Beego — Dependencies#

Module info#

  • Module: github.com/beego/beego/v2
  • Go version: 1.24.2
  • Direct dependencies: 38
  • Indirect dependencies: 40 (go.sum has 322 lines ≈ 161 unique entries, each line appears twice)

Dependency categories#

Core infrastructure#

  • github.com/mitchellh/mapstructure v1.5.0 — decoding map values into structs; used in the etcd config driver to unmarshal etcd key-value pairs into Go config structs.
  • github.com/pelletier/go-toml v1.9.5 — TOML format support for core/config/toml driver.
  • gopkg.in/yaml.v3 v3.0.1 — YAML format support for core/config/yaml driver.
  • github.com/beego/x2j v0.0.0-20131220205130 — XML-to-JSON conversion; used by the XML config driver.
  • github.com/shiena/ansicolor v0.0.0-20230509 — ANSI colour codes on Windows for core/logs coloured console output.
  • github.com/google/uuid v1.6.0 — UUID generation for session IDs and request tracing.
  • github.com/hashicorp/golang-lru v1.0.2 — LRU cache implementation; backing store for in-memory LRU cache adapter.
  • github.com/valyala/bytebufferpool v1.0.0 — pooled byte buffers for the ORM internal buffer subsystem (client/orm/internal/buffers).

Networking / HTTP#

  • google.golang.org/grpc v1.72.1 — gRPC transport used by the etcd client (etcd v3 speaks gRPC), also exposed via grpc-ecosystem/go-grpc-prometheus.
  • google.golang.org/protobuf v1.36.6 — protobuf serialization, pulled in by grpc and used for the Alibaba log sink’s .pb.go file (core/logs/alils/log.pb.go).
  • github.com/gogo/protobuf v1.3.2 — legacy protobuf library; pulled in as a transitive dependency of older components.
  • github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 — Prometheus metrics middleware for the gRPC connection to etcd.
  • golang.org/x/sync v0.14.0 — errgroup, singleflight, and semaphore utilities; client/cache/singleflight.go wraps singleflight.Group for stampede protection.
  • golang.org/x/crypto v0.38.0 — cryptographic primitives; used in session handling (bcrypt, HMAC) and TLS utilities.

Data / Storage#

  • github.com/go-sql-driver/mysql v1.9.2 — MySQL driver for ORM (client/orm); registered via blank import.
  • github.com/lib/pq v1.10.9 — PostgreSQL driver for ORM.
  • github.com/mattn/go-sqlite3 v1.14.28 — SQLite driver (CGO) for ORM; makes the module require CGO.
  • github.com/gomodule/redigo v1.8.8 (pinned via replace) — classic Redis client; used by client/cache/redis and server/web/session Redis backend.
  • github.com/redis/go-redis/v9 v9.8.0 — modern Redis client; likely the newer session/cache backend introduced in v2.
  • **github.com/bradfitz/gomemcache v0.0.0-20250403— Memcache client forclient/cache/memcache` and session Memcache backend.
  • github.com/couchbase/go-couchbase v0.1.1 — Couchbase client for the Couchbase cache driver.
  • **github.com/ledisdb/ledisdb v0.0.0-20200510— LedisDB embedded NoSQL; supportsclient/cache` LedisDB backend.
  • **github.com/ssdb/gossdb v0.0.0-20180723` — SSDB client for the SSDB cache backend.
  • github.com/elastic/go-elasticsearch/v6 v6.8.10 — Elasticsearch v6 client for the core/logs/es log appender.
  • github.com/bits-and-blooms/bloom/v3 v3.5.0 — probabilistic bloom filter; used by client/cache to implement a cache stampede/miss protection bloom filter.
  • **github.com/cloudflare/golz4 v0.0.0-20240916` — LZ4 compression; used in the LedisDB backend or cache serialization path.
  • github.com/elazarl/go-bindata-assetfs v1.0.1 — embeds static files (Swagger UI assets) into binary for server/web/swagger.

Observability#

  • go.opentelemetry.io/otel v1.35.0 + /otel/trace + /otel/sdk + /otel/exporters/stdout/stdouttrace — OpenTelemetry tracing; integrated directly into server/web/filter/ and client/orm/filter/ as first-class filter packages.
  • github.com/opentracing/opentracing-go v1.2.0 — legacy OpenTracing API; server/web/filter/opentracing/, client/orm/filter/opentracing/, and client/httplib/filter/opentracing/ all implement OpenTracing filters alongside their OTel equivalents.
  • github.com/prometheus/client_golang v1.22.0 — Prometheus metrics exposition; server/web/filter/prometheus/filter.go records HTTP request latency histograms.
  • github.com/go-kit/kit v0.13.0 + github.com/go-kit/log v0.2.1 — go-kit log adapter for structured logging in components that want structured log output.

Authorization#

  • github.com/casbin/casbin v1.9.1 — RBAC/ABAC policy enforcement; server/web/filter/authz/authz.go wraps casbin as an HTTP filter to gate request authorization by policy.

Testing#

  • github.com/stretchr/testify v1.10.0 — assert and require for unit tests throughout the repo.

Config backends (distributed)#

  • go.etcd.io/etcd/client/v3 v3.6.0 — etcd v3 client for core/config/etcd — allows distributed config loading from an etcd cluster.

Stdlib reliance#

Beego leans heavily on the Go standard library for its core HTTP serving and routing path. Key stdlib packages in heavy use:

  • net/http — the entire web server builds directly on stdlib’s HTTP server; no third-party HTTP framework is used internally.
  • database/sql — ORM sits directly atop database/sql, using it for connection pooling and query execution.
  • encoding/json, encoding/xml — config parsers and ORM serialization.
  • context — propagated through ORM queries, HTTP handlers, and cache operations.
  • sync, sync/atomic — session store locking, LRU cache concurrency, once-initialization of Prometheus vectors.
  • html/template, text/template — template rendering in the web server.
  • crypto/tls, crypto/hmac, crypto/sha256 — session security and HTTPS.

Third-party dependencies are largely additive backends/drivers/adapters, not replacements for stdlib. The HTTP and ORM core stays on stdlib; third-party packages enter as drivers (MySQL, Redis) or optional integrations (OTel, Prometheus).

Shared dependencies#

Several of beego’s direct dependencies are also widely used across the 50-project corpus:

  • google.golang.org/grpc — shared with Consul, Vault, Nomad, etcd, Dapr, Istio, gRPC-gateway.
  • google.golang.org/protobuf — shared with nearly all gRPC-using projects.
  • go.opentelemetry.io/otel — shared with Dapr, Nomad, modern Consul builds.
  • github.com/prometheus/client_golang — shared with almost every server-side project in the corpus.
  • github.com/stretchr/testify — near-universal across the corpus.
  • gopkg.in/yaml.v3 — shared with Helm, Kubernetes-adjacent projects.
  • golang.org/x/crypto — shared with Vault, Consul, most projects doing TLS.
  • github.com/hashicorp/golang-lru — shared with Consul, Vault (HashiCorp ecosystem), though here adopted outside it.
  • go.etcd.io/etcd/client/v3 — shared with Nomad, Consul backends.

Vendoring#

Beego does not vendor its dependencies. There is no vendor/ directory. This is consistent with a framework library that expects consumers to manage their own module graphs. The one notable exception to “plain” module behavior is a replace directive pinning github.com/gomodule/redigo to v1.8.8, suggesting the transitive dependency graph pulls in an incompatible newer version that beego needed to lock down.

Notable dependency decisions#

  1. Dual Redis clients (redigo + go-redis/v9): Beego ships both the classic redigo (via replace pin) and the modern go-redis/v9. This reflects an evolutionary migration: the cache layer’s redis sub-package still uses redigo, while newer session or cache backends were added using go-redis/v9. The replace directive is a code smell — redigo changed its module path, forcing the pin.

  2. Dual tracing stacks (OpenTracing + OTel): Rather than migrating from OpenTracing to OpenTelemetry, beego ships both. This is intentional: users on legacy OpenTracing setups still work, while new users can adopt OTel. The cost is carrying both as direct deps.

  3. CGO dependency (go-sqlite3): github.com/mattn/go-sqlite3 requires CGO. This is an unusual choice for a framework that otherwise compiles cleanly. It means CGO_ENABLED=0 builds (common in Docker) will fail if the SQLite driver package is included. Beego mitigates this by making drivers blank-import-based — SQLite support only activates if the user imports it.

  4. Niche storage backends as direct deps (LedisDB, SSDB, CouchBase): These are obscure datastores with low community adoption outside China. Their presence as direct deps (not optional sub-modules) bloats the module graph for users who need none of these backends. This is a known architectural tension in “batteries-included” frameworks — the cost of convenience is a heavier transitive graph.

  5. Casbin for authz as a first-class filter: Rather than leaving authorization to the user, beego bundles casbin integration directly. This is unusual — most frameworks treat auth/authz as a community concern. It reflects beego’s enterprise-targeting philosophy.

  6. go-kit/kit for structured logging integration: go-kit/kit is a microservices toolkit, not just a logger. Beego pulls it in specifically for its log interface adapters, suggesting interoperability with go-kit service architectures was a design goal — a niche choice that adds a heavyweight transitive graph for logging alone.

Backward Beego — Structure Beego — Architecture Forward