frp — Dependencies#

Module info#

• Module: github.com/fatedier/frp
• Go version: 1.25.0
• Direct dependencies: 32
• Indirect dependencies: 40 (go.mod indirect block); ~127 unique modules in go.sum (254 lines, two entries per module)

Dependency categories#

Core infrastructure#

• github.com/spf13/cobra — CLI framework for all frpc and frps subcommands (verify, reload, status, etc.)
• github.com/spf13/pflag — POSIX-compatible flag parsing underpinning cobra
• github.com/pelletier/go-toml/v2 — primary config file format (TOML); frp’s current recommended format
• gopkg.in/ini.v1 — legacy INI config parsing; retained for backward-compatibility with older frp configurations
• github.com/fatedier/golib — author’s own utility library providing pool (byte-buffer pooling), io helpers, crypto (XOR stream cipher), error wrapping, and extended net utilities — the internal glue that predates the project’s current package layout
• github.com/google/uuid — UUID generation for proxy IDs and client session identifiers
• github.com/samber/lo — generic collection utilities (Map, Filter, Keys, etc.); used throughout for slice/map transformations (11 internal import sites in pkg/, 6 more in client/server/)
• github.com/tidwall/gjson — JSON path querying; used for parsing responses from server-side manage plugin webhooks
• github.com/rodaine/table — CLI table formatting for the frpc status command output

Networking/HTTP#

• github.com/hashicorp/yamux (replaced via go.mod replace with github.com/fatedier/yamux) — stream multiplexing over TCP/TLS; the primary control-channel mux between frpc and frps; author maintains a fork to apply patches not yet merged upstream
• github.com/quic-go/quic-go — QUIC transport option for the frpc↔frps tunnel; offers lower latency and connection migration compared to TCP-based transports
• github.com/xtaci/kcp-go/v5 — KCP reliable-UDP transport for the tunnel; targets high-loss or high-latency networks where TCP is impractical
• github.com/gorilla/mux — HTTP router for the frps dashboard and frpc admin API
• github.com/gorilla/websocket — WebSocket transport option for the frpc↔frps tunnel; useful for traversing HTTP proxies that block plain TCP
• github.com/pion/stun/v3 — STUN protocol implementation for P2P NAT hole-punching; used by the nathole package to negotiate direct frpc-to-frpc connections
• github.com/pires/go-proxyproto — PROXY protocol v1/v2 support, allowing frps to forward real client IPs to backend services
• github.com/armon/go-socks5 — SOCKS5 proxy server; used by the socks5 client-side plugin to expose a full SOCKS5 proxy through an frp tunnel
• golang.org/x/net — extended networking: websocket upgrade path, IPv4/IPv6 multicast, CIDR utilities
• golang.org/x/crypto — SSH tunnel gateway mode (crypto/ssh) and additional TLS helpers
• golang.org/x/sync — errgroup for structured goroutine coordination; semaphore for connection throttling
• golang.org/x/time — token-bucket rate limiting (rate.Limiter) applied to proxy bandwidth

Virtual networking / OS-level networking#

• golang.zx2c4.com/wireguard — WireGuard VPN implementation in pure Go; powers the VirtualNet feature that provides L3 virtual networking between frpc nodes
• github.com/vishvananda/netlink — Linux netlink interface for creating/managing virtual network interfaces (TUN/TAP, routes) used by VirtualNet on Linux
• github.com/songgao/water — cross-platform TUN/TAP device creation; used by VirtualNet on non-Linux platforms

Authentication / Authorization#

• github.com/coreos/go-oidc/v3 — OpenID Connect token verification; enables OIDC-based authentication for frp client connections
• golang.org/x/oauth2 — OAuth2 client; required by the OIDC flow to exchange authorization codes and refresh tokens

Observability#

• github.com/prometheus/client_golang — Prometheus metrics exposition; frps exposes tunnel, proxy, and connection metrics at /metrics

Kubernetes integration#

• k8s.io/apimachinery — used for sets.Set[T] and other generic collection types from k8s.io/apimachinery/pkg/util/sets; a heavyweight dependency justified only partially — frp imports a narrow slice for its config validation helpers
• k8s.io/client-go — Kubernetes client library; pulled in as a direct dep but lightly used in the current codebase; likely a staging dependency for the planned v2 controller-pattern redesign the author has mentioned

Testing#

• github.com/onsi/ginkgo/v2 — BDD-style test framework used exclusively for e2e tests in test/e2e/
• github.com/onsi/gomega — Ginkgo’s matcher/assertion library (companion to ginkgo)
• github.com/stretchr/testify — assertion library used in unit tests (assert, require)

Stdlib reliance#

frp is genuinely stdlib-heavy for its core tunneling logic. The top stdlib packages by import count across pkg/, client/, and server/ are:

The tunnel read/write loops, connection multiplexing, and proxy protocol handling are all built on stdlib net.Conn, io.Copy, and net/http. Third-party networking deps (yamux, quic-go, kcp-go) add transport alternatives on top of the same stdlib abstractions rather than replacing them.

Shared dependencies#

Dependencies that overlap with other projects commonly analyzed in Go OSS research:

• github.com/spf13/cobra + pflag — ubiquitous in Go CLI tools; shared with Kubernetes, Hugo, Traefik, Caddy, and nearly every multi-command CLI
• github.com/prometheus/client_golang — standard for Go service metrics; shared with Kubernetes, etcd, Prometheus itself, Traefik
• github.com/gorilla/mux + websocket — widely used despite gorilla entering maintenance mode; shared with many pre-2022 Go services
• github.com/stretchr/testify — nearly universal Go assertion library
• golang.org/x/crypto, x/net, x/sync, x/time — the golang.org/x extended stdlib; shared across virtually all networking projects
• github.com/google/uuid — common UUID lib; shared with Kubernetes ecosystem tools
• github.com/quic-go/quic-go — less common but shared with projects adopting HTTP/3

Vendoring#

frp does not vendor its dependencies. No vendor/ directory exists. This is expected for a binary-distribution project where reproducible builds are achieved through go.sum checksums and the Go module proxy rather than checked-in source. The replace directive for github.com/hashicorp/yamux → github.com/fatedier/yamux is the only non-standard module resolution, and it still resolves via the module proxy.

Notable dependency decisions#

1. Author’s own yamux fork: The replace directive swapping hashicorp/yamux for fatedier/yamux (with a comment: “Temporary use the modified version, update to the official version after merging”) signals active upstream negotiation. The project needs specific behavior (likely related to session keepalive or flow control) that hasn’t landed in the canonical library — a pragmatic but technically-debt-accruing choice.

2. Four transport protocols, four libraries: The decision to support TCP+yamux, WebSocket, KCP, and QUIC simultaneously means four separate transport libraries. This is not accidental — frp explicitly positions transport diversity as a feature for operators in constrained network environments. The cost is significant dependency weight and combinatorial testing surface.

3. WireGuard in pure Go: Using wireguard-go (the userspace Go implementation) rather than system WireGuard keeps frp self-contained and cross-platform, at the cost of performance vs. the kernel module. This aligns with the project’s goal of simple binary deployment.

4. k8s.io as a heavy import for light use: Pulling in k8s.io/apimachinery and k8s.io/client-go for what amounts to generic set types is architecturally heavy. The apimachinery sets package is the primary use site. This is likely forward-looking infrastructure for the v2 redesign rather than current feature necessity — and it transitively pulls in a large slab of the Kubernetes dependency graph.

5. OIDC over simpler token auth: Implementing full OIDC via go-oidc and oauth2 shows enterprise ambitions beyond the project’s homelab roots. Simple token authentication remains the default, but OIDC support positions frp as viable in corporate environments with SSO requirements.

6. golib as internal monorepo substitute: github.com/fatedier/golib acts as the author’s personal toolkit, absorbing pool management, IO utilities, and crypto helpers. It avoids vendoring these into the main repo while keeping them under the author’s control — a common pattern for solo maintainers who want reuse without publishing many micro-packages.