Description
In Cargo.toml, the redis crate is listed as an unconditional dependency, but it is only used behind #[cfg(feature = "redis")] in the source code. The [features] section defines redis = [] (empty), meaning the feature flag never activates the dependency, yet the crate is always compiled and linked.
This unnecessarily increases the attack surface and binary size for all builds, even when Redis is not used.
Severity
Low
Suggested Fix
Make the dependency optional and wire the feature flag to activate it.
Description
In
Cargo.toml, therediscrate is listed as an unconditional dependency, but it is only used behind#[cfg(feature = "redis")]in the source code. The[features]section definesredis = [](empty), meaning the feature flag never activates the dependency, yet the crate is always compiled and linked.This unnecessarily increases the attack surface and binary size for all builds, even when Redis is not used.
Severity
Low
Suggested Fix
Make the dependency optional and wire the feature flag to activate it.