CodeVetter · Repo Unpack · Contributor handoff
tokio-rs/axum
Start future work from the pinned source and the owning crate rather than assuming released behavior matches main. Keep changes aligned with crate boundaries, feature gates, and the distinction between library contracts and runnable examples. Tests and CI were inspected, not executed; future execution needs its own authorization and reported results. This brief is bounded and does not establish whole-repository coverage, live integration health, or confirmed vulnerabilities.
- Read README's branch warning before using released API assumptions: main targets 0.9 breaking changes even though the inspected axum manifest declares version 0.8.9.
- Choose the owning boundary first: reusable extractor/response contracts belong in axum-core where possible; optional utility exposure must follow axum-extra's feature gates rather than unconditional dependencies.
- For dispatch edits, read Router, PathRouter, MethodRouter, and Handler together; preserve path metadata installation, HEAD-to-GET selection, rejection short-circuiting, and state delivery.
- Body-limit edits require coordinated documentation and implementation review: RequestExt explicitly points to default_body_limit.rs and extract.md when changing DEFAULT_LIMIT, and direct consumers need separate scrutiny.
- Keep example checks in their workspace: CI uses --manifest-path examples/Cargo.toml separately from the root, and example binaries may connect to databases or run startup migrations.
- Tests and CI were inspected, not executed in this investigation; for authorized future validation, use a filtered affected-package test first and follow CI's locked workspace tests, formatting, and all-feature Clippy commands as scope requires.
- Macro diagnostic work needs nightly trybuild coverage, optionally narrowed with AXUM_TEST_ONLY; stable/beta runs skip that harness, and debug_handler itself emits checks only with debug_assertions enabled.
- Preserve compatibility conventions: workspace lints forbid unsafe code, Clippy disallows BoxCloneService in favor of BoxCloneSyncService, and axum-extra deliberately retains its older serde_html_form behavior for deprecated Query/Form migration support.