Detect usage to widen feature set of indirect dependency

[taladar]

I recently disabled default-features on reqwest in some of my API crates (e.g. redmine-api) to allow the user to select a TLS implementation instead of forcing them to use the default TLS implementation.

This requires the user to add reqwest to their own dependencies and set additional features (e.g. rustls-tls) when compared to the ones specified by dependencies.

It would be great if cargo-machete could take this usage into account when deciding if a dependency is unused.

[reneleonhardt]

Could you provide a minimal before / after example of your Cargo.toml?

[taladar]

I am not quite sure what you are asking here.

Basically some libraries (like my redmine-api crate) internally use dependencies like reqwest that have features that allow a selection of one of multiple backends, TLS in the case of reqwest. However, none of the API the crate uses from reqwest requires any particular TLS-backend to be enabled. This means I would like to allow my users to decide if they use the nativetls or rustls backends so I disable both of them in my redmine-api crate dependency statement. The user can then include reqwest in their own dependencies and enable the features they need in reqwest.

Due to https://doc.rust-lang.org/cargo/reference/features.html#feature-unification this copy of the reqwest dependency with their chosen features enabled will then (assuming matching version constraints) be used for all occurrences of reqwest in the dependency graph.

This is commonly used to avoid having to mirror all dependency features in your own crate features.

What you would need to detect is basically if the removal of an "unused" dependency would reduce the set of enabled features for that dependency if it remains in the set of indirect dependencies despite being removed as a direct dependency.

[bnjbvr]

If I understand correctly: say you make a lib libexample which makes use of reqwest. If I make use of libexample in my own project, I can still want to add reqwest to my Cargo.toml file just so as to set the native-tls-vendored feature, for instance. That doesn't mean I necessarily use reqwest directly in my own project, but the activation of this feature would happen for libexample, that I'm using.

This would be a false positive found by cargo-machete, because reqwest isn't immediately used by my project. What you're proposing is to analyze the set of transitive dependencies, so we can notice this situation, and not report it as an unused dependency, because it's setting a specific. Am I understanding this correctly?

[taladar]

Yes, that is exactly what I am proposing.