Gogs — Dependencies#

Module info#

  • Module: gogs.io/gogs
  • Go version: 1.26.0
  • Direct dependencies: 54
  • Indirect dependencies: 75 (638 go.sum entries)

Dependency categories#

Core infrastructure#

  • gopkg.in/macaron.v1 — Martini-inspired HTTP framework; the central web layer for routing, middleware, and rendering
  • github.com/go-macaron/* (8 packages: binding, cache, captcha, csrf, gzip, i18n, session, toolbox) — the Macaron middleware ecosystem; form binding, session storage, CSRF, gzip compression, captcha, i18n, and debug toolbox
  • github.com/urfave/cli/v3 — CLI framework for top-level command parsing (serve, admin, backup, etc.)
  • gopkg.in/ini.v1 — INI file parsing for app.ini; Gogs’ primary configuration format
  • unknwon.dev/clog/v2 — structured logger maintained by the same community as several other unknwon.* deps
  • github.com/cockroachdb/errors — error wrapping with stack traces and Sentry integration; mandated by CLAUDE.md
  • github.com/gogs/cron — cron scheduler for background jobs (own fork pinned to a 2017 commit)
  • github.com/google/uuid — UUID generation for tokens and identifiers

Networking/HTTP#

  • golang.org/x/crypto — SSH server implementation, bcrypt password hashing, and other crypto primitives
  • golang.org/x/net — net utilities (HTML parsing, HTTP/2 support via macaron)
  • github.com/wneessen/go-mail — outbound email (SMTP) for notifications and invites
  • github.com/go-ldap/ldap/v3 — LDAP authentication for enterprise deployments
  • github.com/msteinert/pam — PAM authentication (Linux pluggable auth modules)
  • github.com/google/go-github — GitHub OAuth integration (login via GitHub)
  • github.com/pquerna/otp — TOTP/HOTP 2FA support; generates and validates OTP codes

Data/Storage#

  • gorm.io/gorm + gorm.io/driver/mysql + gorm.io/driver/postgres — primary ORM now (30 files); actively replacing xorm
  • xorm.io/xorm + xorm.io/core + xorm.io/builder — legacy ORM (15 files); still in use for older database models and schema migrations
  • github.com/glebarez/sqlite + github.com/glebarez/go-sqlite — CGo-free SQLite via modernc; the preferred SQLite path for cross-compilation
  • github.com/go-redis/redis/v8 (indirect via go-macaron/cache) — Redis backend for session/cache
  • github.com/bradfitz/gomemcache (indirect via go-macaron/cache) — Memcache backend

Content rendering#

  • github.com/russross/blackfriday — Markdown to HTML rendering (v1; notably not v2)
  • github.com/microcosm-cc/bluemonday — HTML sanitizer to prevent XSS in rendered Markdown
  • github.com/niklasfasching/go-org — Org-mode document rendering
  • github.com/sergi/go-diff — diff computation for inline diff display in PRs
  • github.com/editorconfig/editorconfig-core-go/v2 — EditorConfig detection for repository browser
  • github.com/inbucket/html2text — HTML to plaintext conversion for email bodies
  • github.com/olekukonko/tablewriter — table formatting (used in CLI output)

Git integration#

  • github.com/gogs/git-module — Gogs’ own Git library; wraps git CLI commands for repository operations (clone, log, blame, diff, etc.)
  • github.com/sourcegraph/run — command execution (used internally by git-module)
  • github.com/Masterminds/semver/v3 — semantic versioning for release tag handling

Identity and avatars#

  • github.com/gogs/chardet — character encoding detection (own fork of a Python port)
  • github.com/gogs/go-libravatar — Libravatar/Gravatar URL generation for user avatars
  • github.com/issue9/identicon — default identicon generation for users without avatars
  • golang.org/x/image — image decoding/resizing for uploaded avatars
  • github.com/unknwon/cae — ZIP/TAR archive extraction (for repository archives)

Internationalization#

  • github.com/unknwon/i18n + github.com/go-macaron/i18n — dual i18n layers (library + middleware)
  • golang.org/x/text — Unicode normalization and encoding conversion

Observability#

  • github.com/prometheus/client_golang — Prometheus metrics exposition (/metrics endpoint)

Testing#

  • github.com/stretchr/testify — test assertions (require and assert); mandated by CLAUDE.md
  • github.com/DATA-DOG/go-sqlmock — SQL mock for database unit tests
  • github.com/derision-test/go-mockgen/v2 — mock code generation for interfaces

Other#

  • github.com/gogs/minwinsvc — Windows service support (rare in Go web apps)
  • github.com/unknwon/com — common utility functions (string, file, etc.)
  • github.com/unknwon/paginater — pagination helper for list views

Stdlib reliance#

Gogs uses stdlib heavily. The most-referenced packages across internal/ are strings, fmt, time, net/http, context, os, path/filepath, and strconv. Because Macaron wraps net/http rather than replacing it, all HTTP handlers still operate on http.ResponseWriter and *http.Request directly. File I/O for repository operations also relies on os and path/filepath extensively. The project leans on stdlib as its foundation with third-party deps filling specific gaps (ORM, auth protocols, markup rendering).

Shared dependencies#

Dependencies likely to appear in other projects in the 50-project set:

  • github.com/stretchr/testify — near-universal in Go projects
  • golang.org/x/crypto — common in any project doing SSH, TLS, or hashing
  • golang.org/x/net — common
  • golang.org/x/text — common where Unicode handling matters
  • github.com/prometheus/client_golang — standard in server-side Go services
  • gorm.io/gorm — popular ORM shared with many web services
  • github.com/google/uuid — very widely used
  • gopkg.in/ini.v1 — appears in older Go projects (Gitea also uses it)
  • github.com/cockroachdb/errors — less common but growing; shared with CockroachDB itself
  • github.com/urfave/cli/v3 — popular CLI framework alternative to cobra

Vendoring#

No vendor/ directory. Gogs uses the Go module proxy. This is straightforward for a project with 54 direct deps, though the dual-ORM situation adds some module complexity. The absence of vendoring means build reproducibility relies on module proxy and go.sum integrity.

Notable dependency decisions#

  1. Dual ORM in transition: Both gorm.io/gorm (30 files) and xorm.io/xorm (15 files) are active simultaneously. GORM is clearly winning — new stores use GORM exclusively — but xorm remains for legacy models and the migration subsystem. This is a prolonged, careful migration rather than a flag-day switch, resulting in elevated dependency weight and two competing DB abstraction layers.

  2. Own ecosystem (gogs/*): Gogs maintains git-module, chardet, cron, go-libravatar, and minwinsvc under its own GitHub org. This gives tight control over Git integration and avoids depending on third-party libraries that might have different release cadences or break APIs. The tradeoff is maintenance burden on a small team.

  3. Blackfriday v1 (not v2): The project uses russross/blackfriday v1 (2018-era), not v2. This is a legacy choice — v1 and v2 have incompatible APIs. Upgrading would require a larger refactor of the markup pipeline.

  4. CGo-free SQLite path: glebarez/sqlite (modernc-based, pure Go) is listed as a direct dependency alongside the legacy CGo mattn/go-sqlite3 (indirect). This suggests an ongoing migration toward a pure-Go build for easier cross-compilation, particularly relevant for Raspberry Pi / ARM targets in Gogs’ core audience.

  5. cockroachdb/errors as mandatory: The CLAUDE.md mandates cockroachdb/errors for all error handling. This is a sophisticated choice — it provides stack traces, Sentry integration (via the indirect getsentry/sentry-go), sentinel error types, and errors.Is/errors.As compatibility. It’s heavier than pkg/errors but aligns with Gogs’ quality push.

  6. Windows service support: gogs/minwinsvc enables Gogs to run as a native Windows service — an unusual capability for a Go web application, reflecting the project’s commitment to cross-platform self-hosted deployment.

Backward Gogs — Structure Gogs — Architecture Forward