From 62df4d714cf57e4c9e4f1daaa3f54a9ef7e1e0c4 Mon Sep 17 00:00:00 2001
From: zyycn <zyycn@users.noreply.github.com>
Date: Sat, 11 Jul 2026 18:06:16 +0800
Subject: [PATCH] refactor: tighten backend dependency graph

Co-authored-by: Codex <noreply@openai.com>
---
 backend/Cargo.lock        | 578 +++++++-------------------------------
 backend/Cargo.toml        |  14 +-
 docs/dependency-review.md |  97 +++++++
 3 files changed, 201 insertions(+), 488 deletions(-)
 create mode 100644 docs/dependency-review.md

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index fd12ceef6..5e7f7fa18 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -289,15 +289,15 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.2.65"
+version = "1.2.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -366,7 +366,7 @@ dependencies = [
  "indexmap",
  "ipnet",
  "percent-encoding",
- "rand 0.10.1",
+ "rand 0.10.2",
  "rand_core 0.6.4",
  "redis",
  "reqwest",
@@ -382,7 +382,7 @@ dependencies = [
  "subtle",
  "tar",
  "tempfile",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tokio-tungstenite",
  "tokio-util",
@@ -446,49 +446,12 @@ version = "0.15.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b85f248a4de22d204ceabc6299d89d2c70fbd7f09fea53c06c852369652d8139"
 dependencies = [
- "async-trait",
- "convert_case",
- "json5",
  "pathdiff",
- "ron",
- "rust-ini",
- "serde-untagged",
  "serde_core",
- "serde_json",
- "toml",
  "winnow",
  "yaml-rust2",
 ]
 
-[[package]]
-name = "const-random"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
-dependencies = [
- "const-random-macro",
-]
-
-[[package]]
-name = "const-random-macro"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
-dependencies = [
- "getrandom 0.2.17",
- "once_cell",
- "tiny-keccak",
-]
-
-[[package]]
-name = "convert_case"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
-dependencies = [
- "unicode-segmentation",
-]
-
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -578,33 +541,27 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.15"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-queue"
-version = "0.3.12"
+version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
-
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "crypto-common"
@@ -688,23 +645,23 @@ dependencies = [
 
 [[package]]
 name = "dirs"
-version = "5.0.1"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
 dependencies = [
  "dirs-sys",
 ]
 
 [[package]]
 name = "dirs-sys"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
 dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -718,15 +675,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "dlv-list"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
-dependencies = [
- "const-random",
-]
-
 [[package]]
 name = "document-features"
 version = "0.2.12"
@@ -766,17 +714,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
-[[package]]
-name = "erased-serde"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
-dependencies = [
- "serde",
- "serde_core",
- "typeid",
-]
-
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -1012,11 +949,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -1026,9 +961,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1050,12 +987,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -1094,7 +1025,7 @@ dependencies = [
  "http",
  "httpdate",
  "mime",
- "sha1 0.10.6",
+ "sha1 0.10.7",
 ]
 
 [[package]]
@@ -1195,9 +1126,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.12"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9155a582abd142abc056962c29e3ce5ff2ad5469f4246b537ed42c5deba857da"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
 dependencies = [
  "typenum",
 ]
@@ -1416,11 +1347,11 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jobserver"
-version = "0.1.34"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "libc",
 ]
 
@@ -1435,17 +1366,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "json5"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
-dependencies = [
- "pest",
- "pest_derive",
- "serde",
-]
-
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -1460,9 +1380,9 @@ checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libredox"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
 dependencies = [
  "libc",
 ]
@@ -1544,9 +1464,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "mime"
@@ -1637,16 +1557,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
-[[package]]
-name = "ordered-multimap"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
-dependencies = [
- "dlv-list",
- "hashbrown 0.14.5",
-]
-
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -1699,49 +1609,6 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
-[[package]]
-name = "pest"
-version = "2.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
-dependencies = [
- "memchr",
- "ucd-trie",
-]
-
-[[package]]
-name = "pest_derive"
-version = "2.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
-dependencies = [
- "pest",
- "pest_generator",
-]
-
-[[package]]
-name = "pest_generator"
-version = "2.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
-dependencies = [
- "pest",
- "pest_meta",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "pest_meta"
-version = "2.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
-dependencies = [
- "pest",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -1817,7 +1684,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tracing",
  "web-time",
@@ -1825,20 +1692,21 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.15"
+version = "0.11.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
+checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
 dependencies = [
  "bytes",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "lru-slab",
- "rand 0.9.4",
+ "rand 0.10.2",
+ "rand_pcg",
  "ring",
  "rustc-hash",
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.18",
+ "thiserror",
  "tinyvec",
  "tracing",
  "web-time",
@@ -1846,16 +1714,16 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.14"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
 dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1891,9 +1759,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
@@ -1934,6 +1802,15 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "redis"
 version = "1.3.0"
@@ -1972,20 +1849,20 @@ dependencies = [
 
 [[package]]
 name = "redox_users"
-version = "0.4.6"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
  "getrandom 0.2.17",
  "libredox",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.4"
+version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1995,9 +1872,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "1f388202e4b80542a0921078cc23b6333bcf1409c1e3f86404cae4766a6131db"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2068,35 +1945,11 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "ron"
-version = "0.12.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81116b9531d61eabc41aeb228e4b6b2435bcca3233b98cf3b3077d4e6e9debb3"
-dependencies = [
- "bitflags",
- "once_cell",
- "serde",
- "serde_derive",
- "typeid",
- "unicode-ident",
-]
-
-[[package]]
-name = "rust-ini"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
-dependencies = [
- "cfg-if",
- "ordered-multimap",
-]
-
 [[package]]
 name = "rustc-hash"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustix"
@@ -2139,9 +1992,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.1"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
 dependencies = [
  "web-time",
  "zeroize",
@@ -2160,9 +2013,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "ryu"
@@ -2233,18 +2086,6 @@ dependencies = [
  "serde_derive",
 ]
 
-[[package]]
-name = "serde-untagged"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9faf48a4a2d2693be24c6289dbe26552776eb7737074e6722891fadbe6c5058"
-dependencies = [
- "erased-serde",
- "serde",
- "serde_core",
- "typeid",
-]
-
 [[package]]
 name = "serde_core"
 version = "1.0.228"
@@ -2290,15 +2131,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "serde_spanned"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
-dependencies = [
- "serde_core",
-]
-
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -2313,9 +2145,9 @@ dependencies = [
 
 [[package]]
 name = "sha1"
-version = "0.10.6"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
@@ -2468,7 +2300,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -2511,7 +2343,6 @@ dependencies = [
  "sqlx-postgres",
  "sqlx-sqlite",
  "syn",
- "thiserror 2.0.18",
  "tokio",
  "url",
 ]
@@ -2539,7 +2370,7 @@ dependencies = [
  "sha1 0.11.0",
  "sha2 0.11.0",
  "sqlx-core",
- "thiserror 2.0.18",
+ "thiserror",
  "tracing",
  "uuid",
 ]
@@ -2568,14 +2399,14 @@ dependencies = [
  "log",
  "md-5",
  "memchr",
- "rand 0.10.1",
+ "rand 0.10.2",
  "serde",
  "serde_json",
  "sha2 0.11.0",
  "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror 2.0.18",
+ "thiserror",
  "tracing",
  "uuid",
  "whoami",
@@ -2601,7 +2432,7 @@ dependencies = [
  "percent-encoding",
  "serde",
  "sqlx-core",
- "thiserror 2.0.18",
+ "thiserror",
  "tracing",
  "url",
  "uuid",
@@ -2691,33 +2522,13 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.18",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "thiserror-impl",
 ]
 
 [[package]]
@@ -2733,18 +2544,18 @@ dependencies = [
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "time"
-version = "0.3.51"
+version = "0.3.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c17d80feb7334b40c484e45ed1a5273dfd8bfda537c3be2e74a06a6686f327"
+checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50"
 dependencies = [
  "deranged",
  "num-conv",
@@ -2762,23 +2573,14 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.30"
+version = "0.2.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcef1a61bdb119096e153208ec5cbec23944ce8bca13be5c7f60c634f7403935"
+checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f"
 dependencies = [
  "num-conv",
  "time-core",
 ]
 
-[[package]]
-name = "tiny-keccak"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
-dependencies = [
- "crunchy",
-]
-
 [[package]]
 name = "tinystr"
 version = "0.8.3"
@@ -2791,9 +2593,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -2881,37 +2683,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "toml"
-version = "1.1.2+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
-dependencies = [
- "serde_core",
- "serde_spanned",
- "toml_datetime",
- "toml_parser",
- "winnow",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
-dependencies = [
- "serde_core",
-]
-
-[[package]]
-name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
-dependencies = [
- "winnow",
-]
-
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -2925,7 +2696,6 @@ dependencies = [
  "tokio",
  "tower-layer",
  "tower-service",
- "tracing",
 ]
 
 [[package]]
@@ -2990,7 +2760,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
  "symlink",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tracing-subscriber",
 ]
@@ -3079,29 +2849,17 @@ dependencies = [
  "rand 0.9.4",
  "rustls",
  "rustls-pki-types",
- "sha1 0.10.6",
- "thiserror 2.0.18",
+ "sha1 0.10.7",
+ "thiserror",
  "utf-8",
 ]
 
-[[package]]
-name = "typeid"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
-
 [[package]]
 name = "typenum"
 version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
-[[package]]
-name = "ucd-trie"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
-
 [[package]]
 name = "unicase"
 version = "2.9.0"
@@ -3135,12 +2893,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
-[[package]]
-name = "unicode-segmentation"
-version = "1.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
-
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -3387,31 +3139,13 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
+ "windows-targets",
 ]
 
 [[package]]
@@ -3423,192 +3157,70 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "winnow"
 version = "1.0.3"
@@ -3705,18 +3317,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.52"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.52"
+version = "0.8.54"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 5070ee970..5f69b3559 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -8,12 +8,12 @@ rust-version = "1.95"
 [dependencies]
 argon2 = "0.5.3"
 async-trait = "0.1.89"
-axum = "0.8.9"
+axum = { version = "0.8.9", default-features = false, features = ["http1", "json", "query", "tokio", "tracing"] }
 base64 = "0.22.1"
 bytes = "1.11.1"
 chrono = { version = "0.4.45", features = ["serde", "clock"] }
-config = "0.15.23"
-dirs = "5.0.1"
+config = { version = "0.15.23", default-features = false, features = ["yaml"] }
+dirs = "6.0.0"
 flate2 = "1.1.9"
 futures = "0.3.32"
 hex = "0.4.3"
@@ -21,8 +21,10 @@ indexmap = { version = "2.0", features = ["serde"] }
 ipnet = "2.12.0"
 percent-encoding = "2.3.2"
 rand = "0.10.1"
+# Enables password_hash::rand_core::OsRng for argon2 0.5.
 rand_core = { version = "0.6.4", features = ["getrandom"] }
 redis = { version = "1.3.0", default-features = false, features = ["tokio-comp", "connection-manager", "script"] }
+# Pinned to the Codex Desktop 26.707.41301 HTTP stack; re-audit a newer Desktop before upgrading.
 reqwest = { version = "=0.12.28", default-features = false, features = ["json", "stream", "cookies", "rustls-tls-native-roots", "gzip", "brotli", "zstd", "deflate", "http2"] }
 rustls = { version = "=0.23.36", default-features = false, features = ["ring", "std", "tls12"] }
 rustls-native-certs = "0.8.4"
@@ -32,11 +34,11 @@ semver = "1.0.27"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["preserve_order"] }
 sha2 = "0.10.9"
-sqlx = { version = "0.9.0", features = ["runtime-tokio", "tls-rustls", "postgres", "sqlite", "chrono", "uuid", "json"] }
+sqlx = { version = "0.9.0", default-features = false, features = ["runtime-tokio", "tls-rustls", "postgres", "sqlite-bundled", "chrono", "uuid", "json"] }
 subtle = "2.6.1"
 tar = "0.4.44"
 thiserror = "2.0.18"
-tokio = { version = "1.52.3", features = ["macros", "rt-multi-thread", "signal", "fs", "time", "sync", "net", "test-util"] }
+tokio = { version = "1.52.3", default-features = false, features = ["macros", "rt-multi-thread", "signal", "fs", "time", "sync", "net"] }
 tokio-util = { version = "0.7.18", features = ["rt"] }
 tokio-tungstenite = { version = "0.28.0", features = ["proxy", "rustls-tls-native-roots"] }
 tower = { version = "0.5.3", features = ["util"] }
@@ -49,7 +51,9 @@ url = "2.5.8"
 uuid = { version = "1.23.3", features = ["v4", "v7", "serde"] }
 
 [dev-dependencies]
+sqlx = { version = "0.9.0", default-features = false, features = ["derive"] }
 tempfile = "3.27.0"
+tokio = { version = "1.52.3", default-features = false, features = ["test-util"] }
 wiremock = "0.6.5"
 
 [patch.crates-io]
diff --git a/docs/dependency-review.md b/docs/dependency-review.md
new file mode 100644
index 000000000..396c342c0
--- /dev/null
+++ b/docs/dependency-review.md
@@ -0,0 +1,97 @@
+# 依赖健康审计(backend)
+
+> 审计于 `feat/postgres-redis-migration` 工作树，2026-07-11 以 `b0d8be0a` 复核。对象为 `backend/Cargo.toml` 的 41 个直接依赖 + 2 个 dev-dependencies；Linux normal+build 依赖树 299 个 crate，Cargo.lock 全平台 382 个。方法：`cargo tree -d`（重复版本）、cargo-machete 0.9.2（未使用依赖）、cargo-audit 0.22.2 + RustSec 1159 条 advisory（漏洞）、crates.io 当前版本、`rg` 逐个抽查 feature 与 crate 的实际代码使用点。
+
+先说结论：底子相当健康。machete 零未使用，cargo audit 零漏洞零警告，redis/reqwest/rustls 的 feature 白名单纪律很好，也没有重复能力 crate。需要处理的是三类问题：**config 与 SQLx 默认 feature 带来的无用编译能力**、**测试 feature 混入生产依赖**，以及**缺少就地说明的 TLS 指纹版本 pin**。SQLite bundled C 库确有成本，但 `import-sqlite` 仍是权威架构规定的正式命令，本轮不能用默认关闭的兼容 feature 隐藏；源库退役后应直接删除整条导入路径。
+
+## 实施结果（2026-07-11）
+
+- 已完成 config、SQLx、Tokio、Axum feature 收窄；SQLx derive 与 Tokio test-util 只在 dev-dependencies 启用；dirs 升至 6.0.0，并刷新全部兼容范围内的 lock 版本。`cargo update --locked --dry-run` 最终为 0 个可更新包。
+- Linux normal+build 依赖从 299 降至 272 个 package id，Cargo.lock 全平台 package 从 382 降至 338；生产树已无 `sqlx-macros`，config 的 INI/RON/JSON5/TOML 解析链及相关 proc-macro 已移除。
+- `cargo machete --with-metadata backend` 为 0 个未使用依赖；`cargo audit --file backend/Cargo.lock` 为 0 漏洞、0 warning；生产 check、all-target/all-feature clippy、release build 均在 `RUSTFLAGS=-D warnings` 下通过。
+- PostgreSQL/Redis 实库测试共 634 项，结果 634 passed / 0 failed。测试仍全部位于 `backend/tests/`，没有向 `backend/src/` 写入测试代码。
+- runtime 镜像 `codex-proxy-rs:dependency-review` 构建成功，镜像 ID `sha256:f1f297745aa9`，本机显示 158 MB；Trivy 0.72.0 对 HIGH/CRITICAL、ignore-unfixed 扫描为 0 漏洞。使用独立 PostgreSQL 18 + Redis 8 启动后 `/healthz` 返回 204，容器 healthy、0 次重启，启动日志 WARN/ERROR/PANIC/FATAL 均为 0。
+- tower-http 0.7 与 reqwest 0.12.28 的传递依赖约束冲突，单独升级会同时保留 0.6/0.7 两套，因此按审计结论保持 0.6.11；SQLite 导入路径也按权威架构继续作为正式命令保留，没有引入临时 feature 或兼容分支。
+
+## P0 — 常驻的无用编译成本
+
+### 1. config 默认 features 全开:只用 YAML,却编译着 5 种用不到的格式解析器
+- 现状:`config = "0.15.23"` 未声明 features → 默认打开 `toml, json, yaml, ini, ron, json5, convert-case, async`。而代码里唯一的加载点是 `bootstrap/config.rs:383` 的 `File::from(config.yaml)`,格式只有 YAML(`load_from_dir` 硬编码 `config.yaml`,无其他扩展名支持)。
+- 实测:`cargo tree -i` 逐个确认 rust-ini、ordered-multimap、dlv-list、const-random(+proc-macro)、ron、json5、pest/pest_derive/pest_generator/pest_meta、toml、convert_case 全部**只被 config 拉入**——约 13 个 crate 纯死重,其中 pest_derive、const-random-macro 是 proc-macro(占编译关键路径)。这条链还顺带引入了全树第三个 hashbrown 版本(0.14.5,经 rust-ini→ordered-multimap)和一支 getrandom 0.2(经 const-random)。
+- 建议:`config = { version = "0.15", default-features = false, features = ["yaml"] }`。一行改动,-13 crate,风险≈0。
+
+### 2. SQLx 默认 features 与 `sqlite` 总开关同时过宽
+- 现状：`sqlx` 没有设置 `default-features = false`，因此除显式功能外还启用了默认的 `any`、`macros`、`migrate`、`json`。项目使用自建 PG 迁移框架，生产代码没有 SQLx 查询宏；唯一的 `sqlx::FromRow` derive 位于外部测试。显式的 `sqlite` 又是总开关，同时启用 bundled、deserialize、load-extension、unlock-notify；导入代码只需要 bundled 基础驱动。
+- 问题：生产构建编译了没有调用方的 SQLx Any、宏、内置迁移和 SQLite 扩展能力。原审计只看到 SQLite C 库，漏掉了这部分更容易消除的成本。
+- 建议：主依赖设置 `default-features = false`，显式保留 PG、JSON、chrono、uuid、运行时与 TLS，并将 `sqlite` 收窄为 `sqlite-bundled`；仅在 dev-dependencies 为外部测试开启 `derive`。
+
+### 3. bundled SQLite C 库仍在生产二进制，但当前不能 feature-gate
+- 现状：`sqlite-bundled` 会编译并静态链接 SQLite C amalgamation，顺带引入 sqlx-sqlite、libsqlite3-sys 和 flume。唯一业务调用方是 `bootstrap/import_sqlite/`，但 `main.rs`、`docs/architecture.md` 与 `docs/database.md` 均把 `import-sqlite` 定义为正式维护命令。
+- 结论：成本真实存在，原建议的默认关闭 Cargo feature 却会让标准发布二进制缺少权威命令，不予采用。当前只收窄 SQLx 能力；SQLite v3 源库退役后，直接删除 `import-sqlite` 分支、`bootstrap/import_sqlite/`、相关外部测试和 SQLite feature，不保留兼容开关。
+
+## P1 — 策略与卫生
+
+### 4. reqwest / rustls 精确 pin 缺少就地说明，但动机已经确认
+- 现状：`=0.12.28` / `=0.23.36` 从 scaffold 首提交 `fc47967f` 就存在。该提交的 `docs/dependency-policy.md` 明确要求：在 TLS 指纹复核证明新版本与真实 Codex Desktop 一致前保持两者固定。该文档后来随旧项目布局清理，但决策没有被推翻，Cargo.toml 也一直保留精确 pin。
+- 最新实物复核：解包 2026-07-11 官方 latest DMG，应用版本为 `26.707.41301`（DMG SHA-256 `467a25381af2943f2c9b8794adae28b36400bd6da2753daf4889a5fd550c4d65`）。内置 Codex 二进制同时含 `reqwest 0.12.28` 与 `0.13.4`；对照同日 OpenAI Codex 源码 `5c19155c`，Codex API、core 与 http-client 主请求链仍使用 workspace `reqwest 0.12`，只有独立的 `rmcp-client` 使用 `0.13`。内置 `rustls` 仍为 `0.23.36`。因此不能因二进制出现 `reqwest 0.13.4` 就升级本项目主传输栈，当前两个精确 pin 与最新 Desktop 主链一致。
+- provider 边界：最新 Codex 通过 `codex-utils-rustls-provider` 进程级安装 AWS-LC，以覆盖企业代理可能使用的 ECDSA P-521/SHA-512；本项目当前显式使用 ring。provider 切换会改变签名算法、构建链和 TLS 行为，不属于版本新旧问题，本轮不夹带修改。若决定追齐，必须作为独立 TLS 指纹变更，覆盖真实 OpenAI HTTP、SSE、WebSocket、自定义 CA 与发布镜像后再落地。
+- 风险：精确 pin 会阻止 `cargo update` 自动接收后续补丁；当前 reqwest 0.12.28 已是 0.12 最新版，rustls 0.23 已有 0.23.41。本次 cargo audit 无漏洞，但未来 advisory 必须触发显式 TLS 指纹复核与版本修改。
+- 结论：保留两个 pin，在 Cargo.toml 直接记录已核实的 Desktop 版本；升级前重新解包当时 latest Desktop，并用官方源码区分主链与旁路依赖。`security-scan.yml` 已在 push、pull request 与定时任务执行 cargo audit，无需重复新增门禁。
+
+### 5. 九个 crate 多版本共存，根因三个，可控的只有 config 一条
+- 现状(`cargo tree -d`):rand_core ×3(0.6.4 / 0.9.5 / 0.10.1)、getrandom ×3(0.2 / 0.3 / 0.4)、hashbrown ×3(0.14 / 0.16 / 0.17);rand、sha2、digest、crypto-common、block-buffer、cpufeatures 各 ×2。
+- 根因拆解(逐个 `cargo tree -i` 核实):
+  - **config→rust-ini 链**:hashbrown 0.14 与 getrandom 0.2 的 const-random 支——做 P0-1 顺带消掉;
+  - **tungstenite fork 停在 rand 0.9 线**:rand 0.9.4 / rand_core 0.9.5 / getrandom 0.3 全部来自 openai-oss-forks 的 tungstenite,与直接依赖 rand 0.10 + sqlx-postgres 的 rand 0.10 线分叉——只有更新 fork 才能统一;
+  - **RustCrypto 世代分裂**:argon2 0.5(blake2/password-hash)、sha1(tungstenite/headers)、sqlx-core 在 digest 0.10 线,sqlx-postgres 已迁 digest 0.11 线(sha2 0.11 / hmac 0.13 / md-5 0.11)——等 argon2 0.6 转正(现为 0.6.0-rc.8)可再收敛一档。hashbrown 0.16(sqlx 的 hashlink)与 0.17(indexmap 2.14)属生态过渡期,不可控。
+- 建议:做 P0-1;fork 侧机会性跟进 rand 0.10;argon2 0.6 stable 后升级统一。其余接受现状,无需折腾。
+
+### 6. tokio `test-util` feature 挂在生产 [dependencies]
+- 现状:`tokio = { features = [..., "test-util"] }` 在主依赖表;全 `src/` 无 `pause/advance/start_paused` 使用,唯一使用方是 `tests/upstream/openai/transport/websocket.rs`。
+- 问题:生产二进制的 tokio 编译进了测试专用的时间控制代码路径,属语义污染(体积影响小)。
+- 建议:[dev-dependencies] 加 `tokio = { version = "1", features = ["test-util"] }`,主表删除该 feature。dev-deps 的 feature 在编译测试时做并集,单元/集成测试均不受影响。
+
+## P2 — 例行升级与可选收窄,视精力而定
+
+### 7. dirs 5.0.1 落后一个 major（crates.io 最新 6.0.0）
+- 仅 `infra/paths.rs` 两处调用(`data_local_dir` / `home_dir`),升级面极小,顺手一并做。
+
+### 8. axum 默认 features 可白名单（收益小）
+- 实测未用 Form / ws / MatchedPath / OriginalUri / Multipart，只用 Query 与 Json；可收窄为 `features = ["http1", "json", "query", "tokio", "tracing"]` + `default-features = false`。改动后需要跑全量测试确认没有隐式依赖 tower-log 等。
+
+### 9. tower-http 0.7.0 必须与 reqwest/TLS 指纹升级一起处理
+- 0.7.0 是当前最新版，但固定的 reqwest 0.12.28 依赖 `tower-http ^0.6.8`。应用单独升级会让 0.6 与 0.7 两套 tower-http 同时进入依赖树，违背本轮收敛目标。
+- 0.7.0 还包含 `ServeDir` 尾斜杠文件路径从 200 改为 404 的行为变化；本项目用 `ServeDir` 提供 SPA 静态文件与 fallback。结论是本轮保留 0.6.11，等 reqwest/TLS 指纹升级时同步升级，并覆盖静态文件、SPA fallback、未知 API 与尾斜杠路径。
+
+### 10. futures facade 可换 futures-util（迁移退役后处理）
+- 全仓使用的 Stream / StreamExt / TryStreamExt / SinkExt / join_all / stream::unfold 都来自 futures-util；但当前 sqlx-sqlite 同样依赖 futures-executor，现在替换直接依赖不能从构建树移除它。等 SQLite 导入路径删除后再替换，避免只有语义没有实际收益的改动。
+
+### 11. 例行 `cargo update`
+- 2026-07-11 的 `cargo update --dry-run` 显示 29 个兼容更新，包括 bytes 1.12.1、rand 0.10.2、rustls-pki-types 1.15.0、regex 1.13.0、time 0.3.53 等。按既有依赖策略独立刷新 lock，并执行完整质量门禁；精确 pin 与 major 版本不混入该步骤。
+
+## 做得好的(记录一下,免得反复怀疑)
+
+- **cargo-machete 全绿**：41 个直接依赖零未使用；原有 dev-deps 只有 tempfile + wiremock 两个，极简。
+- **重量级 crate 的 feature 纪律好**:redis `default-features = false` 只开 tokio-comp/connection-manager/script(script 实测 `fleet/refresh/lease.rs:49` Lua 租约在用);reqwest `default-features = false`、TLS 明确走 rustls-tls-native-roots(全树无 openssl);rustls `default-features = false` 只开 ring/std/tls12;tokio 逐项列 feature 而不是无脑 `full`。
+- **reqwest 四种解压 feature 与代码一致**:gzip/brotli/zstd/deflate 在 `transport/client.rs:81-84` 全部显式开启,指纹 Accept-Encoding 头(`bootstrap/config.rs:230`)也四种全声明——不是拍脑袋开的。
+- **serde_json `preserve_order` + indexmap 是刻意设计**:透明代理与指纹头需要保序(`transport/headers.rs`、`fingerprint/*` 全用 IndexMap),与 /v1/responses 透明性目标一致,不是多余 feature。
+- **无重复能力 crate**:HTTP client、JSON、时间库(chrono)、错误派生(thiserror)各一个;tungstenite + tokio-tungstenite 是基座+异步包装的正常组合,不算重复。
+- **版本总体接近 latest**：axum 0.8.9、tokio 1.52.3、sqlx 0.9.0、redis 1.3.0、serde 1.0.228、tracing 0.1.44、chrono 0.4.45 等对照 crates.io 均为当前稳定版；明确例外是 TLS 指纹 pin、dirs/tower-http major 与待刷新的兼容 lock。cargo audit 零漏洞零警告。
+- **release profile 配套到位**:lto=thin、codegen-units=1、strip=symbols、panic=abort,对 299 crate 的树该省的都省了;`rust-version = "1.95"` 明示 MSRV。
+
+## 核实过的误报
+
+- **rand_core 0.6.4 直接依赖"看似没人 use"**——实为 feature-enabler:`infra/identity.rs:4` 用的 `password_hash::rand_core::OsRng` 要求 rand_core 的 `getrandom` feature,而 argon2 0.5.3 的 features 表(已核实)没有透传开关,只能由顶层依赖做 feature 并集打开。**不能删**;建议在 Cargo.toml 加一行注释防止后人误删(machete 恰好因 `password_hash::rand_core::` 的字符串巧合不报它,属侥幸而非可靠)。
+- **tungstenite 0.27 + tokio-tungstenite 0.28 版本"错位"不是 bug**:两者都被 `[patch.crates-io]` 指到 openai-oss-forks 的固定 rev,fork 内部自洽;deflate/proxy feature 也确有使用(`transport/websocket.rs:280` permessage-deflate)。
+- **直接依赖 sha2 0.10 不升 0.11 是对的**:0.10 线还被 argon2(blake2)、sha1、sqlx-core 占着,单独升直依赖消不掉旧版本,反而破坏 password-hash 生态兼容。
+- **flate2 与 reqwest 的 gzip 不重复**:前者是自更新 tar.gz 的同步解包(`update/archive.rs`),后者是 HTTP 响应异步解压,场景不同,各自成立。
+- **`cargo tree -d` 里 tokio/thiserror/uuid/chrono/serde_json 同版本出现两次不是重复版本**:那是 sqlx proc-macro 的 host 侧构建单元,同版本、不同构建上下文,正常现象,不可也不必消除。
+- **flume "凭空"出现在树里**：确认只被 sqlx-sqlite 拉入；当前正式导入命令仍保留，因此它会在 SQLite 路径退役时一起消失，无需单独处理。
+
+## 建议动手顺序
+
+1. **feature 卫生**：config 只开 YAML；SQLx 关闭默认 features 并把 `sqlite` 收窄为 `sqlite-bundled`；tokio `test-util` 与 SQLx `derive` 下沉 dev-dependencies；axum 使用显式白名单。
+2. **决策就地化**：为 reqwest/rustls pin 与 rand_core feature-enabler 写短注释，CI cargo audit 保持现状。
+3. **例行升级**：dirs 升 6，执行兼容范围内的 cargo update，并跑完整门禁。
+4. **TLS 栈升级时同步处理 tower-http**：本轮保持 0.6.11；未来 reqwest 指纹复核通过后同步升级 0.7，并执行 assets 路由与全量测试。
+5. **迁移退役清理**：确认 SQLite v3 源库不再需要后，一次删除 import-sqlite、SQLite 依赖和相关测试；随后把 futures facade 换成 futures-util。此前不引入 feature 兼容路径。