build(deps): drop an unused dependency and narrow unused features

[membphis]

What

Dependency-hygiene pass over the workspace manifests: removes the one unused direct dependency and narrows four feature lists to what the code actually uses. No behavior change; every cut is backed by a zero-usage search across src/ and tests/ of all crates.

Changes and evidence

Change	Evidence	Tree effect
aisix-a2a: drop direct http dependency	zero http:: references in the crate; its tests use axum::http (axum's re-export, not the direct dep). Only cargo machete finding in the workspace, manually verified (no cfg-gated / feature-gated / test-only use)	none (http stays in the tree for its real consumers); manifest-only cleanup
tower-http: ["trace", "cors", "limit", "compression-gzip", "set-header"] → ["set-header"]	TraceLayer/CorsLayer/RequestBodyLimitLayer/CompressionLayer have zero hits; body limiting is axum::extract::DefaultBodyLimit plus the crate's own enforce_request_body_limit (aisix-proxy/src/lib.rs); the only tower-http item in use is SetResponseHeaderLayer (server header)	tower-http's trace/cors/limit/compression modules stop compiling. Note: async-compression itself stays — reqwest's gzip feature (deliberately kept: Accept-Encoding negotiation) enables tower-http's decompression side
axum: drop macros	no #[debug_handler], no derive(FromRef); FromRef appears only as a trait bound, which the feature does not gate	drops the axum-macros proc-macro crate
uuid: drop serde	no Uuid-typed field crosses a serde boundary; every call site converts immediately (to_string()/simple()/as_u128())	declaration-only
tracing-subscriber: drop json	no .json() formatter is constructed and there is no log-format config knob, so the JSON formatter is unreachable at runtime	drops tracing-serde

Deliberately kept (audited, not cut)

• axum tracing — has no API surface; it gates axum's internal logging of extractor rejections. It is also an axum default feature (default features stay on), so the explicit entry is documentation of intent rather than what enables it; the manifest comment records both facts so a future sweep does not re-flag it.
• config toml / json — statically zero-hit, but config::File::from infers the format from the file extension, so existing config.toml / config.json deployments depend on them. Removing them would be a breaking operator-facing change.
• tokio full — only io-std and process are unused, and both are thin internal tokio modules whose removal compiles out no third-party crate; narrowing buys nothing measurable.
• reqwest features — gzip (Accept-Encoding negotiation), multipart (audio), stream/json all in use; rustls-tls-native-roots is load-bearing (Upstream TLS trust: no config surface for a private CA, and no verification override #860); http2 is enabled by object_store's reqwest dependency either way.

Verification

• cargo check --workspace --all-targets --all-features — clean
• cargo test --workspace --all-features — 0 failed
• cargo clippy --workspace --all-targets --all-features — no warnings; cargo fmt --check clean
• cargo run -p aisix-core --bin dump-schema — zero schema diff
• e2e (both serving modes) gated by CI

Stacked on #960: both PRs touch the workspace manifest and lockfile; this one retargets to main automatically when #960 merges.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 72dcfb8f-ffd7-4f86-b238-503e6cb2bd02

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[membphis]

Note on the stack: CI does not trigger while the base is build/deps-security-convergence (this repo's workflows only run against main-based PRs). Once #960 squash-merges and its branch is deleted, GitHub retargets this PR to main; it then needs a rebase onto main to drop the duplicated #960 commit, after which the full CI matrix runs. Local verification (unit suite, clippy, fmt, schema dump) already passed on this head.

[membphis]

Closing as not needed, per maintainer decision. For the record, the full reasoning — this is a value judgment, not a correctness problem:

Why it is safe (what closing does NOT mean). The independent audit on this PR came back 0 HIGH / 0 MEDIUM: all five zero-usage claims were verified across src, tests, doc-tests, cfg-gated code and the lockfile, and the one LOW (the axum tracing comment wording) was already fixed on this branch. Nothing here was found wrong.

Why it is not worth carrying anyway.

• No measurable benefit. The only things that leave the build graph are axum-macros (a proc-macro) and tracing-serde — both tiny. The runtime binary is unaffected: under fat LTO the unused tower-http modules were already dead-code-eliminated, and async-compression stays in the tree regardless because reqwest's gzip feature (deliberately kept for Accept-Encoding negotiation) enables tower-http's decompression side. The compile-time and size wins measured in the hygiene pass (−3.3% cold build, −4.1% binary) came almost entirely from build(deps): clear all 8 open dependabot alerts #960's removal of the retired hyper 0.14 + rustls 0.21 connector, not from these trims.
• The cost is not zero. It is one more lockfile-touching change to review, land and rebase around, for feature entries that are additive, compile-time-only, and harmless when unused.

What survives this closure. The durable output was the audit itself, and that is recorded (here and in the internal dependency-hygiene report): the unused-feature inventory with evidence, the deliberately-kept list (axum tracing is a default feature and gates rejection logging; config toml/json are operator-facing format support; reqwest features are load-bearing), and the note that aisix-a2a's direct http dependency is declared but unused. If a future manifest change wants to pick any of these trims up, the diff and the evidence tables in this PR are ready to reuse — nothing needs to be re-investigated.