Syncthing — Dependencies#

Module info#

• Module: github.com/syncthing/syncthing
• Go version: go 1.25.0
• Direct dependencies: 46
• Indirect dependencies: 50 (go.sum has 390 lines ≈ 195 unique module hashes)

Dependency categories#

Core infrastructure#

• github.com/thejerf/suture/v4 — The most architecturally distinctive dep: Erlang-inspired supervisor tree for managing goroutines as restartable services. Used pervasively; every major subsystem (model, scanner, connections, events, discovery) is a suture.Service.
• github.com/alecthomas/kong — Primary CLI parsing framework for the main syncthing binary. Replaces older flag/cobra approaches.
• github.com/willabides/kongplete — Shell completion plugin for kong.
• github.com/urfave/cli — Legacy CLI framework still used by strelaysrv and stdiscosrv binaries. Coexists with kong, showing incremental migration.
• github.com/AudriusButkevicius/recli — Reflection-based CLI builder used to generate a REST client CLI from the API definitions automatically.
• github.com/coreos/go-semver — Semantic version parsing for build/upgrade comparison.
• github.com/calmh/incontainer — Detects whether the process is running inside a container (Docker/Podman) to adjust behavior.
• github.com/maruel/panicparse/v2 — Parses and formats Go panic stack traces; used to improve crash readability before reporting.
• github.com/getsentry/raven-go — Sentry error reporting client for crash telemetry (usage reports).
• sigs.k8s.io/yaml — YAML serialization for config files and API responses.
• github.com/kballard/go-shellquote — Shell string quoting utilities.

Networking / Protocol / Transport#

• github.com/quic-go/quic-go — QUIC transport layer for the Block Exchange Protocol (BEP). Core networking dep; Syncthing uses QUIC as the primary transport for peer connections since it provides multiplexing and better NAT traversal than raw TCP.
• golang.org/x/crypto — TLS cryptographic primitives, including curve25519 for device IDs and key exchange; critical security dep.
• golang.org/x/net — HTTP/2, WebSocket, and network utilities.
• google.golang.org/protobuf — Protocol Buffers runtime for BEP message serialization (.proto files in proto/). The modern google.golang.org/protobuf (not legacy github.com/golang/protobuf).
• github.com/calmh/xdr — XDR (External Data Representation) encoder/decoder; a fork maintained by Syncthing’s author. Used for the older BEP wire format alongside protobuf — legacy serialization still in use for some data structures.
• github.com/ccding/go-stun — STUN client for NAT type detection and external address discovery, enabling peer connections through NATs.
• github.com/jackpal/go-nat-pmp — NAT-PMP for automatic port mapping on home routers.
• github.com/jackpal/gateway (replaced by a fork github.com/marbens-arch/gateway) — Default gateway detection for network interface routing.
• github.com/wlynxg/anet — Android-compatible network interface enumeration (pure Go, avoids NDK restrictions).
• github.com/julienschmidt/httprouter — High-performance HTTP router for Syncthing’s REST API (/rest/… endpoints and GUI).
• github.com/go-ldap/ldap/v3 — LDAP client for enterprise authentication support.
• github.com/miscreant/miscreant.go — AES-SIV (miscreant) authenticated encryption; used for relay tokens and session authentication.
• github.com/rabbitmq/amqp091-go — AMQP 0-9-1 client for RabbitMQ; used exclusively by stdiscosrv to publish discovery events for infrastructure metrics.
• golang.org/x/time — Rate limiting (rate.Limiter) for connection throttling and request limiting.

Data / Storage#

• github.com/mattn/go-sqlite3 (replaced by github.com/calmh/go-sqlite3) — CGo-based SQLite3 driver; primary database for the Syncthing file index (replaces LevelDB in newer versions). The fork patches a specific upstream bug.
• modernc.org/sqlite — Pure-Go SQLite driver (transpiled from C); used for CGo-free build targets (e.g., cross-compilation, some container/embedded scenarios). Dual-driver strategy is unique in the ecosystem.
• github.com/jmoiron/sqlx — Extends database/sql with struct scanning and named queries; used alongside the SQLite drivers.
• github.com/syndtr/goleveldb — LevelDB embedded key-value store; the historical database engine being superseded by SQLite. Still present for migration paths.
• github.com/hashicorp/golang-lru/v2 — Generics-based LRU cache for frequently accessed file metadata.
• github.com/puzpuzpuz/xsync/v3 — High-performance concurrent map implementation (sharded, cache-line-aware); used where sync.Map would be a bottleneck.
• github.com/pierrec/lz4/v4 — LZ4 block compression for protocol-level data compression.
• github.com/aws/aws-sdk-go — AWS SDK; used by stdiscosrv (global discovery server) for DynamoDB-backed device address storage and S3 integration for infrastructure services.
• github.com/gobwas/glob (replaced by github.com/calmh/glob) — Glob pattern matching for .stignore file pattern evaluation. The fork patches a correctness issue in the upstream library.
• github.com/d4l3k/messagediff — Deep struct diff; used for detecting config changes and computing deltas for change notifications.
• github.com/maxmind/geoipupdate/v6 — MaxMind GeoIP database updater; used by stdiscosrv to keep GeoIP data current for analytics.
• github.com/oschwald/geoip2-golang — GeoIP2 lookup library; paired with geoipupdate in the discovery server.

Observability / System metrics#

• github.com/prometheus/client_golang — Prometheus metrics exposition (/metrics endpoint); used for the main application, relay server, and discovery server.
• github.com/rcrowley/go-metrics — Older go-metrics library; present alongside Prometheus, likely for legacy instrumentation or relay server metrics.
• github.com/shirou/gopsutil/v4 — Cross-platform system information (CPU, memory, disk) for usage reporting and diagnostics.

Filesystem / OS integration#

• github.com/syncthing/notify — Filesystem change notifications (a maintained fork of rjeczalik/notify); critical for real-time file change detection across Linux (inotify), macOS (FSEvents), and Windows (ReadDirectoryChangesW).
• github.com/gofrs/flock — Cross-platform file locking for database file safety.
• golang.org/x/sys — Low-level OS syscall access; used for Linux-specific file operations, Windows ACLs, and extended attributes.

Other#

• github.com/vitrun/qart — Generates QR codes with embedded images; used to render device IDs as scannable QR codes in the GUI.
• golang.org/x/text — Unicode normalization for filename comparison across file systems with different case/normalization semantics (macOS NFC vs Linux NFD).
• golang.org/x/exp — Experimental generics utilities (slices, maps); used while these were pre-stdlib.

Testing#

• github.com/stretchr/testify (indirect) — Standard assertion library used in _test.go files.
• github.com/maxbrunsfeld/counterfeiter/v6 (indirect, also listed as a tool) — Interface mock generator; //go:generate directives in lib/model/model.go and lib/protocol/protocol.go invoke it to produce mocks/ packages.

Stdlib reliance#

Syncthing makes heavy use of stdlib; most packages import stdlib-heavy patterns:

• context — pervasive; every service accepts and propagates context for cancellation
• sync / sync/atomic — used in most packages; goroutine safety is a first-class concern
• crypto/tls, crypto/rand, crypto/x509 — TLS and certificate management done in stdlib; x/crypto extends it
• net, net/http — direct socket programming and HTTP REST server
• io, io/fs — abstracted filesystem I/O (syncthing has its own lib/fs layer built on top)
• log/slog — structured logging (migrated from older log and custom logging, now uses the Go 1.21+ slog package)
• encoding/json — REST API request/response serialization
• path/filepath — cross-platform path handling

The ratio is notably high: the lib/model/model.go file imports 16 stdlib packages vs 1 external package (suture). This reflects a deliberate philosophy of keeping the application self-contained and minimizing third-party exposure in the core protocol and model code.

Shared dependencies#

Dependencies likely shared with other projects in the 50-project set:

• golang.org/x/crypto, golang.org/x/net, golang.org/x/sys, golang.org/x/text — ubiquitous in nearly every Go project
• github.com/prometheus/client_golang — standard for metrics in server-side Go projects
• google.golang.org/protobuf — common in any project using gRPC or Protocol Buffers
• github.com/stretchr/testify — near-universal test assertion library
• github.com/hashicorp/golang-lru/v2 — widely adopted LRU cache
• sigs.k8s.io/yaml — common in infrastructure-adjacent projects
• github.com/syndtr/goleveldb — found in several blockchain and storage projects
• github.com/quic-go/quic-go — increasingly common in network-heavy projects (e.g., used by Caddy)

Notably absent compared to typical server projects: no Cobra (uses Kong), no Viper, no Zap/Zerolog (uses slog), no gRPC (uses its own QUIC+Protobuf stack), no database/ORM framework (raw sqlx + SQLite).

Vendoring#

No vendor directory. Syncthing uses Go modules without vendoring. However, three direct dependencies are replaced with custom forks via replace directives:

This pattern — maintaining personal forks of slow-moving upstream deps — is consistent across the project. github.com/calmh is Jakob Borg, Syncthing’s creator, who maintains several forks and original packages used by the project (also calmh/xdr, calmh/incontainer).

Notable dependency decisions#

1. Dual SQLite strategy (cgo + pure-Go): Shipping both mattn/go-sqlite3 (CGo) and modernc.org/sqlite (pure Go) for the same database is rare. It allows CGo-free cross-compilation builds (e.g., GOOS=linux GOARCH=arm) while retaining the more battle-tested CGo version as default. A build tag selects which driver is compiled in.

2. thejerf/suture as the concurrency backbone: Rather than ad-hoc goroutine management with sync.WaitGroup and channels, Syncthing adopts a full supervisor-tree library. This is an Erlang “let it crash” philosophy applied to Go — each subsystem is a restartable service. This is the most architecturally distinctive dep in the entire set.

3. QUIC-go instead of raw TCP: Using quic-go for peer transport (rather than TCP or a gRPC transport) gives Syncthing built-in multiplexing, connection migration, and 0-RTT reconnection — important for mobile and unstable networks. Most file-sync projects use TCP.

4. Maintaining forks rather than waiting on upstream: Three replace directives point to the author’s own forks of slow-moving upstreams. This is pragmatic but creates long-term maintenance burden. The pattern signals that Syncthing moves faster than its dependencies.

5. AWS SDK in a client application: aws-sdk-go is present not for the client binary but for stdiscosrv (the global discovery server), which uses DynamoDB as its backing store. This is infrastructure code shipped in the same module, making the dependency graph reflect both client and server concerns simultaneously.

6. No logging framework; slog: Syncthing has migrated to Go’s standard log/slog (introduced in 1.21) rather than adopting Zap or Zerolog. This reduces the dependency surface and aligns with the project’s preference for stdlib where possible.