Grafana — Dependencies#

Module info#

  • Module: github.com/grafana/grafana
  • Go version: 1.25.8
  • Direct external dependencies: ~224 (first require block in go.mod; each annotated with owning Grafana team)
  • Internal workspace modules: ~36 (second require block; all replaced with local ./apps/ and ./pkg/ paths via replace directives and go.work)
  • Indirect dependencies: 397 (go.mod lines with // indirect)
  • go.sum entries: 3,784 lines ≈ 1,892 unique module versions tracked

Dependency categories#

Core infrastructure#

  • github.com/spf13/cobra v1.10.2 — CLI sub-command framework (@grafana/grafana-app-platform-squad)
  • github.com/urfave/cli/v2 + /v3 — CLI framework used by the root main.go binary (two versions coexist)
  • github.com/google/wire v0.7.0 — Compile-time DI code generation; regenerated via make gen-go after any service init change (@grafana/grafana-backend-group)
  • go.uber.org/zap v1.27.1 — Structured logging for backend services (@grafana/identity-access-team)
  • github.com/go-kit/log v0.2.1 — Kit-style log interface, used where Prometheus/dskit expects it
  • gopkg.in/ini.v1 v1.67.1 — Parses conf/grafana.ini / conf/custom.ini (@grafana/alerting-backend)
  • github.com/BurntSushi/toml v1.5.0 — TOML config support (@grafana/identity-access-team)
  • github.com/mitchellh/mapstructure v1.5.1 — Config struct hydration from maps (@grafana/identity-access-team)
  • github.com/open-feature/go-sdk v1.17.1 + ofrep provider — Feature flag SDK; Grafana manages feature toggles as a first-class concern (@grafana/grafana-backend-group)
  • github.com/thomaspoignant/go-feature-flag v1.42.0 — Alternative feature flag runtime (@grafana/grafana-backend-group)
  • github.com/robfig/cron/v3 v3.0.1 — Cron scheduling for background jobs (@grafana/grafana-backend-group)
  • github.com/Masterminds/sprig/v3 v3.3.0 — Template helper functions used in provisioning/config (@grafana/grafana-backend-group)
  • github.com/centrifugal/centrifuge v0.38.0 — Real-time WebSocket messaging (powers Grafana Live) (@grafana/grafana-app-platform-squad)

Networking/HTTP#

  • github.com/gorilla/mux v1.8.1 — Primary HTTP router for REST API (@grafana/grafana-backend-group)
  • github.com/gorilla/websocket v1.5.4 — WebSocket upgrade (Grafana Live / live dashboard updates) (@grafana/grafana-app-platform-squad)
  • github.com/emicklei/go-restful/v3 v3.13.0 — REST framework used by the app platform Kubernetes-style API layer (@grafana/grafana-app-platform-squad)
  • google.golang.org/grpc v1.79.3 — gRPC for plugin process communication; core to the plugin isolation model (@grafana/plugins-platform-backend)
  • github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 — gRPC interceptors chain (@grafana/grafana-search-and-storage)
  • github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 — Updated interceptors (@grafana/grafana-backend-group)
  • github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 — gRPC ↔ HTTP/JSON transcoding for the app platform (@grafana/identity-access-team)
  • connectrpc.com/connect v1.19.1 — Connect RPC protocol (used by Parca/profiling datasource) (@grafana/data-sources-plugins)
  • github.com/rs/cors v1.11.1 — CORS middleware (@grafana/identity-access-team)
  • golang.org/x/net v0.51.0 — Extended networking (HTTP/2, etc.) (@grafana/oss-big-tent)
  • golang.org/x/oauth2 v0.35.0 — OAuth2 flows for identity providers (@grafana/identity-access-team)
  • github.com/mwitkow/go-conntrack v0.0.0 — HTTP connection tracking metrics (@grafana/grafana-operator-experience-squad)

Data/Storage#

  • github.com/go-sql-driver/mysql v1.9.3 — MySQL driver for Grafana’s own DB and MySQL datasource (@grafana/grafana-search-and-storage)
  • github.com/lib/pq v1.10.9 — PostgreSQL driver (@grafana/grafana-backend-group)
  • github.com/jackc/pgx/v5 v5.8.0 — Alternate PostgreSQL driver with richer features (@grafana/grafana-search-and-storage)
  • github.com/microsoft/go-mssqldb v1.9.2 — MSSQL driver (@grafana/partner-datasources)
  • modernc.org/sqlite v1.47.0 — Pure-Go SQLite (no CGo); used as the default embedded backend database (@grafana/grafana-backend-group)
  • github.com/jmoiron/sqlx v1.4.0 — SQL struct scanning extensions (@grafana/grafana-backend-group)
  • xorm.io/builder v0.3.13 — SQL query builder (legacy xorm usage) (@grafana/grafana-backend-group)
  • github.com/golang-migrate/migrate/v4 v4.7.0 — Database schema migrations (@grafana/grafana-backend-group)
  • github.com/pressly/goose/v3 v3.26.0 — Second migration framework used by newer app platform modules (@grafana/identity-access-team)
  • github.com/redis/go-redis/v9 v9.14.0 — Redis client for alerting, caching, sessions (@grafana/alerting-backend)
  • github.com/bradfitz/gomemcache v0.0.0 + github.com/grafana/gomemcache — Memcache client + Grafana’s fork (@grafana/grafana-backend-group / @grafana/grafana-operator-experience-squad)
  • github.com/blevesearch/bleve/v2 v2.5.7 + bleve_index_api — Full-text search engine for resource indexing (@grafana/grafana-search-and-storage)
  • github.com/dgraph-io/badger/v4 v4.9.1 — Embedded key-value store (unified storage layer) (@grafana/grafana-search-and-storage)
  • go.etcd.io/bbolt v1.4.3 — BoltDB for legacy/simple storage (@grafana/grafana-search-and-storage)
  • github.com/dolthub/go-mysql-server v0.19.1 + dolthub/vitess — Embeddable MySQL-compatible query engine (used for the SQL-layer datasource testing) (@grafana/grafana-datasources-core-services)
  • google.golang.org/protobuf v1.36.11 — Protocol Buffers runtime (@grafana/plugins-platform-backend)
  • github.com/json-iterator/go v1.1.12 — Drop-in fast JSON encoder/decoder (@grafana/grafana-backend-group)
  • github.com/apache/arrow-go/v18 v18.5.1 — Apache Arrow columnar memory format (plugin data frame exchange) (@grafana/plugins-platform-backend)
  • github.com/influxdata/influxdb-client-go/v2 + influxql — InfluxDB datasource support (@grafana/partner-datasources)
  • gocloud.dev v0.44.0 + hashivault — Portable cloud abstractions for secrets/storage (@grafana/grafana-app-platform-squad)
  • github.com/shopspring/decimal v1.4.0 — Arbitrary-precision decimal arithmetic (@grafana/grafana-datasources-core-services)

Observability & Telemetry#

  • github.com/prometheus/client_golang v1.23.2 — Prometheus metrics instrumentation (@grafana/alerting-backend)
  • github.com/prometheus/prometheus v0.303.1 — Prometheus server library (query engine, remote write) (@grafana/alerting-backend)
  • github.com/prometheus/alertmanager v0.28.2 — Alertmanager library for Grafana Alerting (@grafana/alerting-backend)
  • go.opentelemetry.io/otel v1.42.0 — OpenTelemetry tracing core (@grafana/grafana-backend-group)
  • go.opentelemetry.io/otel/sdk, exporters/jaeger, exporters/otlp/... — OTel SDK + Jaeger and OTLP exporters
  • go.opentelemetry.io/contrib/instrumentation/... — Auto-instrumentation for gRPC, HTTP (@grafana/plugins-platform-backend)
  • github.com/grafana/otel-profiling-go v0.5.1 — OTel profiling integration (@grafana/grafana-backend-group)
  • github.com/grafana/pyroscope-go/godeltaprof v0.1.9 — Continuous profiling delta profiles (@grafana/data-sources-plugins)
  • go.opentelemetry.io/collector/pdata v1.44.0 — OTel Collector data types (@grafana/grafana-backend-group)

Authentication & Security#

  • github.com/crewjam/saml v0.4.14 — SAML 2.0 SSO (@grafana/identity-access-team)
  • github.com/go-ldap/ldap/v3 v3.4.4 — LDAP authentication (@grafana/identity-access-team)
  • github.com/go-jose/go-jose/v4 v4.1.3 — JOSE/JWK/JWE cryptographic operations (@grafana/identity-access-team)
  • github.com/golang-jwt/jwt/v4 v4.5.2 — JWT signing/verification (@grafana/grafana-backend-group)
  • github.com/openfga/openfga v1.11.3 + proto + language — Embedded OpenFGA authorization server for fine-grained access control (@grafana/identity-access-team)
  • filippo.io/age v1.2.1 — Secrets encryption (for secure value storage) (@grafana/identity-access-team)
  • github.com/grafana/authlib v0.0.0 + types — Grafana’s own identity/auth library (@grafana/identity-access-team)
  • github.com/beevik/etree v1.6.0 + russellhaering/goxmldsig — XML parsing + digital signatures (SAML XML validation) (@grafana/grafana-backend-group)
  • github.com/jmespath-community/go-jmespath v1.1.1 — JMESPath query language for IAM policy evaluation (@grafana/identity-access-team)
  • github.com/youmark/pkcs8 v0.0.0 — PKCS#8 key handling for crypto operations (@grafana/grafana-operator-experience-squad)

Cloud SDKs#

  • cloud.google.com/go/kms + storage — GCP KMS and Cloud Storage (@grafana/grafana-backend-group)
  • github.com/Azure/azure-sdk-for-go v68.0.0 (legacy) + multiple azure-sdk-for-go/sdk/* packages — Full Azure SDK coverage for AKS/AzureMonitor/KeyVault (@grafana/partner-datasources / @grafana/identity-access-team)
  • github.com/aws/aws-sdk-go v1.55.7 (v1) + aws-sdk-go-v2 v1.41.1 + service packages — CloudWatch, CloudWatchLogs, EC2, OAM, SecretsManager, STS (@grafana/aws-datasources)
  • github.com/grafana/grafana-aws-sdk v1.4.3 — Grafana AWS auth helper (@grafana/aws-datasources)
  • github.com/grafana/grafana-azure-sdk-go/v2 v2.4.0 — Grafana Azure auth helper (@grafana/partner-datasources)
  • github.com/grafana/grafana-google-sdk-go v0.4.2 — Grafana GCP auth helper (@grafana/partner-datasources)

Kubernetes/Platform stack#

  • k8s.io/api v0.35.3, apimachinery, client-go, apiserver, apiextensions-apiserver, kube-aggregator, component-base, klog/v2, utils, kube-openapi — Full Kubernetes API machinery; Grafana’s App Platform embeds a Kubernetes-style API server (@grafana/grafana-app-platform-squad)
  • github.com/grafana/grafana-app-sdk v0.52.1 — Grafana’s own App SDK wrapping k8s patterns (@grafana/grafana-app-platform-squad)
  • sigs.k8s.io/structured-merge-diff/v6 + randfill — k8s server-side apply support
  • github.com/getkin/kin-openapi v0.133.0 — OpenAPI 3.x validation for Kubernetes-style APIs (@grafana/grafana-app-platform-squad)

Grafana ecosystem#

  • github.com/grafana/grafana-plugin-sdk-go v0.290.1 — Plugin SDK for data source and panel plugins (the canonical extension point) (@grafana/plugins-platform-backend)
  • github.com/grafana/loki/v3 v3.5.11 — Loki log storage library (@grafana/observability-logs)
  • github.com/grafana/tempo v1.5.1 — Tempo trace storage library (@grafana/data-sources-plugins)
  • github.com/grafana/alerting v0.0.0 — Shared alerting business logic (@grafana/alerting-backend)
  • github.com/grafana/dskit v0.0.0 — Shared infrastructure kit (ring, HTTP, gRPC helpers) (@grafana/grafana-backend-group)
  • github.com/grafana/pyroscope/api v1.2.1 — Pyroscope profiling API (@grafana/data-sources-plugins)
  • github.com/grafana/dataplane/sdata — Data plane data structures (@grafana/observability-metrics)

Testing#

  • github.com/stretchr/testify v1.11.1 — Primary test assertion library (@grafana/grafana-backend-group)
  • github.com/golang/mock v1.7.0-rc.1 — Classic mockgen code-gen mocking (@grafana/alerting-backend)
  • go.uber.org/mock v0.6.0 — Uber’s maintained mockgen fork (@grafana/grafana-operator-experience-squad)
  • github.com/DATA-DOG/go-sqlmock v1.5.2 — SQL driver mock (@grafana/grafana-search-and-storage)
  • github.com/testcontainers/testcontainers-go v0.40.0 — Docker-based integration tests (@grafana/grafana-app-platform-squad)
  • pgregory.net/rapid v1.2.0 — Property-based (fuzzing-style) testing (@grafana/grafana-operator-experience-squad)
  • go.uber.org/goleak v1.3.0 — Goroutine leak detector (@grafana/grafana-search-and-storage)
  • github.com/alicebob/miniredis/v2 v2.34.0 + Bose/minisentinel — In-process Redis and Redis Sentinel for alerting tests (@grafana/alerting-backend)
  • github.com/madflojo/testcerts v1.4.0 — Dynamic TLS cert generation for tests (@grafana/alerting-backend)
  • github.com/mocktools/go-smtp-mock/v2 v2.5.1 — SMTP server mock for notification tests (@grafana/grafana-backend-group)

Stdlib reliance#

Grafana uses the Go stdlib extensively but is far more third-party-heavy than typical Go projects due to its scope. Key stdlib packages:

  • net/http — Foundation for the HTTP server; gorilla/mux sits on top of it
  • database/sql — All database access goes through sqlx and raw database/sql
  • context — Pervasive; every service call and DB query passes a context
  • sync — Mutexes, RWMutex, Once, WaitGroup used throughout; supplemented by puzpuzpuz/xsync/v4 for concurrent maps
  • encoding/json — Supplemented heavily by json-iterator/go for performance-critical paths
  • io / io/fs — Embedded static assets (embed.go exists at repo root), file system abstraction
  • os, path/filepath — Plugin discovery, config file loading
  • crypto/* — Used directly alongside go-jose/age for TLS, hashing, key operations
  • time — Pervasive in metrics, alerting, scheduling

The stdlib-to-third-party ratio is low by design: Grafana delegates specialized concerns (routing, ORM, DI, observability, auth protocols) to well-maintained libraries rather than reimplementing them.

Shared dependencies#

Dependencies shared with many other projects in the 50-project analysis set:

  • github.com/prometheus/client_golang — Nearly universal in cloud-native Go projects
  • go.opentelemetry.io/otel — Increasingly standard for tracing
  • google.golang.org/grpc — Common in distributed systems (etcd, Kubernetes, Consul all use it)
  • github.com/stretchr/testify — De facto test assertion standard
  • github.com/spf13/cobra — Dominant CLI framework (Kubernetes, Vault, Consul, Terraform all use it)
  • golang.org/x/net, x/sync, x/text — Near-universal Go extended packages
  • google.golang.org/protobuf — Protocol Buffers, universal in gRPC-using projects
  • github.com/hashicorp/go-plugin — Plugin framework (also used by Vault, Terraform)
  • k8s.io/apimachinery / client-go — Increasingly common as cloud-native projects adopt k8s patterns
  • github.com/prometheus/prometheus — Used by Grafana and also Thanos, Cortex, Mimir

Vendoring#

No vendor directory. Grafana uses the standard Go module proxy (GOPROXY) without vendoring. The repo uses a Go workspace (go.work) to wire together the monorepo’s sub-modules (26+ workspace modules under apps/ and pkg/) without publishing them separately. This is the modern approach for monorepo management introduced in Go 1.18.

Notable dependency decisions#

  1. Two migration frameworks: Both golang-migrate/migrate (legacy) and pressly/goose (newer app platform) coexist. This reflects the incremental adoption of the Kubernetes-style app platform without a big-bang migration of older services.

  2. Both aws-sdk-go v1 and v2: The older v1 SDK is retained for existing datasources while v2 is used for newer services (SecretsManager, STS, OAM). An explicit migration is implied but not yet complete.

  3. Pure-Go SQLite (modernc.org/sqlite): Instead of the CGo-dependent mattn/go-sqlite3, Grafana uses modernc.org/sqlite — a transpiled pure-Go SQLite that compiles without CGo. This dramatically simplifies cross-compilation and avoids CGo overhead in CI.

  4. Embedded OpenFGA: github.com/openfga/openfga v1.11.3 is a full-featured authorization server embedded inside the Grafana binary. This is an unusual choice — most projects call an external FGA service. Grafana runs it in-process for fine-grained resource-level authorization without deploying extra infrastructure.

  5. Two CLI frameworks: urfave/cli (v2 and v3 simultaneously) is used for the top-level binary, while spf13/cobra is used internally for sub-tool commands. This dual presence is a historical artifact of the Grafana CLI tool predating broader Cobra adoption.

  6. Grafana-forked dependencies: Several packages are Grafana forks (grafana/gomemcache, grafana/loki, grafana/tempo), reflecting the tight vertical integration of the LGTM stack. These forks allow Grafana Labs to ship coordinated changes across the stack without waiting on upstream.

  7. Dependency ownership annotations: Every direct dependency in go.mod is annotated with a // @grafana/<team> comment. This transforms go.mod into a living ownership manifest, enabling automated team-level dependency auditing — a unique governance practice at this scale.

  8. dolthub/go-mysql-server + vitess: An in-process MySQL-compatible query engine is included as a direct dependency for the SQL-based datasource testing layer — a heavyweight choice that hints at ambitions for first-class SQL federation across multiple backends.

Backward Grafana — Structure Grafana — Architecture Forward