chore(scripts): add tinyanalyzer-driven dependency audit across core and vendor submodules - #6353

package.json:61

[RULE] renamed-dependency-detection

This command invokes the audit that scans source imports using the manifest dependency name rather than Cargo's resolved package/crate name. A dependency such as serde1 = { package = "serde" } can therefore be reported as unused even though the source correctly imports serde, encouraging deletion of a required dependency and breaking the target build. Resolve each dependency's package rename before textual scanning.

package.json:61

[RULE] symlink-lockfile

The command snapshots lockfiles with cp and restores them by writing to the lockfile path. If a target's Cargo.lock is a symlink, both operations follow it, so an audit can overwrite or restore an unrelated file outside the target (and potentially outside the repository). Refuse symlinked lockfiles or snapshot and restore the symlink itself without following it.

scripts/dep-audit/README.md

[RULE] renamed-dependency-detection

Cargo permits a dependency such as serde1 = { package = "serde" }, while Rust source imports it as serde. The scanner derives its search identifier from the manifest dependency key and does not resolve the package rename, so it can report a required dependency as removable. The README should not present this scan as sufficient until renamed dependencies are resolved.

scripts/dep-audit/report.mjs:172

[RULE] resolve-renamed-dependencies

The manifest dependency name is not necessarily the Rust crate name. A declaration such as serde1 = { package = "serde" } can be used in source as serde::...; replacing hyphens in serde1 does not find that use, so the report emits a false remove verdict and may recommend deleting a required dependency. Resolve the dependency's package name from the manifest (or the resolved package metadata) before building the scan pattern and graph lookup.

scripts/dep-audit/run.sh:141

[RULE] reject-symlinked-lockfiles

-f follows symlinks, so a symlinked Cargo.lock is treated as a normal lockfile. Cargo metadata can then rewrite the symlink target, and the restoration cp also follows it, potentially modifying an unrelated file during an audit. Check that the lockfile is a regular non-symlink file before analyzing it, or refuse the target.

scripts/dep-audit/README.md

[RULE] symlinked-lockfile

The documented backup/restore flow does not reject a symlinked Cargo.lock. Because cp and the later restore follow the link, auditing a target with a symlinked lockfile can overwrite the link target rather than restore the target's original file, causing data corruption outside the expected lockfile path. Refuse symlinked lockfiles before analysis.

scripts/dep-audit/report.mjs:174

[RULE] syntax-aware-dependency-use

This grep treats comments and string literals as crate references whenever they contain forms such as foo::, #[foo], or foo!. For example, a comment containing serde:: makes an actually unused serde dependency get a keep verdict, hiding a removable dependency. Use a syntax-aware scan or strip comments and strings before applying the crate-use patterns.

scripts/dep-audit/README.md:84

[RULE] overbroad-unused-suppression

The shared configuration globally suppresses thiserror for every target, including targets where it may be genuinely unused. This can hide a real removable dependency and prevents the report's re-check from evaluating it. Scope the exception to verified targets or remove the global suppression.

scripts/dep-audit/README.md:110

[RULE] development-dependency-cost

The analyzer configuration explicitly includes development dependencies, but this section presents every direct dependency's exclusive footprint as build cost without distinguishing dev or build kinds. Test- and example-only dependencies can therefore be reported as costs of the shipped build even though Cargo does not link them into a normal release. Restrict the table to runtime dependencies or label the dependency kinds and change the claim.

scripts/dep-audit/report.mjs:74

[RULE] serialize-drift-summary

driftAcross attaches patch_only as a custom property to an Array. JSON.stringify serializes array elements but not custom properties, so summary.json loses the patch-only count even though the Markdown renderer can read it in memory. Store drift as an object with rows and patch_only, or otherwise copy the count into an enumerable object field used by both outputs.

scripts/dep-audit/tinyanalyzer.toml:22

[RULE] overbroad-unused-suppression

This configuration is passed to every target, so any crate that declares thiserror but does not actually use it is silently omitted from the unused-dependency audit. For example, a target with thiserror = "..." and no thiserror::Error derive would be a genuine removable dependency, but this global entry prevents tinyanalyzer and the later report from surfacing it. Remove the entry or scope it to specific verified targets/false-positive cases.

scripts/dep-audit/tinyanalyzer.toml:13

[RULE] development-dependency-cost

Enabling include_dev makes test- and benchmark-only dependencies participate in the analyzer output, while the audit documentation describes the heavy-dependency section as the cost of the shipped build. Those dependencies are not linked into a normal release build, so they can be reported as shipped-build costs even when they only support tests or examples. Either disable this for the shipped-build analysis or ensure the report distinguishes dev/build dependencies and excludes them from shipped-build rankings.

scripts/dep-audit/run.sh:139

[RULE] remove-created-lockfiles

When a target has no pre-existing Cargo.lock, cargo metadata may create one, but lock_backup remains empty and the cleanup block never removes it. This contradicts the script's promise not to leave edits behind and dirties repositories that intentionally do not commit a lockfile. Track the missing-lockfile case and delete the newly created file after analysis.