feat(deps): use cargo machete --with-metadata and remove unused dev-deps

[josecelano]

Summary

Fixes #1804.

Plain cargo machete uses text-scan which produces false negatives for dev-dependencies.
Switching to cargo machete --with-metadata (which uses cargo metadata for accurate
crate-name resolution) revealed 22 unused dev-dependencies that the old check was silently
missing.

Changes

Pre-commit hook

• contrib/dev-tools/git/hooks/pre-commit.sh: changed cargo machete → cargo machete --with-metadata

Cargo.toml files cleaned up (21 genuine unused dev-deps removed across 13 files)

Package	Removed dev-dependencies
root Cargo.toml	local-ip-address, mockall
packages/axum-health-check-api-server	tracing-subscriber
packages/axum-http-tracker-server	torrust-tracker-events, zerocopy
packages/axum-rest-tracker-api-server	local-ip-address, mockall
packages/http-tracker-core	formatjson, serde_json
packages/peer-id	pretty_assertions (entire [dev-dependencies] removed)
packages/primitives	rstest (entire [dev-dependencies] removed)
packages/server-lib	rstest (entire [dev-dependencies] removed)
packages/swarm-coordination-registry	async-std, criterion, rand, torrust-tracker-test-helpers
packages/torrent-repository-benchmarking	async-std
packages/tracker-core	local-ip-address, torrust-rest-tracker-api-client
packages/udp-tracker-core	torrust-tracker-test-helpers
packages/udp-tracker-server	local-ip-address

False-positive handled

serde_bytes in packages/axum-http-tracker-server is used via #[serde(with = "serde_bytes")]
string attributes in test code — cargo machete cannot detect this pattern. It is kept and
suppressed via:

[package.metadata.cargo-machete]
ignored = ["serde_bytes"]
# cargo-machete cannot detect serde_bytes usage via #[serde(with = "serde_bytes")] string
# attributes in test code; suppress the false-positive.

CI note

Only .github/workflows/copilot-setup-steps.yml exists in this repo and it only installs
cargo-machete (no invocation) — no CI update was needed.

Verification

• cargo machete --with-metadata → "didn't find any unused dependencies. Good job!"
• cargo build --workspace → exit 0
• cargo test --workspace → all tests pass
• linter all → exit 0 (markdownlint, yamllint, taplo, cspell, clippy, rustfmt, shellcheck)
• Pre-commit hook ran and passed before commit 225e74fc

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates dependency hygiene tooling to use cargo machete --with-metadata (more accurate dependency detection) and removes now-identified unused dev-dependencies across the workspace, with documentation updated to reflect completion of issue #1804.

Changes:

• Switch pre-commit dependency check to cargo machete --with-metadata.
• Remove unused dev-dependencies across multiple workspace crates.
• Add a cargo-machete ignore for a known false-positive (serde_bytes) and update the tracking issue doc.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
contrib/dev-tools/git/hooks/pre-commit.sh	Run cargo machete with --with-metadata in pre-commit.
Cargo.toml	Remove unused workspace-level dev-dependencies.
packages/axum-health-check-api-server/Cargo.toml	Remove unused tracing-subscriber dev-dependency.
packages/axum-http-tracker-server/Cargo.toml	Remove unused deps and add cargo-machete ignore metadata for serde_bytes.
packages/axum-rest-tracker-api-server/Cargo.toml	Remove unused dev-dependencies.
packages/http-tracker-core/Cargo.toml	Remove unused dev-dependencies used for tests/formatting.
packages/peer-id/Cargo.toml	Remove dev-dependencies section (unused).
packages/primitives/Cargo.toml	Remove dev-dependencies section (unused).
packages/server-lib/Cargo.toml	Remove dev-dependencies section (unused).
packages/swarm-coordination-registry/Cargo.toml	Remove multiple unused dev-dependencies.
packages/torrent-repository-benchmarking/Cargo.toml	Remove unused async runtime dev-dependency.
packages/tracker-core/Cargo.toml	Remove unused dev-dependencies.
packages/udp-tracker-core/Cargo.toml	Remove unused test-helper dev-dependency.
packages/udp-tracker-server/Cargo.toml	Remove unused dev-dependency.
docs/issues/open/1804-use-cargo-machete-with-metadata-and-remove-unused-dev-deps.md	Mark issue as implemented and record verification evidence/PR linkage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[josecelano]

ACK 7aa49ef

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.70%. Comparing base (b487ab0) to head (7aa49ef).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #1809   +/-   ##
========================================
  Coverage    77.70%   77.70%           
========================================
  Files          379      379           
  Lines        28607    28607           
  Branches     28607    28607           
========================================
  Hits         22228    22228           
+ Misses        6071     6066    -5     
- Partials       308      313    +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.