GitHub CLI (gh) — Dependencies#

Module info#

• Module: github.com/cli/cli/v2
• Go version: 1.26.1
• Direct dependencies: 58
• Indirect dependencies: ~125 (go.mod indirect block) — go.sum has 661 lines ≈ 330 unique module entries total

Dependency categories#

Core infrastructure#

• github.com/spf13/cobra + spf13/pflag — CLI framework; every command and subcommand is a cobra.Command. The deepest and most pervasive non-stdlib dependency in the codebase (241 imports of cobra alone).
• github.com/MakeNowJust/heredoc — inline multi-line string formatting for command usage and long descriptions (237 imports — more than cobra itself in leaf packages).
• github.com/cli/go-gh/v2 — gh’s own published helper library, shared with extension authors; provides GitHub API plumbing, auth, and config abstractions.
• github.com/cli/go-internal — internal testing and plumbing utilities extracted from the Go toolchain, used to drive integration-style test scripts.
• github.com/joho/godotenv — .env file loading for local development / test configuration.
• github.com/muhammadmuzzammil1998/jsonc — JSON-with-comments parser; used to allow comments in gh config files.
• golang.org/x/sync — errgroup and similar sync utilities for structured concurrency across API calls.

Networking / HTTP#

• github.com/cli/oauth — GitHub OAuth device and web flow; gh’s own published OAuth library.
• github.com/cli/safeexec — safe subprocess execution (avoids PATH injection on Windows).
• github.com/shurcooL/githubv4 — typed GraphQL client for GitHub’s v4 API (query builder pattern).
• github.com/google/go-containerregistry — OCI image inspection for gh container operations and attestation verification.
• github.com/distribution/reference — OCI/Docker image reference parsing (indirect dep of containerregistry).
• github.com/gorilla/websocket — WebSocket support, used for live log streaming and Codespaces port forwarding.
• github.com/microsoft/dev-tunnels — Microsoft Dev Tunnels library, used in the Codespaces SSH/port-forwarding feature.
• github.com/cenkalti/backoff/v4 + /v5 — exponential back-off for retryable API calls; both versions present, suggesting a migration in progress.
• golang.org/x/crypto — SSH crypto primitives used by Codespaces SSH tunneling.
• golang.org/x/term — terminal width/raw-mode detection.
• golang.org/x/text — Unicode text normalization.
• google.golang.org/grpc + google.golang.org/protobuf — gRPC/proto used by the Sigstore attestation and rekor verification code paths.
• github.com/opentracing/opentracing-go — tracing interface (pulled in transitively; minimal direct use in gh itself).

TUI / Presentation#

• charm.land/bubbletea/v2 — Elm-architecture TUI framework; powers interactive selection lists, pickers, and pager views.
• charm.land/bubbles/v2 — pre-built Bubble Tea components (text input, list, progress, spinner, etc.).
• charm.land/huh/v2 — form library built on Bubble Tea; used for multi-step interactive prompts.
• charm.land/lipgloss/v2 + github.com/charmbracelet/lipgloss — terminal style/layout DSL; both v1 (Charmbracelet) and v2 (charm.land re-org) are listed, indicating a partial migration.
• github.com/charmbracelet/glamour — terminal markdown renderer using goldmark + lipgloss; renders README previews, PR bodies, release notes.
• github.com/briandowns/spinner — simple spinner for non-interactive progress feedback (pre-dates BubbleTea spinner).
• github.com/gdamore/tcell/v2 — lower-level terminal cell library used by rivo/tview (full-screen text UI for gh dash and table views).
• github.com/rivo/tview — full-screen TUI widgets built on tcell, used for interactive table-based views.
• github.com/mattn/go-colorable + go-isatty — Windows-compatible ANSI color output and terminal detection.
• github.com/mgutz/ansi — lightweight ANSI escape codes (older utility, likely legacy from pre-lipgloss era).
• github.com/AlecAivazis/survey/v2 — interactive terminal prompts (checkbox, select, input); predates huh, still used in parts of the codebase.
• github.com/atotto/clipboard — clipboard read/write for gh copy-to-clipboard features.
• github.com/yuin/goldmark — Markdown parser underlying glamour.

Data / Serialization#

• gopkg.in/yaml.v3 — YAML parsing (config files, workflow files).
• github.com/vmihailenco/msgpack/v5 — MessagePack binary serialization, likely used for Codespaces or extension state caching.
• github.com/klauspost/compress — compression algorithms (used for OCI layer handling via containerregistry).
• github.com/google/shlex — POSIX shell-style argument splitting for gh alias expansion (144 imports — heavily used).
• github.com/kballard/go-shellquote — shell quoting/unquoting companion to shlex.
• github.com/hashicorp/go-version — semantic version parsing for upgrade checks and minimum version enforcement.
• github.com/gabriel-vasile/mimetype — MIME type detection for file uploads (releases, PR review file attachments).
• github.com/itchyny/gojq (indirect) — jq-compatible JSON query engine, powering --jq flags on API commands.
• github.com/cpuguy83/go-md2man/v2 — Markdown → man page conversion for generating gh’s man pages.
• github.com/distribution/reference — Docker/OCI image reference parsing.

Supply-chain security#

• github.com/sigstore/sigstore-go — Sigstore signature verification; core of gh attestation verify.
• github.com/sigstore/protobuf-specs — Sigstore protobuf bundle format.
• github.com/theupdateframework/go-tuf/v2 — TUF (The Update Framework) client for Sigstore trust root distribution.
• github.com/digitorus/timestamp — RFC 3161 trusted timestamping, used in attestation signing.
• github.com/in-toto/attestation — in-toto attestation envelope format (SLSA provenance).

Credentials / Keychain#

• github.com/zalando/go-keyring — OS keychain integration (Keychain on macOS, GNOME Keyring / Secret Service on Linux, Windows Credential Manager) for storing GitHub tokens securely.

Testing#

• github.com/stretchr/testify — assertion and require helpers (232 + 162 imports across test files).
• gopkg.in/h2non/gock.v1 — HTTP interceptor / mock for round-tripping test API calls.
• github.com/Netflix/go-expect — pseudo-terminal expectations, used for interactive prompt testing.
• github.com/hinshun/vt10x — VT100 terminal emulator, backing go-expect tests.
• github.com/creack/pty — PTY creation for interactive terminal test scenarios.
• github.com/google/go-cmp — deep-equality comparison in tests, especially for complex structs.

Stdlib reliance#

gh makes heavy use of the Go standard library alongside third-party deps:

Assessment: stdlib is the backbone for HTTP and I/O. Third-party deps cluster around TUI, GitHub API access, and supply-chain security — domains where stdlib has no offering. This is a healthy split.

Shared dependencies#

Dependencies that overlap with other projects in the 50-repo set:

• github.com/spf13/cobra — ubiquitous CLI framework; shared with kubectl, helm, k3s, hugo, and many others. One of the most common Go CLI deps.
• github.com/spf13/pflag — paired with cobra; same sharing profile.
• github.com/stretchr/testify — universal test assertion library; appears in nearly every medium/large Go project.
• gopkg.in/yaml.v3 — standard YAML library; shared with helm, k8s, and configuration-heavy tools.
• golang.org/x/crypto, golang.org/x/term, golang.org/x/text, golang.org/x/sync — golang.org/x packages are baseline for most serious Go projects.
• google.golang.org/grpc + google.golang.org/protobuf — used by any project touching gRPC or protobuf (consul, vault, k8s ecosystem).
• github.com/google/go-cmp — widely used in tests across the Go ecosystem.
• github.com/hashicorp/go-version — common in tools that do version gating (terraform, vault).
• github.com/mattn/go-isatty + go-colorable — near-universal in CLI tools that emit colored output.

Vendoring#

Not vendored. No vendor/ directory exists. gh relies on the Go module cache and go.sum for reproducibility. This is the modern approach for a CLI distributed as a binary — there is no need to vendor since reproducible builds are achieved via go.sum hash pinning and the release pipeline controls the build environment.

Notable dependency decisions#

1. Dual TUI stacks (Bubble Tea + tview): gh uses both charmbracelet/bubbletea (Elm-model, reactive) and rivo/tview (immediate-mode, widget-based) for different interactive views. This reflects organic evolution: tview predates or was chosen for certain table-heavy views, while the Charmbracelet ecosystem was adopted for newer interactive forms. Maintaining both is a cost (dependency weight, inconsistent UX feel) but avoids a large rewrite.

2. Two survey libraries (survey/v2 + huh): Similarly, the older AlecAivazis/survey/v2 prompt library coexists with the newer charm.land/huh/v2. This is an ongoing migration from the community-maintained survey to GitHub’s preferred Charmbracelet ecosystem.

3. Both cenkalti/backoff v4 and v5: Two major versions of the same back-off library are present simultaneously, suggesting a dependency being upgraded in parts of the codebase while others remain on v4. This is a maintenance smell worth tracking.

4. Own published libraries (cli/go-gh, cli/oauth, cli/safeexec): GitHub’s CLI team publishes their own reusable Go packages rather than inlining everything. This creates a public API contract for extension authors and separates concerns cleanly — a mature open-source dependency management strategy.

5. sigstore-go for supply-chain security: Adopting Sigstore attestations is a forward-looking choice; the dependency surface it adds (TUF, in-toto, rekor, pkcs7, protobuf) is non-trivial but signals enterprise/compliance requirements that justify the cost.

6. gojq as indirect dependency: The --jq flag on gh api and similar commands is backed by the full itchyny/gojq engine — not a simplified subset. This makes gh api --jq a first-class scripting primitive, at the cost of pulling in a relatively large dependency.

7. Minimal direct use of structured logging: There is no zerolog, zap, or slog in the direct deps. gh writes to iostreams (its own abstraction) and uses fmt.Fprintf directly — appropriate for a CLI where human-readable output is the product, not machine-readable logs.