v0.38.0 adding plenty of new dependencies

[Turbo87]

How do you use Sentry?

Sentry SaaS (sentry.io)

SDK version

v0.38.0

Steps to reproduce

see https://github.com/rust-lang/crates.io/pull/11143/files

Expected result

No significant increase in dependencies

Actual result

The sentry crate suddenly pulls in actix-web with its 30 dependencies and plenty of other things that we are not actually using.

Is there a reason why the core sentry crate now needs all of these seemingly non-optional dependencies? If this comes from the new OpenTelemetry integration then maybe it would be better to put that behind a feature flag or extract it to a dedicated crate?

[lcian]

Thanks for calling that out.
The reason it's downloading those dependencies is that I forgot a question mark here

release-health = ["sentry-core/release-health", "sentry-actix?/release-health"]

We'll release a fix ASAP.

[Turbo87]

rust-lang/crates.io#11143 was updated to the latest release but it looks like it still contains the actix dependencies for some reason 🤔

[lcian]

Yeah @Turbo87 I've also noticed that, it will be there in Cargo.lock but not actually built, e.g. if you use cargo tree it would not be there.
I think it's just a side effect of the /? syntax so this is the best we can do, see #805 (comment)

[Turbo87]

huh, interesting... I thought that was only the case for target-specific dependencies, not weak dependencies, but looks like you're right. sorry for the noise :)

[lcian]

All good and thank you for reporting, I was also surprised that it works like this.

[lcian]

Linking the relevant cargo issue here for the record rust-lang/cargo#10801
Thanks @Swatinem for sharing

[thomaseizinger]

Would it be an option to perhaps revert the adding of the sentry-actix sub-crate? It is unfortunate that cargo still has this bug but it would be nice to avoid pulling in all of these dependencies into our lockfile.

[lcian]

Would it be an option to perhaps revert the adding of the sentry-actix sub-crate? It is unfortunate that cargo still has this bug but it would be nice to avoid pulling in all of these dependencies into our lockfile.

Sorry but we don't plan to do that, as the intended way to use the crate is to depend directly only on sentry, and activate integrations using feature flags.

It looks like to me that the practical impact of this is limited to the fact that downloading dependencies would take a bit more time on each build, right?
If you use tools like cargo-deny or similar, it seems they are smart enough to understand that the dependency is not actually used, even if it's in the lockfile.

Moreover, the same argument could be made for the tracing integration and all its dependencies, it's still being pulled in for everyone even though they might not be using sentry-tracing at all, due to the fact that we have this line in the Cargo.toml for the top-level sentry crate:

backtrace = ["sentry-backtrace", "sentry-tracing?/backtrace"]

[Turbo87]

FWIW I think a lot more apps use tracing (directly, or through transitive dependencies) compared to actix 😅