chore: remove unused Rust dependencies and record dependency audit

Cargo.toml

@@ -426,9 +426,6 @@ dialoguer = "0.12"
 walkdir = "2.4"
 notify = "6.1"
 
-# Diff generation
-similar = "2.4"
-
 # HTTP / WebSocket (for publish command)
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "multipart", "blocking"] }
 tokio = { version = "1", features = ["full"] }

changelog.d/10262-rust-dependency-cleanup.md

@@ -0,0 +1,9 @@
+Remove 22 unused Rust dependency declarations and the unused `similar` workspace
+template, including stdlib's unused Clap and Tokio cron scheduler dependencies.
+The lockfile drops 15 external package versions without upgrading or adding any
+packages. Existing Tokio usage and public APIs are unchanged.
+
+Add an assessment of all 195 baseline direct Rust dependencies, reproducible
+dependency inventory tooling, and recommendations for feature trimming and
+selective implementation ownership. Graph measurements are distinguished from
+unmeasured binary-size and runtime-performance effects.

crates/perry-codegen/Cargo.toml

@@ -47,12 +47,10 @@ perry-api-manifest.workspace = true
 
 anyhow.workspace = true
 aho-corasick.workspace = true
-thiserror.workspace = true
 log.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 
-
 # Keep these target lists aligned with `inprocess::global_init`. Inkwell's
 # `target-all` default references backends Perry cannot emit and which the
 # official Windows LLVM archive does not build.

crates/perry-container-compose/Cargo.toml

@@ -16,18 +16,14 @@ serde_json = { workspace = true }
 serde_yaml = "0.9"
 tokio = { workspace = true }
 clap = { workspace = true }
-anyhow = { workspace = true }
 thiserror = { workspace = true }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 async-trait = "0.1"
 md-5 = "0.11"
 hex.workspace = true
-dotenvy = { workspace = true }
 indexmap = { version = "2.2", features = ["serde"] }
-dashmap.workspace = true
 rand = "0.10"
-atty = "0.2"
 dialoguer = "0.11"
 console = "0.16"
 once_cell.workspace = true

crates/perry-ext-fastify/Cargo.toml

@@ -27,7 +27,6 @@ bytes.workspace = true
 tokio = { workspace = true }
 tokio-tungstenite = { workspace = true }
 serde_json.workspace = true
-lazy_static.workspace = true
 
 # #cluster — SO_REUSEPORT bind for `cluster.fork()` workers (unix only),
 # mirroring perry-ext-http's cluster_bind. The

crates/perry-hir/Cargo.toml

@@ -23,7 +23,6 @@ swc_common.workspace = true
 swc_ecma_visit.workspace = true
 swc_ecma_transforms_base.workspace = true
 
-thiserror.workspace = true
 anyhow.workspace = true
 serde = { workspace = true }
 serde_json = { workspace = true }

crates/perry-parser/Cargo.toml

@@ -15,7 +15,6 @@ swc_ecma_visit.workspace = true
 swc_common.workspace = true
 swc_ecma_transforms_base.workspace = true
 
-thiserror.workspace = true
 anyhow.workspace = true
 
 perry-diagnostics.workspace = true

crates/perry-runtime/Cargo.toml

@@ -306,8 +306,6 @@ dyn-eval = ["dep:perry-parser", "dep:perry-diagnostics"]
 # with perry-hir through perry-dispatch, so the runtime's property-read and
 # method-call paths and the HIR's import lowering cannot drift apart.
 perry-dispatch.workspace = true
-thiserror.workspace = true
-anyhow.workspace = true
 libc.workspace = true
 rustc-demangle = "0.1"
 # Owned single-phase unwinder (#7302 follow-up): decodes .eh_frame CFI for

crates/perry-stdlib/Cargo.toml

@@ -284,7 +284,7 @@ bundled-cheerio = ["dep:scraper"]
 # backwards-compat; v0.5.564's well-known flip toggles
 # `bundled-cron` instead.
 scheduler = ["bundled-cron"]
-bundled-cron = ["dep:cron", "dep:tokio-cron-scheduler", "async-runtime"]
+bundled-cron = ["dep:cron", "async-runtime"]
 
 # Rate limiting — `rate-limit` umbrella stays for backwards-compat;
 # v0.5.552's well-known flip toggles `bundled-ratelimit` instead.
@@ -332,14 +332,9 @@ perry-updater = { workspace = true }
 # in this crate's tests/.
 perry-container-compose = { path = "../perry-container-compose", optional = true }
 
-thiserror.workspace = true
-anyhow.workspace = true
-
 # Always needed
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
-itoa.workspace = true
-ryu.workspace = true
 once_cell.workspace = true
 lazy_static.workspace = true
 chrono = { workspace = true, features = ["serde"] }
@@ -444,7 +439,6 @@ scraper = { version = "0.27", optional = true }
 
 # Scheduler
 cron = { version = "0.17", optional = true }
-tokio-cron-scheduler = { version = "0.15", optional = true }
 
 # Rate limiting
 governor = { version = "0.10", optional = true }
@@ -461,9 +455,6 @@ nanoid = { version = "0.5", optional = true }
 # to perry-ext-lru-cache instead.
 lru = { version = "0.18", optional = true }
 
-# CLI parsing (Commander)
-clap = { version = "4.4", features = ["derive"] }
-
 # Decimal math (Big.js / Decimal.js) — optional from v0.5.547 so
 # the well-known flip can strip perry-stdlib's copy when
 # `import 'decimal.js'` resolves to perry-ext-decimal instead.

crates/perry-transform/Cargo.toml

@@ -10,6 +10,3 @@ workspace = true
 
 [dependencies]
 perry-hir.workspace = true
-
-thiserror.workspace = true
-anyhow.workspace = true

crates/perry-ui-android/Cargo.toml

@@ -27,7 +27,4 @@ perry-ext-sharp = { path = "../perry-ext-sharp" }
 base64.workspace = true
 libc.workspace = true
 jni = "0.22"
-serde_json.workspace = true
-itoa.workspace = true
-ryu.workspace = true
 tungstenite = { version = "0.24", features = ["rustls-tls-webpki-roots"] }

crates/perry-updater/Cargo.toml

@@ -15,7 +15,6 @@ crate-type = ["rlib", "staticlib"]
 anyhow = "1.0"
 perry-runtime = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
-serde_json.workspace = true
 semver.workspace = true
 sha2 = "0.11"
 hex.workspace = true