | Removes lock entries that are no longer reachable after dependency cleanup; no version bumps. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
sea-snake
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes five direct dependency declarations from
Cargo.tomlthat are never referenced anywhere in the codebase. Verified by grep acrosssrc/andtests/, and by a clean--lockedbuild + full test run without them.This is the dependency-stripping item from the PR #77 scoping doc (§3), landed as an independent cleanup that stands on its own regardless of the local-binary work.
Related issues
Prompted by the dependency audit in #77 (§3). No issue closed.
Changes
[dependencies]:ed25519-dalek— Ed25519 keygen/signing goes throughic-agent'sBasicIdentity::from_raw_key, never this crate.p256,ic-signature-verification— the server never verifies delegation signatures itself; the replica verifies every hop at redeem.ic-representation-independent-hash— unreferenced.schemars = "0.8"— vestigial: everyJsonSchemaderive resolves throughuse rmcp::schemars(rmcp's re-exported 1.x). rmcp's own schemars re-export is untouched.Cargo.lock: removals only, no version bumps.ic-signature-verification,ic-representation-independent-hash, and their unique transitive deps (ic-canister-sig-creation,ic0) leave the build closure.Note on the tree:
ed25519-dalekandp256remain transitively viaic-agent, andschemars 0.8remains via the optionalpocket-ic(e2efeature) dep. So for those three, dropping the declaration is direct-dependency hygiene (our code never binds them directly) rather than closure reduction; the default build has zeroschemars 0.8nodes.Testing
cargo build --locked --all-targetscargo test --locked --all-targets(151 + 8 tests pass, 0 failed)cargo fmt --all/cargo clippy --all-targets(tree is warning-free)npm test --prefix monitoring/mcp-status(if the dashboard changed)Checklist
🤖 Generated with Claude Code
Generated by Claude Code