Temporal — Dependencies#

Module info#

  • Module: go.temporal.io/server
  • Go version: 1.26.0
  • Direct dependencies: 67 (first require block, no // indirect tag)
  • Indirect dependencies (go.mod): ~91 (2 in second block + ~89 in third block)
  • go.sum entries: ~290 unique module versions (579 lines ÷ 2)
  • Vendoring: None — uses standard Go module proxy

Dependency categories#

Core infrastructure#

  • go.uber.org/fx v1.24.0 — The central dependency injection framework; virtually every package in the codebase defines an fx.Module and uses fx.In/fx.Out struct embedding. This is the biggest architectural bet in the dependency graph.
  • go.uber.org/zap v1.27.0 — Structured logging, used across all services. The standard choice for high-performance Go logging.
  • go.uber.org/multierr v1.11.0 — Aggregating multiple errors into one; used in cleanup/shutdown paths.
  • gopkg.in/yaml.v3 v3.0.1 — YAML configuration file parsing.
  • github.com/mitchellh/mapstructure v1.5.0 — Decode config maps into structs; common companion to Viper-style config loading.
  • github.com/blang/semver/v4 v4.0.0 — Semantic versioning used for deployment versioning (worker deployment feature).
  • github.com/urfave/cli v1.22.16 and github.com/urfave/cli/v2 v2.27.5 — Both v1 and v2 CLI frameworks are present simultaneously (likely migration in progress from the tchannel/Uber-era tooling).
  • github.com/Masterminds/sprig/v3 v3.3.0 — Template helper functions; used for config templating.
  • github.com/iancoleman/strcase v0.3.0 — String case conversion for protobuf/JSON field mapping.
  • github.com/fatih/color v1.18.0 — Terminal color output for CLI tools.
  • github.com/olekukonko/tablewriter v0.0.5 — Table-formatted CLI output.
  • github.com/maruel/panicparse/v2 v2.4.0 — Panic stack trace parsing; useful for crash analysis tooling.
  • gopkg.in/validator.v2 v2.0.1 — Struct validation via field tags.

Networking/RPC#

  • google.golang.org/grpc v1.79.3 — Core gRPC framework; the entire inter-service communication is gRPC. Arguably the most critical transitive dependency.
  • github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 — Bridges gRPC services to HTTP/JSON; used by the Frontend service to expose a REST-compatible API.
  • github.com/gorilla/mux v1.8.1 — HTTP router for non-gRPC HTTP endpoints (health checks, admin, metrics).
  • github.com/temporalio/ringpop-go — Temporal-maintained fork of Uber’s Ringpop; provides gossip-based membership and consistent hashing for shard routing between History/Matching nodes.
  • github.com/temporalio/tchannel-go — TChannel RPC protocol (Uber legacy); still present as ringpop’s transport layer, despite gRPC being the primary RPC.
  • github.com/nexus-rpc/sdk-go v0.5.2-... — Nexus RPC protocol SDK; the cutting-edge addition enabling cross-namespace and cross-cluster workflow composition. Pre-release pinned version indicates active co-development.
  • github.com/sony/gobreaker v1.0.0 — Circuit breaker implementation for protecting downstream dependencies.
  • golang.org/x/oauth2 v0.34.0 — OAuth2 client for Cloud provider auth (GCS, Google APIs).
  • golang.org/x/sync v0.19.0 — errgroup, semaphore, singleflight from the Go extended standard library.

Data/Storage#

  • github.com/gocql/gocql v1.7.0 — Cassandra driver; the original/primary persistence backend (Cadence heritage).
  • github.com/jackc/pgx/v5 v5.7.2 — PostgreSQL driver (modern, high-performance); used alongside lib/pq.
  • github.com/lib/pq v1.10.9 — Legacy PostgreSQL driver; still needed for database/sql compatibility paths.
  • github.com/go-sql-driver/mysql v1.9.0 — MySQL driver for MySQL/TiDB persistence support.
  • github.com/jmoiron/sqlx v1.4.0 — SQL extension library; convenience layer over database/sql for struct scanning.
  • modernc.org/sqlite v1.44.3 — Pure-Go SQLite driver (no CGo); enables local development and testing without an external database.
  • github.com/olivere/elastic/v7 v7.0.32 — Elasticsearch client for the visibility (workflow search) subsystem.
  • github.com/temporalio/sqlparser v0.0.0-... — Temporal-maintained SQL parser for translating workflow visibility queries into SQL/Elasticsearch DSL.
  • github.com/emirpasic/gods v1.18.1 — Generic data structures (trees, sets, lists); used for internal scheduling/timer data structures.
  • github.com/tidwall/btree v1.8.1 — B-tree implementation; used for in-memory ordered storage.
  • github.com/dgryski/go-farm v0.0.0-... — FarmHash; fast non-cryptographic hashing for shard key computation.
  • github.com/robfig/cron/v3 v3.0.1 — Cron expression parsing for the Scheduler workflow feature.
  • google.golang.org/protobuf v1.36.10 — Protocol Buffers runtime; all API types are protobuf-generated.
  • go.temporal.io/api v1.62.6-... — Temporal’s own API protobuf definitions; direct dependency (pinned pre-release indicates tight co-development cycle).

Observability / Telemetry#

  • go.opentelemetry.io/otel v1.40.0 (+ 8 sub-packages) — Full OpenTelemetry suite: traces, metrics, OTLP exporters, Prometheus bridge, OTel gRPC instrumentation. Temporal went all-in on OTel.
  • go.opentelemetry.io/collector/pdata v1.34.0 — OTel Collector pipeline data types; used for receiving/forwarding telemetry.
  • github.com/prometheus/client_golang v1.21.0 — Prometheus metrics scrape endpoint; exposed alongside OTel Prometheus exporter.
  • github.com/prometheus/client_model v0.6.2 and github.com/prometheus/common v0.62.0 — Supporting Prometheus libraries.
  • github.com/uber-go/tally/v4 v4.1.17 — Uber’s metrics abstraction (pre-OTel); still present, likely for backward compatibility with existing metrics emission paths.
  • github.com/cactus/go-statsd-client/v5 v5.1.0 — StatsD metrics sink; one of the tally backends.

Security / Auth#

  • github.com/go-jose/go-jose/v4 v4.1.3 — JOSE standard (JWE/JWS/JWK); used for JWT signing/verification and key management in the authorization plugin system.
  • github.com/golang-jwt/jwt/v4 v4.5.2 — JWT parsing/validation.
  • github.com/spiffe/go-spiffe/v2 v2.6.0 (indirect) — SPIFFE/SPIRE workload identity; for mTLS in service mesh deployments.

Cloud / External services#

  • cloud.google.com/go/storage v1.51.0 — GCS client for workflow history archival to Google Cloud Storage.
  • github.com/aws/aws-sdk-go v1.55.8 — AWS SDK v1 for S3 archival support.
  • google.golang.org/api v0.224.0 — Google API client library (OAuth2, GCS).

Testing#

  • github.com/stretchr/testify v1.11.1 — Primary assertion library; near-universal in the test suite.
  • go.uber.org/mock v0.6.0 — Uber’s fork of gomock; used for generating interface mocks.
  • github.com/google/go-cmp v0.7.0 — Deep equality comparison; used in tests requiring proto-aware comparison.
  • github.com/go-faker/faker/v4 v4.6.0 — Fake data generation for property-based-style tests.
  • github.com/jstemmer/go-junit-report/v2 v2.1.0 — JUnit XML output for CI test reporting.
  • go.temporal.io/sdk v1.38.0 — Temporal’s own Go SDK; used to write workflow/activity logic in the internal service/worker/ and temporaltest/ packages. The server depends on its own SDK to implement internal workflows (scheduler, archival, etc.).

Stdlib reliance#

High. The service/ directory alone shows 1,340+ stdlib import lines (context, sync, fmt, time, io, net, os, errors, strings, bytes). The project makes heavy use of:

  • context — pervasive cancellation and deadline propagation (distributed system staple)
  • sync — Mutex, RWMutex, WaitGroup, Once throughout
  • time — timers, deadlines, retention periods
  • database/sql — abstraction layer over MySQL/Postgres/SQLite drivers
  • net/http — HTTP server for health and admin endpoints

Despite heavy third-party dependencies, the core business logic relies on stdlib primitives for correctness guarantees; third-party deps are mostly transport/storage/observability layers.

Shared dependencies#

Dependencies Temporal shares with many other projects in the 50-project set, creating natural cross-reference points for the book:

  • google.golang.org/grpc — ubiquitous across gRPC-native projects (Consul, Vault, etcd, k3s, Istio)
  • go.uber.org/zap — extremely common structured logger (Consul, Vault, CockroachDB, etc.)
  • github.com/prometheus/client_golang — de-facto standard for metrics in cloud-native Go
  • go.opentelemetry.io/otel — rapidly becoming universal telemetry standard
  • github.com/stretchr/testify — nearly universal test assertion library
  • gopkg.in/yaml.v3 — dominant YAML parser
  • github.com/google/uuid — ubiquitous UUID generation
  • golang.org/x/sync — extended concurrency primitives used widely

Vendoring#

Not vendored. Uses Go module proxy (GOPROXY) directly. For a project of this scale and production criticality, this is notable — many enterprise Go projects vendor to ensure reproducible builds without network dependencies. Temporal relies on module checksums (go.sum) and likely a module proxy mirror in CI for reproducibility.

Notable dependency decisions#

  1. Self-dependency (server → SDK): Temporal’s server directly imports go.temporal.io/sdk to implement internal workflows (archival, scheduler, DLQ processing). This means the production server is a Temporal worker running on itself — a powerful dogfooding decision that validates the SDK in the most demanding environment.

  2. Two versions of urfave/cli simultaneously: Both v1 and v2 of the CLI framework are direct dependencies. This is a migration artifact: the tchannel-era tooling used v1, while newer tooling targets v2. It signals incomplete but ongoing modernization.

  3. Four database drivers in one binary: Cassandra (gocql), PostgreSQL (pgx + lib/pq), MySQL (go-sql-driver), and SQLite (modernc) are all direct dependencies. The compiled binary includes all drivers; runtime selection is configuration-driven. This is a deliberate portability-over-binary-size tradeoff.

  4. Dual telemetry systems (tally + OTel): uber-go/tally (legacy, Uber-era metrics abstraction) coexists with the full OpenTelemetry stack. Tally provides backward compatibility for existing metric names and StatsD/Prometheus sinks; OTel is the forward-looking standard. The overlap means some metrics are emitted twice.

  5. Pre-release pinning: Both go.temporal.io/api and github.com/nexus-rpc/sdk-go use pre-release pseudo-versions, indicating tight coupling to unreleased API changes. This is intentional for coordinated protocol evolution but creates release coordination risk.

  6. Pure-Go SQLite (modernc.org/sqlite): Choosing the CGo-free SQLite implementation (over mattn/go-sqlite3) enables cross-compilation and simpler CI — critical for a project with Docker-based local dev environments (docker-compose for single-node Temporal).

  7. No Viper, no Cobra: Despite being a large CLI application, Temporal uses urfave/cli rather than the ubiquitous Cobra/Viper combo found in most Kubernetes-ecosystem projects. This reflects its Uber heritage (Cadence also used tchannel + urfave/cli) and is one of its most visible departures from CNCF-standard tooling.

Backward Temporal — Structure Temporal — Architecture Forward