cargo test --workspace --all-features did not compile. Everything here only breaks with the zeroize feature on, so the default build stayed green and the breakage sat unnoticed.
Three of the four causes are the same one. Deriving ZeroizeOnDrop gives a
type a Drop impl, and Rust forbids both functional record update and
moving a field out of a type that implements Drop. So
OAuthClientConfig { .., ..Default::default() } and
header.key_id.expect(..) compile with default features and fail with
--all-features, which is a confusing way to find out that a feature flag
changed what syntax is available.
For OAuthClientConfig the fix is a constructor rather than a local workaround: the trap is aimed at anyone building one, not just at these tests, and Default is useless for the idiomatic pattern. new() names every field instead of filling from Default, so adding a field is a compile error to decide about rather than something silently defaulted, and redirect_uris/jwks_uri cover what the callers actually set. The existing binary already constructed the struct field by field, which is the same shape by hand.
The jwk.rs import was redundant: a trait is in scope inside its own impl,
so use zeroize::Zeroize under impl Zeroize for Jwk imported nothing.
The sibling import in the test below it is real -- it calls jwk.zeroize()
from outside any impl -- which is why only one of the two was flagged.
The metrics test asserted something this library never does. A fresh export is exactly "# EOF": both families are registered, but a labelled Family has no series until a sample exists, so the encoder emits nothing for it, not even HELP and TYPE. The test now pins the empty document as valid and the registration claim moves to a second test that records one of each first, where it is observable.
That test only exists under a feature, so it had never run in a default build.
Now: 3422 tests pass across all targets with all features, and clippy is clean under both feature configurations.