Cargo Shear ✂️ 🐑

Detect and fix unused/misplaced dependencies from Cargo.toml in Rust projects.

Installation

# Install from pre-built binaries.
cargo binstall cargo-shear

# Build from source.
cargo install cargo-shear

# Install from brew.
brew install cargo-shear

Usage

cargo shear --fix

Limitations

Important

cargo shear cannot detect "hidden" imports from macro expansions without the --expand flag (nightly only). This is because cargo shear uses rust-analyzer's parser to parse files and does not expand macros by default.

To expand macros:

cargo shear --expand --fix

The --expand flag uses cargo expand, which requires nightly and is significantly slower.

Important

Misplaced dependency detection only works for integration tests, benchmarks, and examples. Unit tests dependencies within #[cfg(test)] cannot be detected as misplaced.

Ignore false positives

False positives can be ignored by adding them to the package's Cargo.toml:

[package.metadata.cargo-shear]
ignored = ["crate-name"]

or in the workspace Cargo.toml:

[workspace.metadata.cargo-shear]
ignored = ["crate-name"]

Otherwise please report the issue as a bug.

CI

- name: Install cargo-binstall
  uses: cargo-bins/cargo-binstall@main

- name: Install cargo-shear
  run: cargo binstall --no-confirm cargo-shear

- run: cargo shear

Exit Code (for CI)

The exit code gives an indication whether unused dependencies have been found:

• 0 if found no unused dependencies,
• 1 if it found at least one unused dependency,
• 2 if there was an error during processing (in which case there's no indication whether any unused dependency was found or not).

With --fix:

• 0 if found no unused dependencies so no fixes were performed,
• 1 if removed some unused dependencies. Useful for running cargo check after cargo-shear changed Cargo.toml.

GitHub Actions Job Example:

- name: cargo-shear
  shell: bash
  run: |
    if ! cargo shear --fix; then
      cargo check
    fi

Technique

1. use the cargo_metadata crate to list all dependencies specified in [workspace.dependencies] and [dependencies]
2. iterate through all package targets (lib, bin, example, test and bench) to locate all Rust files
3. use rust-analyzer's parser (ra_ap_syntax) to parse these Rust files and extract imports

• alternatively, use the --expand option with cargo expand to first expand macros and then parse the expanded code (though this is significantly slower).

4. find the difference between the imports and the package dependencies

Prior Arts

• est31/cargo-udeps
  • it collects dependency usage by compiling your project and find them from the target/ directory
  • does not seem to work anymore with the latest versions of cargo
  • does not work with cargo workspaces
• bnjbvr/cargo-machete
  • it collects dependency usage by running regex patterns on source code
  • does not detect all usages of a dependency
  • does not remove unused dependencies from the workspace root
• cargo and clippy
  • There was intention to add similar features to cargo or clippy, but the progress is currently stagnant
  • See rust-lang/rust#57274 and rust-lang/rust-clippy#4341

Trophy Cases

• -7 lines from oxc
• -59 lines from rspack
• -39 lines from rolldown
• -12 lines ast-grep commit1 commit2
• -66 lines biome
• -164 lines astral-sh/uv
• -86 lines reqsign
• -184 lines from turbopack

Sponsored By