Unused dependencies, dependency versions and security vulnerabilities with cargo

[mversic]

Sometimes it happens that unused dependencies remain in our dependency tree. Also, sometimes it happens that we use some crates with known security vulnerabilities. It would be good to investigate and integrate into our CI tools that would help us circumvent these issues in production releases.

• a project that contains various tools to help mitigate security vulnerabilities in cargo dependencies
• a project to help us remove unused dependencies that crept into the codebase

An interesting workflow to execute:

1. Run cargo update to update to the latest semver compatible version.
2. Run cargo outdated --workspace --root-deps-only to find newer, possibly incompatible dependencies. Update those and fix code as needed.
3. Run cargo tree --duplicate to show dependencies which come in multiple versions. Deduplicate those

The ability to manage dependencies for all workspace crates is not yet available in cargo. However, there is a tracking issue for this feature. Once available we will be able to deduplicate dependencies and metadata directives amongst Iroha workspace crates

[mversic]

this should come in handy

[appetrosyan]

Undepend does a great job