Gitea — Dependencies#

Module info#

• Module: code.gitea.io/gitea
• Go version: 1.26.1
• Direct dependencies: 119
• Indirect dependencies: ~155 (second require block in go.mod)
• go.sum entries: 979 lines (~489 module versions)

Dependency categories#

Core infrastructure#

• github.com/urfave/cli/v3 — CLI framework for the gitea binary; commands like web, admin, migrate, etc.
• gopkg.in/ini.v1 — INI file parsing for app.ini, Gitea’s primary configuration format; deliberate over Viper/YAML since Gitea pre-dates widespread YAML config adoption in Go apps
• go.yaml.in/yaml/v4 — YAML used for Actions workflow files and API payloads
• gopkg.in/yaml.v3 — Still used internally alongside yaml/v4 (pinned at rc.3 pending stable release)
• github.com/robfig/cron/v3 and github.com/go-co-op/gocron/v2 — Cron/job scheduling for background tasks (cleanup, mirrors, archiving)
• github.com/hashicorp/golang-lru/v2 — In-process LRU caches for hot data (user info, git objects, sessions)
• github.com/fsnotify/fsnotify — File system watching (custom template hot-reload in development mode)
• github.com/google/uuid — UUID generation for tokens, uploads, etc.
• github.com/dustin/go-humanize — Human-readable file sizes, timestamps in templates
• github.com/felixge/fgprof and github.com/google/pprof — Profiling endpoints exposed at /debug/pprof

Networking/HTTP#

• github.com/go-chi/chi/v5 — Primary HTTP router; Gitea forked and maintains several chi middlewares under gitea.com/go-chi/
• gitea.com/go-chi/binding, gitea.com/go-chi/cache, gitea.com/go-chi/captcha, gitea.com/go-chi/session — Gitea-maintained chi middleware forks; the project self-hosts its own fork chain rather than depending on upstream
• github.com/go-chi/cors — CORS headers for the API
• github.com/chi-middleware/proxy — Trusted reverse-proxy header handling (X-Forwarded-For, etc.)
• connectrpc.com/connect + google.golang.org/grpc + google.golang.org/protobuf — Used for Gitea Actions runner protocol (code.gitea.io/actions-proto-go); not for general internal RPC
• github.com/42wim/httpsig — HTTP Signature verification for ActivityPub federation
• github.com/caddyserver/certmagic — Automatic TLS certificate provisioning via ACME (Let’s Encrypt built in)
• github.com/markbates/goth — Social/OAuth2 login providers (GitHub, Google, GitLab, Twitter, etc.)
• golang.org/x/oauth2 — OAuth2 client used alongside goth
• github.com/yohcop/openid-go — OpenID 2.0 SSO support
• github.com/gliderlabs/ssh — Embedded SSH server for git-over-SSH and the SSH API shell
• github.com/go-ldap/ldap/v3 — LDAP/LDAPS authentication
• github.com/quasoft/websspi — Windows SSPI/Kerberos authentication (Windows-only build)
• github.com/msteinert/pam/v2 — PAM authentication (Linux-only build)
• github.com/wneessen/go-mail — Outbound SMTP email (notifications, password resets)
• github.com/emersion/go-imap — IMAP client for incoming mail processing
• github.com/gorilla/feeds — RSS/Atom feed generation for repository activity
• github.com/gorilla/sessions — Session store backend (complements gitea.com/go-chi/session)
• strk.kbt.io/projects/go/libravatar — Federated avatar service (Gravatar-compatible)
• golang.org/x/net — Extended networking (HTTP/2, idna, etc.)
• github.com/bohde/codel — Controlled delay (CoDel) queue for request admission control under load

Data/Storage#

• xorm.io/xorm + xorm.io/builder — ORM and query builder; the entire models/ layer sits on xorm, a deliberate choice over GORM dating back to the Gogs codebase
• github.com/go-sql-driver/mysql — MySQL/MariaDB driver
• github.com/lib/pq — PostgreSQL driver
• github.com/mattn/go-sqlite3 — SQLite3 driver (CGO required; default for single-user installs)
• github.com/microsoft/go-mssqldb — MSSQL/SQL Server driver (pinned, Azure SDK compatibility)
• github.com/redis/go-redis/v9 — Redis client for queue, cache, and distributed session storage
• github.com/go-redsync/redsync/v4 — Redis-backed distributed locks (cluster coordination)
• gitea.com/lunny/levelqueue + github.com/syndtr/goleveldb — LevelDB-backed task queue; the default queue backend without Redis
• github.com/minio/minio-go/v7 — Object storage (MinIO, S3-compatible) for attachments and LFS
• github.com/Azure/azure-sdk-for-go/sdk/azcore + azblob — Azure Blob Storage backend (pinned below v1.21 due to CI Azurite compatibility)
• github.com/aws/aws-sdk-go-v2/credentials + service/codecommit — AWS S3 credentials and CodeCommit mirroring
• github.com/blevesearch/bleve/v2 — Embedded full-text search index (default; no external service)
• github.com/olivere/elastic/v7 — Elasticsearch backend for search (optional)
• github.com/meilisearch/meilisearch-go — Meilisearch backend for search (optional)
• github.com/klauspost/compress — Compression (zstd, gzip, snappy) used throughout storage and network layers
• github.com/SaveTheRbtz/zstd-seekable-format-go/pkg — Seekable zstd for compressed git pack files
• github.com/mholt/archives — Archive extraction (zip, tar.gz, etc.) for repository downloads and uploads
• github.com/goccy/go-json — Drop-in fast JSON encoder; selected over encoding/json for performance on large API responses

Authentication & Security#

• github.com/go-webauthn/webauthn — WebAuthn/FIDO2 hardware security key support
• github.com/pquerna/otp — TOTP 2FA (authenticator app QR codes)
• github.com/golang-jwt/jwt/v5 — JWT tokens for API auth and OAuth2 tokens
• github.com/tstranex/u2f — Legacy U2F hardware token support
• github.com/ProtonMail/go-crypto — OpenPGP/GPG for commit signing verification
• github.com/42wim/sshsig — SSH signature verification for signed commits
• codeberg.org/gusted/mcaptcha — mCaptcha integration for bot prevention
• golang.org/x/crypto — bcrypt, SSH protocol, TLS helpers

Git & VCS#

• github.com/go-git/go-git/v5 + go-billy/v5 — Pure Go git library; used for specific operations like parsing git objects without shelling out to git
• github.com/charmbracelet/git-lfs-transfer — Git LFS pure-Go transfer protocol
• github.com/gogs/go-gogs-client — Gogs API client for Gogs→Gitea migration
• github.com/emirpasica/gods — Generic data structures used by go-git internals
• github.com/editorconfig/editorconfig-core-go/v2 — EditorConfig file parsing for the editor UI

Code Rendering & Markup#

• github.com/yuin/goldmark + goldmark-highlighting/v2 + goldmark-meta — Markdown pipeline with syntax highlighting and YAML frontmatter
• github.com/alecthomas/chroma/v2 — Syntax highlighting engine (280+ languages) for code view and diffs
• github.com/microcosm-cc/bluemonday — HTML sanitizer for user-submitted content
• github.com/PuerkitoBio/goquery — HTML parsing/manipulation for rendering pipeline
• github.com/sergi/go-diff — Diff computation for code review patches
• github.com/niklasfasching/go-org — Org-mode markup rendering
• github.com/buildkite/terminal-to-html/v3 — Converts ANSI terminal output to HTML for Actions logs
• github.com/go-enry/go-enry/v2 — Language detection by file content/extension (GitHub Linguist port)
• github.com/google/licenseclassifier/v2 — Open-source license detection for repository insights
• github.com/dlclark/regexp2 — .NET-compatible regex for chroma syntax highlighter rules
• mvdan.cc/xurls/v2 — URL autolink extraction from plain text
• github.com/jaytaylor/html2text — HTML→plaintext for email notifications (replaced with a maintained fork via replace)

Package Registry & CI/CD#

• github.com/nektos/act (replaced → gitea.com/gitea/act) — GitHub Actions workflow runner embedded in the Gitea binary; Gitea maintains its own fork
• code.gitea.io/actions-proto-go — Protobuf definitions for Actions runner protocol
• github.com/blakesmith/ar — Debian .deb package format parsing for the package registry
• github.com/sassoftware/go-rpmutils — RPM package parsing for the package registry
• github.com/opencontainers/go-digest + image-spec — OCI container image standards for Gitea’s container registry
• github.com/santhosh-tekuri/jsonschema/v6 — JSON Schema validation for API request bodies

External Integrations#

• github.com/google/go-github/v84 — GitHub API client for GitHub→Gitea migration and repository mirroring
• gitlab.com/gitlab-org/api/client-go — GitLab API client for GitLab→Gitea migration
• code.gitea.io/sdk/gitea — Gitea’s own API client (used internally for CLI admin commands)
• gitea.com/lunny/dingtalk_webhook — DingTalk (Chinese messaging platform) webhook integration
• github.com/ethantkoenig/rupture — Batch indexing for Bleve (wraps bleve indexing with transaction-like batching)

Testing#

• github.com/stretchr/testify — The only explicit test framework (assert, require, mock); used heavily throughout *_test.go files
• github.com/dimero1/reply — HTTP response recording for handler tests

Observability#

• github.com/prometheus/client_golang — Prometheus metrics endpoint (/metrics); production-grade observability built in

Stdlib reliance#

Gitea makes heavy use of stdlib, particularly:

• net/http — All HTTP serving (chi wraps stdlib’s http.Handler)
• database/sql — The DB layer; xorm builds on top of stdlib’s database/sql
• encoding/json — Supplemented by goccy/go-json for hot paths
• os/exec — Git subprocess invocations for most git operations (the project shells out to git CLI rather than using go-git for the majority of operations, for performance/completeness reasons)
• crypto/* — TLS, hash functions, alongside golang.org/x/crypto
• text/template / html/template — Server-side HTML rendering
• sync — Mutexes and WaitGroups throughout the codebase
• context — Pervasive context propagation through all layers

The project is stdlib-heavy for its core serving logic but relies heavily on third-party packages for the breadth of its feature set (auth, search, archives, rendering, etc.).

Shared dependencies#

Dependencies appearing across many of the 50 analyzed projects:

• golang.org/x/{crypto,net,sys,text,sync} — near-universal Go extended stdlib
• github.com/stretchr/testify — de facto standard test framework
• github.com/prometheus/client_golang — common in any server exposing metrics
• github.com/go-chi/chi/v5 — widely used in non-framework Go web apps (also seen in Consul, Vault, Nomad)
• github.com/redis/go-redis/v9 — common Redis client
• google.golang.org/grpc + protobuf — common in infrastructure/service projects
• github.com/google/uuid — ubiquitous
• github.com/hashicorp/golang-lru/v2 — shared with Consul, Vault, Terraform
• github.com/klauspost/compress — common high-performance compression
• gopkg.in/yaml.v3 — widespread YAML parsing
• github.com/fsnotify/fsnotify — common file watching
• github.com/minio/minio-go/v7 — shared with other projects needing S3-compatible storage

Vendoring#

Gitea does not vendor dependencies. The go.mod ignore directive explicitly excludes .venv and node_modules but there is no vendor/ directory. The project uses the Go module proxy and sum database. The replace directives (7 total) serve a similar pinning purpose for specific packages where upstream is unmaintained or broken:

Notable dependency decisions#

1. xorm over GORM: Gitea inherited xorm from Gogs and chose to stay with it rather than migrating to the more widely adopted GORM. xorm has better support for the Sync2 schema migration pattern Gitea relies on, and the cost of migrating 2,800+ Go files was never justified.

2. Fork chain under gitea.com/go-chi/: Rather than contributing back to upstream chi middlewares or finding alternatives, Gitea maintains its own forks of binding, cache, captcha, and session middleware. This reflects the team’s need for tight control over session and cache behavior specific to Gitea’s architecture.

3. Embedded Actions runner (gitea.com/gitea/act): Bundling an entire CI workflow execution engine into the same binary is architecturally unusual. The replace directive pointing to Gitea’s own fork means the project cannot simply pull in upstream nektos/act updates — all upstream changes must be manually ported.

4. Three search backends: Shipping drivers for Bleve (embedded), Elasticsearch, and Meilisearch as direct dependencies means all three are compiled into every Gitea binary, not loaded dynamically. The choice of which backend to use is a runtime config decision; the binaries for all three ship regardless. This inflates binary size but simplifies deployment.

5. All four database drivers always compiled in: Same pattern as search — MySQL, PostgreSQL, SQLite, and MSSQL drivers are always compiled in. SQLite requires CGO, making CGO_ENABLED=0 builds impossible unless sqlite is excluded from build tags.

6. Minimal indirect dep hygiene: The go.mod explicitly comments that go get -u ./... is not safe to run freely, and maintains a pinning list with TODO markers for versions that need manual review before upgrading. This signals the project acknowledges its dependency graph is large and fragile in places, and manages it with explicit human oversight rather than automation.