From bb8703e0f02acdd2c13a0345a3fa28444e474baa Mon Sep 17 00:00:00 2001
From: Lake <lake@e37a.net>
Date: Sun, 12 Jul 2026 14:54:07 -0500
Subject: [PATCH 1/5] build: shear unused dependencies

---
 Cargo.lock             | 15 ---------------
 Cargo.toml             | 17 +++--------------
 src/admin/Cargo.toml   |  1 -
 src/api/Cargo.toml     |  5 -----
 src/core/Cargo.toml    |  2 --
 src/macros/Cargo.toml  |  1 -
 src/router/Cargo.toml  |  1 -
 src/service/Cargo.toml |  1 -
 src/web/Cargo.toml     | 13 ++++++++++---
 xtask/Cargo.toml       |  1 -
 10 files changed, 13 insertions(+), 44 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 798e3052b..d03b00631 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -866,7 +866,6 @@ dependencies = [
 name = "conduwuit_admin"
 version = "26.6.1"
 dependencies = [
- "assign",
  "clap",
  "conduwuit_api",
  "conduwuit_core",
@@ -892,11 +891,8 @@ dependencies = [
 name = "conduwuit_api"
 version = "26.6.1"
 dependencies = [
- "assign",
- "async-trait",
  "axum",
  "axum-client-ip",
- "axum-extra",
  "base64 0.22.1",
  "bytes",
  "conduwuit_core",
@@ -910,7 +906,6 @@ dependencies = [
  "http",
  "http-body-util",
  "hyper",
- "ipaddress",
  "itertools 0.15.0",
  "lettre",
  "log",
@@ -919,7 +914,6 @@ dependencies = [
  "ruma",
  "ruminuwuity",
  "serde",
- "serde_html_form",
  "serde_json",
  "sha1 0.11.0",
  "tokio",
@@ -940,7 +934,6 @@ version = "26.6.1"
 dependencies = [
  "argon2",
  "arrayvec",
- "assign",
  "axum",
  "axum-extra",
  "bytes",
@@ -964,7 +957,6 @@ dependencies = [
  "http-body-util",
  "hyper-util",
  "ipaddress",
- "itertools 0.15.0",
  "lettre",
  "libc",
  "libloading 0.9.0",
@@ -1027,7 +1019,6 @@ dependencies = [
 name = "conduwuit_macros"
 version = "26.6.1"
 dependencies = [
- "cargo_toml",
  "itertools 0.15.0",
  "proc-macro2",
  "quote",
@@ -1038,7 +1029,6 @@ dependencies = [
 name = "conduwuit_router"
 version = "26.6.1"
 dependencies = [
- "assign",
  "axum",
  "axum-client-ip",
  "axum-server",
@@ -1101,7 +1091,6 @@ dependencies = [
  "lru-cache",
  "nonzero_ext",
  "openidconnect",
- "rand 0.10.2",
  "recaptcha-verify",
  "regex",
  "reqwest 0.12.28",
@@ -1129,10 +1118,8 @@ name = "conduwuit_web"
 version = "26.6.1"
 dependencies = [
  "askama",
- "assign",
  "async-trait",
  "axum",
- "axum-extra",
  "base64 0.22.1",
  "conduwuit_api",
  "conduwuit_build_metadata",
@@ -1144,7 +1131,6 @@ dependencies = [
  "lettre",
  "memory-serve",
  "openidconnect",
- "rand 0.10.2",
  "recaptcha-verify",
  "reqwest 0.12.28",
  "ruma",
@@ -6977,7 +6963,6 @@ dependencies = [
  "askama",
  "cargo_metadata",
  "clap",
- "conduwuit",
  "conduwuit_admin",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 41a79df3c..98b6c3bfd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -170,10 +170,6 @@ version = "0.0.29"
 [workspace.dependencies.serde_regex]
 version = "1.1.0"
 
-# Used for ruma wrapper
-[workspace.dependencies.serde_html_form]
-version = "0.4.0"
-
 # Used for password hashing
 [workspace.dependencies.argon2]
 version = "0.5.3"
@@ -309,11 +305,6 @@ features = [
 version = "2.0.12"
 default-features = false
 
-# Used when hashing the state
-[workspace.dependencies.ring]
-version = "0.17.14"
-default-features = false
-
 # Used to make working with iterators easier, was already a transitive depdendency
 [workspace.dependencies.itertools]
 version = "0.15.0"
@@ -651,11 +642,6 @@ package = "conduwuit_build_metadata"
 path = "src/build_metadata"
 default-features = false
 
-
-[workspace.dependencies.conduwuit]
-package = "conduwuit"
-path = "src/main"
-
 [workspace.dependencies.ruminuwuity]
 package = "ruminuwuity"
 path = "src/ruminuwuity"
@@ -985,3 +971,6 @@ collapsible_if = "allow"
 
 # TODO: break these apart
 cognitive_complexity = "allow"
+
+[workspace.metadata.cargo-shear]
+ignored = ["const-str", "ctor", "dtor"]
diff --git a/src/admin/Cargo.toml b/src/admin/Cargo.toml
index 1f82978a4..6495ad400 100644
--- a/src/admin/Cargo.toml
+++ b/src/admin/Cargo.toml
@@ -85,7 +85,6 @@ dtor.workspace = true
 futures.workspace = true
 lettre.workspace = true
 log.workspace = true
-assign.workspace = true
 ruma.workspace = true
 serde_json.workspace = true
 serde-saphyr.workspace = true
diff --git a/src/api/Cargo.toml b/src/api/Cargo.toml
index 34fa951da..68b96b946 100644
--- a/src/api/Cargo.toml
+++ b/src/api/Cargo.toml
@@ -63,9 +63,7 @@ zstd_compression = [
 ]
 
 [dependencies]
-async-trait.workspace = true
 axum-client-ip.workspace = true
-axum-extra.workspace = true
 axum.workspace = true
 base64.workspace = true
 bytes.workspace = true
@@ -80,16 +78,13 @@ hmac.workspace = true
 http.workspace = true
 http-body-util.workspace = true
 hyper.workspace = true
-ipaddress.workspace = true
 itertools.workspace = true
 lettre.workspace = true
 log.workspace = true
 rand.workspace = true
 reqwest.workspace = true
-assign.workspace = true
 ruma.workspace = true
 ruminuwuity.workspace = true
-serde_html_form.workspace = true
 serde_json.workspace = true
 serde.workspace = true
 sha1.workspace = true
diff --git a/src/core/Cargo.toml b/src/core/Cargo.toml
index 1daf731a6..cec3cbaed 100644
--- a/src/core/Cargo.toml
+++ b/src/core/Cargo.toml
@@ -79,7 +79,6 @@ futures.workspace = true
 http-body-util.workspace = true
 http.workspace = true
 ipaddress.workspace = true
-itertools.workspace = true
 libc.workspace = true
 libloading.workspace = true
 libloading.optional = true
@@ -92,7 +91,6 @@ rand_core = { version = "0.6.4", features = ["getrandom"] }
 regex.workspace = true
 reqwest.workspace = true
 sha2.workspace = true
-assign.workspace = true
 ruma.workspace = true
 sanitize-filename.workspace = true
 serde_json.workspace = true
diff --git a/src/macros/Cargo.toml b/src/macros/Cargo.toml
index 4913b9d1c..805228649 100644
--- a/src/macros/Cargo.toml
+++ b/src/macros/Cargo.toml
@@ -18,7 +18,6 @@ syn.workspace = true
 quote.workspace = true
 proc-macro2.workspace = true
 itertools.workspace = true
-cargo_toml.workspace = true
 
 [lints]
 workspace = true
diff --git a/src/router/Cargo.toml b/src/router/Cargo.toml
index 6dfed9947..a7e5c9ab4 100644
--- a/src/router/Cargo.toml
+++ b/src/router/Cargo.toml
@@ -112,7 +112,6 @@ http-body-util.workspace = true
 hyper.workspace = true
 hyper-util.workspace = true
 log.workspace = true
-assign.workspace = true
 ruma.workspace = true
 rustls.workspace = true
 rustls.optional = true
diff --git a/src/service/Cargo.toml b/src/service/Cargo.toml
index 549a3cdb6..be5333120 100644
--- a/src/service/Cargo.toml
+++ b/src/service/Cargo.toml
@@ -96,7 +96,6 @@ log.workspace = true
 loole.workspace = true
 lru-cache.workspace = true
 nonzero_ext.workspace = true
-rand.workspace = true
 regex.workspace = true
 reqwest.workspace = true
 assign.workspace = true
diff --git a/src/web/Cargo.toml b/src/web/Cargo.toml
index 516ff1712..7790efa0b 100644
--- a/src/web/Cargo.toml
+++ b/src/web/Cargo.toml
@@ -27,12 +27,9 @@ conduwuit-api.workspace = true
 async-trait.workspace = true
 askama.workspace = true
 axum.workspace = true
-axum-extra.workspace = true
 base64.workspace = true
 futures.workspace = true
 tracing.workspace = true
-rand.workspace = true
-assign.workspace = true
 ruma.workspace = true
 thiserror.workspace = true
 tower-http.workspace = true
@@ -56,3 +53,13 @@ memory-serve = "2.1.0"
 
 [lints]
 workspace = true
+
+[package.metadata.cargo-shear]
+ignored = [
+    "conduwuit_build_metadata",
+    "form_urlencoded",
+    "reqwest_recaptcha",
+    "serde_json",
+    "tower-sessions-core",
+    "tracing",
+]
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
index 76258f96d..f11953fdc 100644
--- a/xtask/Cargo.toml
+++ b/xtask/Cargo.toml
@@ -11,7 +11,6 @@ version.workspace = true
 
 [dependencies]
 conduwuit-admin.workspace = true
-conduwuit.workspace = true
 clap.workspace = true
 
 askama = "0.16.0"

From 75b725908aa462809bc22deca424a493ffe77991 Mon Sep 17 00:00:00 2001
From: Lake <lake@e37a.net>
Date: Fri, 17 Jul 2026 16:48:50 -0500
Subject: [PATCH 2/5] style(web): format Cargo.toml

---
 src/web/Cargo.toml | 66 ++++++++++++++++++++++++----------------------
 1 file changed, 35 insertions(+), 31 deletions(-)

diff --git a/src/web/Cargo.toml b/src/web/Cargo.toml
index 7790efa0b..69d460d01 100644
--- a/src/web/Cargo.toml
+++ b/src/web/Cargo.toml
@@ -1,52 +1,56 @@
 [package]
-name = "conduwuit_web"
 description.workspace = true
-edition.workspace = true
-homepage.workspace = true
-license.workspace = true
-readme.workspace = true
-repository.workspace = true
-version.workspace = true
+edition.workspace     = true
+homepage.workspace    = true
+license.workspace     = true
+name                  = "conduwuit_web"
+readme.workspace      = true
+repository.workspace  = true
+version.workspace     = true
 
 [lib]
-path = "mod.rs"
 crate-type = [
-	"rlib",
-#	"dylib",
+    "rlib",
+    #	"dylib",
 ]
+path = "mod.rs"
 
 [features]
 
 
 [dependencies]
-conduwuit-build-metadata.workspace = true
-conduwuit-service.workspace = true
-conduwuit-core.workspace = true
-conduwuit-database.workspace = true
-conduwuit-api.workspace = true
-async-trait.workspace = true
 askama.workspace = true
+async-trait.workspace = true
 axum.workspace = true
 base64.workspace = true
+conduwuit-api.workspace = true
+conduwuit-build-metadata.workspace = true
+conduwuit-core.workspace = true
+conduwuit-database.workspace = true
+conduwuit-service.workspace = true
+form_urlencoded = "1.2.2"
 futures.workspace = true
-tracing.workspace = true
-ruma.workspace = true
-thiserror.workspace = true
-tower-http.workspace = true
-serde.workspace = true
-serde_json.workspace = true
 lettre.workspace = true
 memory-serve = "2.1.0"
-validator = { version = "0.20.0", features = ["derive"] }
-tower-sec-fetch = { version = "0.1.2", features = ["tracing"] }
-tower-sessions = { version = "0.15.0", default-features = false, features = ["axum-core"] }
-tower-sessions-core = { version = "0.15.0", features = ["deletion-task"] }
-serde_urlencoded.workspace = true
-url.workspace = true
-recaptcha-verify = { version = "0.2.0", default-features = false }
-reqwest_recaptcha = { package = "reqwest", version = "0.12.28", default-features = false, features = ["rustls-tls-native-roots-no-provider"]  } # As long as recaptcha-verify's reqwest is outdated
-form_urlencoded = "1.2.2"
 openidconnect.workspace = true
+recaptcha-verify = { default-features = false, version = "0.2.0" }
+reqwest_recaptcha = { default-features = false, features = [
+    "rustls-tls-native-roots-no-provider",
+], package = "reqwest", version = "0.12.28" } # As long as recaptcha-verify's reqwest is outdated
+ruma.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+serde_urlencoded.workspace = true
+thiserror.workspace = true
+tower-http.workspace = true
+tower-sec-fetch = { features = ["tracing"], version = "0.1.2" }
+tower-sessions = { default-features = false, features = [
+    "axum-core",
+], version = "0.15.0" }
+tower-sessions-core = { features = ["deletion-task"], version = "0.15.0" }
+tracing.workspace = true
+url.workspace = true
+validator = { features = ["derive"], version = "0.20.0" }
 
 [build-dependencies]
 memory-serve = "2.1.0"

From 7d3d421564d95a05b3b46f03d5fbe42f0f8920dc Mon Sep 17 00:00:00 2001
From: Lake <lake@e37a.net>
Date: Sun, 12 Jul 2026 15:40:13 -0500
Subject: [PATCH 3/5] ci: run 'cargo shear'

---
 .forgejo/actions/setup-rust/action.yml | 8 ++++++++
 .forgejo/workflows/prek-checks.yml     | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/.forgejo/actions/setup-rust/action.yml b/.forgejo/actions/setup-rust/action.yml
index 61d462513..70b9f2892 100644
--- a/.forgejo/actions/setup-rust/action.yml
+++ b/.forgejo/actions/setup-rust/action.yml
@@ -189,6 +189,13 @@ runs:
           cargo-binstall -y --no-symlinks timelord-cli
           echo "::endgroup::"
         fi
+        if command -v cargo-shear &> /dev/null; then
+          echo "✅ cargo-shear already available"
+        else
+          echo "::group::📦 Installing cargo-shear"
+          cargo binstall -y --no-symlinks cargo-shear
+          echo "::endgroup::"
+        fi
 
     - name: Configure sccache environment
       shell: bash
@@ -214,3 +221,4 @@ runs:
         echo "  Cargo: $(cargo --version)"
         echo "  prek: $(prek --version 2>/dev/null || echo 'installed')"
         echo "  timelord: $(timelord --version 2>/dev/null || echo 'installed')"
+        echo "  cargo-shear: $(cargo-shear --version 2>/dev/null || echo 'installed')"
diff --git a/.forgejo/workflows/prek-checks.yml b/.forgejo/workflows/prek-checks.yml
index 1da09a2aa..3dd4da16e 100644
--- a/.forgejo/workflows/prek-checks.yml
+++ b/.forgejo/workflows/prek-checks.yml
@@ -104,3 +104,6 @@ jobs:
             --profile test \
             --all-targets \
             --no-fail-fast
+
+      - name: Check for unused dependencies
+        run: cargo shear

From 2717ce9a76b6d1b5995e45005f46a4e9d1c40d7e Mon Sep 17 00:00:00 2001
From: Lake <lake@e37a.net>
Date: Sun, 12 Jul 2026 16:10:02 -0500
Subject: [PATCH 4/5] chore: write news fragment for #1976

---
 changelog.d/1976.misc | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/1976.misc

diff --git a/changelog.d/1976.misc b/changelog.d/1976.misc
new file mode 100644
index 000000000..31368ad0c
--- /dev/null
+++ b/changelog.d/1976.misc
@@ -0,0 +1 @@
+Removed unused dependencies and added cargo-shear step to CI. Contributed by Lake (@ezera)

From a0f8c818f38f2861e4397703eb0173f0103a14eb Mon Sep 17 00:00:00 2001
From: Lake <lake@e37a.net>
Date: Fri, 17 Jul 2026 16:52:19 -0500
Subject: [PATCH 5/5] chore(git): ignore web/Cargo.toml reformat in blame

---
 .git-blame-ignore-revs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index ddfc0568e..bbb7adb1f 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -7,3 +7,5 @@ f419c64aca300a338096b4e0db4c73ace54f23d0
 5998a0d883d31b866f7c8c46433a8857eae51a89
 # trailing whitespace and newlines
 46c193e74b2ce86c48ce802333a0aabce37fd6e9
+# reformat src/web/Cargo.toml
+b0c0905472b882ff0cc79232e73d307fd0b5035b