Skip to content

refactor(deps): remove unused dependency edges - #1639

Merged
chaliy merged 1 commit into
mainfrom
2026-05-21-dependency-cleanup
May 21, 2026
Merged

chaliy merged 1 commit into
mainfrom
2026-05-21-dependency-cleanup

Conversation

@chaliy

@chaliy chaliy commented May 21, 2026

Copy link
Copy Markdown
Contributor

What

Remove unused dependency edges and replace two small dependency-backed helpers with local implementations.

Why

Reduce dependency surface and keep stable tool schemas independent of proc-macro schema generation.

How

  • Removed unused direct dependencies from manifests and locks: schemars, russh-keys, CLI serde/serde_json, JS serde.
  • Replaced url::form_urlencoded calls in the HTTP builtin with a local x-www-form-urlencoded encoder and tightened tests.
  • Replaced schemars::schema_for!(ToolRequest/ToolResponse) with manual stable JSON schemas reused by BashTool and scripted tools.
  • Updated threat-model wording and supply-chain exemptions to match the new dependency graph.

Risk

  • Low
  • Manual schemas could drift if ToolRequest or ToolResponse changes without updating the schema helper.

Checklist

  • Tests added or updated
  • Backward compatibility considered
  • Security review performed against relevant threat model categories

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
bashkit ef58d23 Commit Preview URL May 21 2026, 01:57 AM

@chaliy
chaliy merged commit 7c293f5 into main May 21, 2026
34 checks passed
@chaliy
chaliy deleted the 2026-05-21-dependency-cleanup branch May 21, 2026 02:09
@chaliy chaliy mentioned this pull request May 25, 2026
4 tasks
chaliy added a commit that referenced this pull request May 30, 2026
## What
Remove unused dependency edges and replace two small dependency-backed
helpers with local implementations.

## Why
Reduce dependency surface and keep stable tool schemas independent of
proc-macro schema generation.

## How
- Removed unused direct dependencies from manifests and locks:
`schemars`, `russh-keys`, CLI `serde`/`serde_json`, JS `serde`.
- Replaced `url::form_urlencoded` calls in the HTTP builtin with a local
x-www-form-urlencoded encoder and tightened tests.
- Replaced `schemars::schema_for!(ToolRequest/ToolResponse)` with manual
stable JSON schemas reused by BashTool and scripted tools.
- Updated threat-model wording and supply-chain exemptions to match the
new dependency graph.

## Risk
- Low
- Manual schemas could drift if `ToolRequest` or `ToolResponse` changes
without updating the schema helper.

## Checklist
- [x] Tests added or updated
- [x] Backward compatibility considered
- [x] Security review performed against relevant threat model categories
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant