feat: add cargo-unused-deps

.spelling

@@ -521,3 +521,6 @@ deprecations
 parallelization
 remediate
 recency
+symlink
+symlinked
+symlinks

CHANGELOG.md

@@ -10,3 +10,4 @@ Please see each crate's change log below:
 - [`cargo-ensure-no-cyclic-deps`](./crates/cargo_ensure_no_cyclic_deps/CHANGELOG.md)
 - [`cargo-ensure-no-default-features`](./crates/cargo-ensure-no-default-features/CHANGELOG.md)
 - [`cargo-heather`](./crates/cargo-heather/CHANGELOG.md)
+- [`cargo-unused-deps`](./crates/cargo-unused-deps/CHANGELOG.md)

README.md

@@ -32,6 +32,7 @@ These are the crates built out of this repo:
 - [`cargo-ensure-no-cyclic-deps`](./crates/cargo_ensure_no_cyclic_deps/README.md) - A cargo subcommand to detect cyclic dependencies in workspace crates
 - [`cargo-ensure-no-default-features`](./crates/cargo-ensure-no-default-features/README.md) - A cargo subcommand that ensures dependencies are declared with default-features = false
 - [`cargo-heather`](./crates/cargo-heather/README.md) - A cargo subcommand to validate license headers in Rust, TOML, PowerShell, Just, and env source files
+- [`cargo-unused-deps`](./crates/cargo-unused-deps/README.md) - A cargo subcommand that finds unused dependencies, starting with uninherited [workspace.dependencies] entries
 
 ## About this Repo
 

crates/cargo-unused-deps/CHANGELOG.md

@@ -0,0 +1 @@
+# Changelog

crates/cargo-unused-deps/Cargo.toml

@@ -0,0 +1,41 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+[package]
+name = "cargo-unused-deps"
+description = "A cargo subcommand that finds unused dependencies, starting with uninherited [workspace.dependencies] entries"
+version = "0.1.0"
+readme = "README.md"
+keywords = ["oxidizer", "cargo", "subcommand", "dependencies", "ci"]
+categories = ["command-line-utilities", "development-tools::cargo-plugins"]
+
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+license.workspace = true
+homepage.workspace = true
+repository = "https://github.com/microsoft/ox-tools/tree/main/crates/cargo-unused-deps"
+
+[package.metadata.docs.rs]
+all-features = true
+
+[package.metadata.cargo_check_external_types]
+# `anyhow::Error` leaks through the `run` entry point that `main` calls. Mirrors the
+# allowlist entry in `cargo-ensure-no-default-features`, which has the same shape.
+allowed_external_types = ["anyhow::Result"]
+
+[[bin]]
+name = "cargo-unused-deps"
+path = "src/main.rs"
+
+[dependencies]
+anyhow = { workspace = true, features = ["std"] }
+cargo_metadata = { workspace = true }
+clap = { workspace = true, features = ["std", "derive", "color", "help", "error-context", "usage"] }
+tempfile = { workspace = true }
+toml_edit = { workspace = true }
+
+# >>> anvil-managed: anvil-lints
+[lints]
+workspace = true
+# <<< anvil-managed: anvil-lints

crates/cargo-unused-deps/README.md

@@ -0,0 +1,101 @@
+<div align="center">
+ <img src="./logo.png" alt="Cargo-Unused-Deps Logo" width="96">
+
+# Cargo-Unused-Deps
+
+[![crates.io](https://img.shields.io/crates/v/cargo-unused-deps.svg)](https://crates.io/crates/cargo-unused-deps)
+[![docs.rs](https://docs.rs/cargo-unused-deps/badge.svg)](https://docs.rs/cargo-unused-deps)
+[![MSRV](https://img.shields.io/crates/msrv/cargo-unused-deps)](https://crates.io/crates/cargo-unused-deps)
+[![CI](https://github.com/microsoft/ox-tools/actions/workflows/main.yml/badge.svg?event=push)](https://github.com/microsoft/ox-tools/actions/workflows/main.yml)
+[![Coverage](https://codecov.io/gh/microsoft/ox-tools/graph/badge.svg?token=FCUG0EL5TI)](https://codecov.io/gh/microsoft/ox-tools)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](../../LICENSE)
+<a href="../.."><img src="../../logo.svg" alt="This crate was developed as part of the Oxidizer project" width="20"></a>
+
+</div>
+
+A cargo sub-command that ensures every `[workspace.dependencies]` entry is
+inherited by at least one workspace member.
+
+A workspace root declares a dependency catalog that members draw from with
+`dep = { workspace = true }`. Nothing requires an entry to be drawn from, so
+an entry nobody inherits stays in the manifest forever: it never enters the
+dependency graph, and no build fails because of it. It still carries a
+version requirement, so it keeps attracting dependency-bump traffic and keeps
+misleading readers about what the workspace depends on.
+
+Unused-dependency tools resolve the crate graph and ask which *declared*
+dependencies go unused, so an entry that no member declares is invisible to
+them. This tool answers the prior question – is the entry inherited at all?
+– from the manifests alone, which makes it free of false positives and cheap
+enough to run on every pull request.
+
+## Usage
+
+Run in a cargo workspace:
+
+```bash
+cargo unused-deps
+```
+
+Remove what it finds:
+
+```bash
+cargo unused-deps --fix
+```
+
+`--manifest-path` points at an explicit workspace root, defaulting to the
+`Cargo.toml` in the current directory. A manifest with no `[workspace]` table
+declares no catalog and passes with a note; `--require-workspace` turns that
+into an error for callers that know they are pointing at a workspace root.
+
+## Configuration
+
+An entry kept on purpose is exempted in the workspace manifest:
+
+```toml
+[workspace.metadata.unused-deps]
+allowed = ["kept-on-purpose"]
+```
+
+An `allowed` name that suppresses nothing is reported as stale, on stderr,
+without failing the run.
+
+## Fixing
+
+`--fix` replaces the manifest atomically – a temporary file in the same
+directory, renamed over the original, carrying the permissions of the
+manifest it replaces and following a symlinked manifest to its target – and
+refuses to write at all if the file changed after it was read, so a
+concurrent edit is never clobbered.
+
+Comments on a removed entry are carried to the next surviving entry, which
+keeps a group header attached to the group it introduces. A note about one
+specific dependency is indistinguishable from such a header, so every move
+is reported on stderr: check that carried text still describes the entry it
+landed on. Comments that cannot be placed – the removal emptied the table,
+or left a trailing survivor with nothing to append to – are reported as
+dropped.
+
+## Installation
+
+```bash
+cargo install cargo-unused-deps
+```
+
+## Example output
+
+```text
+Found 2 unused workspace dependencies in Cargo.toml:
+
+  - once_cell
+  - smallvec
+
+Re-run with --fix to remove them.
+```
+
+
+<hr/>
+<sub>
+This crate was developed as part of <a href="../..">The Oxidizer Project</a>. Browse this crate's <a href="https://github.com/microsoft/ox-tools/tree/main/crates/cargo-unused-deps">source code</a>.
+</sub>
+