Skip to content
voxlang.orgv0.6.0SSOT

Workspace dependency audit (2026-05)

Rolling closure from the workspace dependency audit v2 plan:

Completed in-tree

Section titled “Completed in-tree”
  • regress: kept as a real dependency of vox-research-events: typify-generated schema_types.generated.rs references ::regress::Regex for pattern-backed string types (grep there before treating it as removable).
  • Workspace inheritance: external crates in high-churn manifests use { workspace = true } with versions centralized in root Cargo.toml.
  • schemars 0.8 vs 1: vox-scientia-jsonschema-codegen depends on workspace alias schemars08 (package = "schemars", version = "0.8") while the rest of the workspace stays on schemars 1.x / typify 0.6.x until a typify upgrade is scoped.
  • LSP stack: consolidated on tower-lsp-server / ls-types (Uri instead of legacy Url).
  • Heavy retrieval: vox-search defaults omit lexical/scrape; consumers opt in via features (tantivy-lexical, web-scrape).
  • Pins: workspace carries current lines for thiserror 2, wasmtime / wasmtime-wasi 44, self_update 0.44, tokio-tungstenite 0.29, etc., per lockfile verification (cargo check --workspace).

Intentional duplicates / deferred

Section titled “Intentional duplicates / deferred”
  • Candle / peft / qlora: unified at Candle 0.10.2, peft-rs 1.0.3, qlora-rs 1.0.5 (pinned by crates/vox-cli/tests/ml_dependency_health.rs); compile-validated by the hosted ml-cuda-health nightly job per ADR 034 (no physical-GPU runtime coverage). Multiple zip majors may still remain via Candle vs other consumers.
  • Rand 0.8 vs 0.9: workspace uses rand09 alias where Oratio STT needs 0.9 APIs; broader unification waits on Wasmtime/Tantivy upstreams.
  • syn 1.x: remains via abi_stable_derive (plugin ABI risk).
  • tiktoken-rs: not replaced by heuristics — cl100k_base is used for accurate budgeting (vox-orchestrator).

Local evidence artifacts

Section titled “Local evidence artifacts”

Optional snapshots (gitignored): .tmp_audit/duplicates.after.txt, .tmp_audit/shear.after.json — regenerate with:

Terminal window
& "$env:USERPROFILE\.cargo\bin\cargo.exe" tree --workspace --duplicates --depth 0 > .tmp_audit/duplicates.after.txt
& "$env:USERPROFILE\.cargo\bin\cargo.exe" shear --format json > .tmp_audit/shear.after.json

Policy

Section titled “Policy”

See Dependency policy.

ADRs

Section titled “ADRs”