Dapr — Dependencies#

Module info#

• Module: github.com/dapr/dapr
• Go version: 1.26.1
• Direct dependencies: 83
• Indirect dependencies: 409 (via // indirect markers in go.mod)
• go.sum entries: 2,604 (~1,302 unique modules)

Dependency categories#

Core infrastructure#

• github.com/dapr/kit — Dapr’s own shared utilities library: structured logging (dapr/kit/logger), concurrency helpers, signal handling; nearly every package imports this
• github.com/kelseyhightower/envconfig — environment variable-based configuration; used in the options layer
• github.com/spf13/pflag — POSIX-compliant CLI flags; used for daprd startup flags and operator flags
• github.com/spf13/cast — safe type conversion utilities
• github.com/mitchellh/mapstructure — config struct hydration from maps; used in component config loading
• github.com/go-logr/logr — logging interface used by the Kubernetes ecosystem components (controller-runtime requires it)
• gopkg.in/yaml.v3 + sigs.k8s.io/yaml — YAML parsing for component spec files and Kubernetes manifests
• go.uber.org/automaxprocs — automatically sets GOMAXPROCS to match container CPU quota; called at startup in app.go
• go.uber.org/ratelimit — token-bucket rate limiter used in the HTTP API layer
• github.com/cenkalti/backoff/v4 — exponential backoff for retries (service invocation, state store operations)
• github.com/sony/gobreaker — circuit breaker implementation for outbound calls via the resiliency subsystem
• github.com/hashicorp/golang-lru/v2 — generic LRU cache used for actor state caching and subscription deduplication
• github.com/google/cel-go — Common Expression Language evaluator; used in the access control policy engine and subscription filtering
• github.com/PaesslerAG/jsonpath — JSONPath for pub/sub message routing and content-based filtering

Networking/HTTP#

• google.golang.org/grpc — gRPC runtime; the primary Dapr API is exposed over gRPC
• connectrpc.com/connect — Connect protocol (HTTP/1.1 and HTTP/2 compatible gRPC); added to support gRPC-Web and Connect clients without a proxy
• google.golang.org/protobuf + github.com/golang/protobuf — protobuf serialization; latter is the legacy v1 API still needed by some Kubernetes and gRPC ecosystem packages
• github.com/grpc-ecosystem/go-grpc-middleware — gRPC interceptor chaining utilities
• github.com/go-chi/chi/v5 — primary HTTP router for the Dapr HTTP API server
• github.com/go-chi/cors — CORS middleware for the HTTP API
• github.com/gorilla/mux — secondary router, retained for compatibility with certain component callback patterns
• github.com/gorilla/websocket — WebSocket support for streaming pub/sub and bindings
• golang.org/x/net — extended network utilities (HTTP/2 internals, DNS)
• golang.org/x/oauth2 — OAuth2 client for external service authentication (some bindings/components)
• github.com/jhump/protoreflect — dynamic proto reflection used in the gRPC proxy passthrough feature

Security#

• github.com/spiffe/go-spiffe/v2 — SPIFFE/SPIRE workload identity for mTLS between sidecars; Dapr’s security model is built around SPIFFE SVIDs
• github.com/coreos/go-oidc/v3 — OIDC token validation for app-level authentication middleware
• github.com/lestrrat-go/jwx/v2 — JWT/JWE/JWS handling for token-based auth and crypto building block
• golang.org/x/crypto — TLS and cryptographic primitives (used in cert rotation, secret management)

Data/Storage#

• github.com/redis/go-redis/v9 — Redis client; Redis is the default/recommended state store in self-hosted mode
• github.com/jackc/pgx/v5 — PostgreSQL client; used by the workflow and actor reminder persistence layers
• go.mongodb.org/mongo-driver — MongoDB driver (indirect via components-contrib, promoted to direct for actor storage)
• go.etcd.io/etcd/{api,client/pkg,client,server}/v3 — full etcd suite; Dapr embeds etcd in the placement service to avoid requiring an external etcd in self-hosted mode
• modernc.org/sqlite — pure-Go SQLite (no CGo); used for local actor state and workflow history in self-hosted single-node mode
• github.com/evanphx/json-patch/v5 — RFC 6902 JSON Patch for CRD status updates and configuration patching

Observability#

• go.opentelemetry.io/otel + otel/sdk + otel/trace — OpenTelemetry core; Dapr instruments all service-to-service calls with distributed traces
• go.opentelemetry.io/otel/exporters/otlp/otlptrace{grpc,http} — OTLP trace export to Jaeger, Tempo, etc.
• go.opentelemetry.io/otel/exporters/zipkin — legacy Zipkin exporter (marked deprecated in code but retained for backward compatibility)
• github.com/prometheus/client_golang + client_model + common — Prometheus metrics exposition; every building block emits metrics
• go.opencensus.io + contrib.go.opencensus.io/exporter/prometheus — OpenCensus (legacy instrumentation); being migrated to OTel but both stacks coexist

Dapr ecosystem#

• github.com/dapr/components-contrib — the pluggable component implementations (state stores, pub/sub, bindings, secrets, etc.); kept in a separate repo for independent release cadence
• github.com/dapr/durabletask-go — durable workflow engine; implements the Durable Task Framework protocol for Dapr’s workflow building block
• github.com/diagridio/go-etcd-cron — etcd-backed cron scheduler used by the actor reminder system

Distributed systems#

• github.com/hashicorp/raft — Raft consensus; the placement service uses Raft to elect a leader and maintain authoritative actor-to-host mapping tables
• github.com/cloudevents/sdk-go/v2 — CloudEvents SDK; Dapr normalizes all pub/sub messages to the CloudEvents 1.0 spec
• github.com/hashicorp/go-hclog — Hashicorp structured logger used internally by the Raft library

Kubernetes#

• k8s.io/api, apimachinery, client-go — core Kubernetes API types and client; used by the operator and by the sidecar injector webhook
• k8s.io/apiextensions-apiserver — CRD API types; Dapr ships its own CRDs (Component, Configuration, Subscription, etc.)
• sigs.k8s.io/controller-runtime — operator/controller framework; Dapr’s operator uses it to reconcile CRD objects
• github.com/argoproj/argo-rollouts — Argo Rollouts integration for progressive delivery support (canary/blue-green with Dapr traffic control)
• github.com/grafana/k6-operator — Grafana k6 load test operator; used in the Dapr performance test infrastructure

AI/LLM#

• github.com/tmc/langchaingo — LangChain Go; powers the Conversation building block (added in Dapr 1.15+), enabling LLM API calls through Dapr’s abstraction layer

Testing#

• github.com/stretchr/testify — assertions and test suites; universally used across the test suite
• github.com/golang/mock — interface mocking (gomock); mocks are generated for major internal interfaces
• github.com/google/gofuzz — property-based fuzzing for API surface tests
• github.com/phayes/freeport — finds free TCP ports for in-process test servers

Stdlib reliance#

Dapr makes substantial use of stdlib for its core machinery. Key packages found in hot paths:

• sync — extensive: sync.Mutex, sync.RWMutex, sync.Map, sync.WaitGroup, sync.Once across actors, state, and pub/sub
• context — pervasive; every major API function accepts a context.Context for cancellation and tracing
• net/http — the HTTP API server is built on top of stdlib’s net/http with the chi router layered on top
• crypto/tls — TLS config for mTLS between sidecar and app, and between sidecars
• time, sync/atomic, errors, fmt, strings, encoding/json — all heavily used throughout

The project uses third-party libraries for infrastructure concerns (resilience, observability, storage), while using stdlib for core runtime mechanics (goroutines, channels, HTTP serving, TLS). This is a conscious choice consistent with Dapr’s philosophy of being a runtime rather than a framework.

Shared dependencies#

Dependencies shared with many other projects in the 50-project set, creating natural comparison points:

Vendoring#

No vendoring. The project relies entirely on the Go module proxy (sum.golang.org / proxy.golang.org). This is consistent with Dapr’s position as a large CNCF project where:

1. The dependency graph is too large (1,302 unique modules) to vendor practically
2. The components-contrib repo evolves independently; vendoring would complicate cross-repo updates
3. Their CI uses go mod download with module caching in containers, not vendored deps

Notable dependency decisions#

1. Dual gRPC stack (grpc + connectrpc/connect) — Rather than choosing one, Dapr supports both the standard gRPC wire protocol and the newer Connect protocol. This enables Connect-native clients (gRPC-Web, browser clients) without requiring an Envoy proxy in front. It’s an unusual dual-stack choice that reflects Dapr’s commitment to being language- and transport-agnostic.

2. Full embedded etcd (etcd/server/v3) — Most projects only import etcd/client. Dapr imports the full etcd server so the placement service can embed an etcd node in self-hosted mode, eliminating an external dependency for simple deployments. This substantially inflates the binary but dramatically simplifies the getting-started experience.

3. components-contrib as a versioned direct dep — All ~100 pluggable component implementations live in a sibling repo and are imported as a single version-pinned dependency. This means updating any component (e.g., adding a Redis feature) requires a release of components-contrib followed by a version bump in the dapr runtime. The tradeoff is clean separation of concerns vs. tight release coupling.

4. OpenCensus + OpenTelemetry coexistence — Both go.opencensus.io and go.opentelemetry.io/otel appear as direct dependencies. This is a migration artifact: Dapr originally used OpenCensus for metrics/tracing and has been migrating to OpenTelemetry since ~1.10. The zipkin exporter is even marked //nolint:staticcheck // SA1019: deprecated but still needed. This dual instrumentation is a significant maintenance cost and signals the migration is not yet complete.

5. github.com/tmc/langchaingo — The inclusion of a LangChain dependency is architecturally significant: it shows Dapr expanding from pure infrastructure building blocks into the AI/LLM space. The conversation building block (added in 1.15) uses LangChain as an abstraction over LLM providers (OpenAI, Azure OpenAI, etc.), following the same pattern-of-abstraction that made Dapr successful for messaging and state.

6. modernc.org/sqlite (pure-Go, no CGo) — Choosing the pure-Go SQLite implementation over mattn/go-sqlite3 (CGo-based) enables cross-compilation and avoids CGo complexity in the build pipeline. This is a deliberate tradeoff: slightly slower SQLite in exchange for simpler multi-platform container builds.

7. github.com/hashicorp/raft alongside etcd — Dapr uses both Raft (via hashicorp/raft) for the placement service’s leader election and etcd (via diagridio/go-etcd-cron) for actor reminder scheduling. These are two different distributed consensus mechanisms coexisting in the same binary, which is unusual but reflects the different semantics needed: Raft for authoritative placement tables vs. etcd’s watch-based model for time-triggered reminder scheduling.