vulture-rs
A Rust reimplementation of
vulture (the Python
dead-code finder), built on the
ruff parser for performance.
Versioned independently; the upstream parity target (currently
vulture 2.13) is stated here, in the package description, and in
the CHANGELOG (a dated entry per release, enforced at release
time).
Drop-in compatible: the binary is named vulture, accepts the same
CLI, and produces byte-identical output — tools that shell out to
vulture via PATH pick it up unchanged (the one visible
difference: --version reports this package's own version, not
2.13).
Install
pip install vulture-rs # ships the `vulture` binary
Wheels for linux x86_64/aarch64 and macOS arm64, published via the
manually-dispatched Release to PyPI workflow (wheels only, no
sdist); every wheel is smoke-tested before it ships.
Results
A large production codebase (6,553 files), 8 cores, median of 5:
| tool | wall time | speedup |
|---|---|---|
| Python vulture 2.13 | 14.31 s | 1x |
| vulture-rs (8 threads) | 0.43 s | 33x |
| vulture-rs (1 thread) | 1.06 s | 13.5x |
Peak memory is comparable (~100 MiB).
Parity
Output is byte-identical (stdout + exit codes) to vulture==2.13:
- on the 6,553-file production codebase above — 2,687 findings, zero diff — across assorted flag combinations;
- across
tests/differential.sh: an edge-case corpus (noqa quirks, whitelist masking, elif chains, encodings incl. latin-1/BOM/CRLF, unreachable code, invisible bindings, decorated defs) times a 12-entry flag matrix; - on two alien corpora: CPython 3.12's stdlib (2,621 findings,
byte-identical incl. normalized stderr) and a 22,286-file
site-packagescorpus (58k findings, 137s -> 3.4s, 41x). There, 144 of 58,008 stdout lines and 11 stderr lines differ - every one triaged to registered deviations (D1 type comments, D16 CPythonSyntaxWarningchatter), zero parity bugs; - on six popular open-source repos (requests, flask, click, rich, celery, django; 3,736 files, 25-54x) — byte-identical.
Known, deliberate deviations (error-message prose, type comments,
crash-path cleanups) are enumerated in
docs/vulture-rust-spec.md §1; the full behavioral contract lives in
docs/vulture-spec.md. Both specs were reverse-engineered from
vulture 2.13 and review-hardened before this implementation.
The parity reference is vulture 2.13 on CPython 3.12: the parser is version-gated to 3.12, so syntax newer than that (PEP 696 type-param defaults, t-strings, …) is a syntax error here exactly as it is there. Bumping the reference is a deliberate task.
Build & test
cargo build --release # target/release/vulture
cargo test # CPython-generated vector tests
tests/differential.sh <python-vulture> target/release/vulture
tests/og_corpus.sh <python-vulture> target/release/vulture
CI (.github/workflows/ci.yml) runs fmt, clippy, the vector tests,
and both differential harnesses against a pinned vulture==2.13 on
every PR and push to main.
Regenerate the test vectors with python3 tests/gen_vectors.py
(needs CPython 3.12).
The ruff_* dependencies are git-pinned to a ruff release tag (the
crates.io releases under those names are stale placeholders). Treat
upgrades as a deliberate task gated on the differential suite.
Usage
Same CLI as Python vulture:
vulture <paths> [--exclude PATTERNS] [--ignore-names PATTERNS]
[--ignore-decorators PATTERNS] [--min-confidence N]
[--sort-by-size] [--make-whitelist] [-v]
Exit codes: 0 clean, 1 invalid input, 2 invalid arguments, 3 dead code found.
Metadata
Release files for vulture-rs 1.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| vulture_rs-1.0.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Python 3 | none | Linux glibc 2.17+ x86-64 | Details for vulture_rs-1.0.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| vulture_rs-1.0.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl | Python 3 | none | Linux glibc 2.17+ ARM64 | Details for vulture_rs-1.0.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl |
| vulture_rs-1.0.0-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details for vulture_rs-1.0.0-py3-none-macosx_11_0_arm64.whl |
Total release size: 6.2 MB
Release files / vulture_rs-1.0.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
| Download URL | vulture_rs-1.0.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
|---|---|
| Size | 2.2 MB |
| Tags | Linux glibc 2.17+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
c13ca4af80dd82fb524f43672472f29f815a317d39de31c012221250e0401d58
|
|
BLAKE2b-256 checksum How to use checksums |
a9eb304a8a9d15fb2d128009c3c29d96013fd17d8de2274b1ba1dcb562935e81
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 15, 2026.
Transparency logRelease files / vulture_rs-1.0.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
| Download URL | vulture_rs-1.0.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | Linux glibc 2.17+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
5765a537b7ab1f6d14309dd31dedef715314378a771ebf034b59942802fd9d4c
|
|
BLAKE2b-256 checksum How to use checksums |
a0b20c37aff8328a30d0d2f76205dec5a1039cf8aa5e74ef6f51f7cbf67e3530
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 15, 2026.
Transparency logRelease files / vulture_rs-1.0.0-py3-none-macosx_11_0_arm64.whl
| Download URL | vulture_rs-1.0.0-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
818ae0f900febac2dffd5f11940dd2cbddb40303b950dfa53c8c202cd8bbf6d6
|
|
BLAKE2b-256 checksum How to use checksums |
95d2fb331ec84275165857e3668dc26b7495a09a3e920cdc483b8956fba817c0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 15, 2026.
Transparency logSecurity for vulture-rs 1.0.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 3 files in this release have been uploaded with provenance metadata.
Attestation for vulture_rs-1.0.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 15, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.