-
Notifications
You must be signed in to change notification settings - Fork 162
Description
imageproc
has a number of external dependencies that are always pulled in, even if I don't use the functionality they provide. For example, ab_glyph
and its dependencies are always pulled in even though I don't render text; rustdct
and its dependencies are always pulled in even though I don't use the DCT; and so on.
I don't want those extra dependencies in my program that uses imageproc
because:
- Having more crates in my dependency tree makes it more difficult for Linux/BSD/etc distributions to package my program
- Having more code in my dependency tree makes it more difficult for organizations that require code review to adopt my program
- Having more publishers in my dependency tree increases the attack surface for supply chain attacks
It would be much better to make these dependencies optional, and gate the modules containing them behind a feature. Rustdoc now has very good support for communicating which modules require which features, so communicating this to users will be easy.
Sadly this would be a semver-breaking change, so this needs to be done in the next major release. image
is going to have an API-breaking change sometime this winter (ish, tentatively), and that will require an API break from imageproc
as well. That's a good opportunity to make these dependencies optional.