From 0e0cde32600d5e6958f0d65a1a4750d971621ea7 Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Wed, 21 Oct 2026 11:39:23 -0700 Subject: [PATCH] Move tempfile to dev-dependencies and drop clap_derive tempfile is only used by tests, but as a normal dependency it reached every crate that depends on codeowners, along with rustix, linux-raw-sys, getrandom, wasip2, wit-bindgen, errno, fastrand and r-efi. The code_ownership gem vendors that tree into its source gem, so it shipped all nine crates. Three of them carry an Apache-2.0 WITH LLVM-exception license file, which license scanners such as Socket flag even though each crate is also offered under MIT. clap_derive was a direct dependency that nothing names. clap's derive feature already depends on it, so removing it changes only Cargo.lock's list of codeowners' direct dependencies. --- Cargo.lock | 1 - Cargo.toml | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index eac3781..d607ef8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -171,7 +171,6 @@ version = "0.5.0" dependencies = [ "assert_cmd", "clap", - "clap_derive", "crossbeam-channel", "enum_dispatch", "error-stack", diff --git a/Cargo.toml b/Cargo.toml index 1f4937b..7addd89 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -18,7 +18,6 @@ path = "src/lib.rs" [dependencies] clap = { version = "4.5.45", features = ["derive"] } -clap_derive = "4.5.45" crossbeam-channel = "0.5.15" error-stack = "0.8.0" enum_dispatch = "0.3.13" @@ -40,7 +39,6 @@ serde = { version = "1.0.219", features = ["derive"] } serde_json = "1.0.143" serde_yaml = "0.9.34" similar = "3.2.0" -tempfile = "3.21.0" tracing = "0.1.41" tracing-subscriber = { version = "0.3.19", features = ["env-filter"] } @@ -50,3 +48,4 @@ rusty-hook = "^0.11.2" predicates = "3.1.3" pretty_assertions = "1.4.1" # Shows a more readable diff when comparing objects indoc = "2.0.6" +tempfile = "3.21.0"