What Are the Gitea Modules Dependencies? A Complete Guide to go.mod

Gitea manages all module dependencies through the standard go.mod file located at the repository root, which categorizes dependencies into direct Gitea-specific modules, primary third-party libraries, and indirect transitive dependencies.

The go-gitea/gitea repository relies on Go’s native module system to declare and version its extensive dependency tree. By examining the go.mod manifest, developers can understand exactly which external libraries power Gitea’s web server, database layer, authentication systems, and CI/CD integrations.

Understanding the Gitea go.mod Structure

The go.mod file in the Gitea repository root serves as the single source of truth for dependency management. As implemented in go-gitea/gitea, this manifest organizes dependencies into three distinct logical sections that span from line 10 through line 284.

Direct Gitea-Specific Modules

These are the core building blocks maintained by the Gitea project itself. Located primarily between lines 10 and 18 of go.mod, these modules provide Gitea’s own APIs, SDKs, and low-level utilities:

• code.gitea.io/actions-proto-go v0.4.1 – Protocol buffer definitions for Actions
• code.gitea.io/sdk/gitea v0.23.2 – The official Go SDK for interacting with Gitea instances
• gitea.com/go-chi/binding – Request binding utilities
• gitea.com/go-chi/cache – Caching middleware
• gitea.com/go-chi/captcha – CAPTCHA generation and validation
• gitea.com/go-chi/session – Session management middleware

Primary Third-Party Libraries

This section (lines 24-94) contains widely-used Go packages that implement common functionality such as HTTP routing, database access, and authentication. These direct dependencies power Gitea’s core features:

• Web Framework: github.com/go-chi/chi/v5 and github.com/go-chi/cors for HTTP routing and cross-origin resource sharing
• Database Drivers: github.com/go-sql-driver/mysql, github.com/lib/pq, and github.com/mattn/go-sqlite3 for MySQL, PostgreSQL, and SQLite support
• ORM: github.com/xorm/xorm for database abstraction and query building
• Caching: github.com/go-redsync/redsync/v4 for distributed locks
• Authentication: github.com/go-webauthn/webauthn, github.com/markbates/goth, and github.com/gorilla/securecookie
• Observability: github.com/sirupsen/logrus for structured logging and github.com/prometheus/client_golang for metrics
• Utilities: github.com/google/uuid, github.com/gorilla/feeds, github.com/microcosm-cc/bluemonday, and github.com/blevesearch/bleve/v2 for search functionality

Indirect Transitive Dependencies

Starting at line 31 and continuing through line 284, the second require block lists indirect dependencies pulled in automatically by the direct modules. These include SDK helpers for cloud providers (github.com/azure/azure-sdk-for-go/sdk/azcore, cloud.google.com/go/compute/metadata), protocol buffers, Docker client libraries, and google.golang.org/grpc.

Key Dependencies in the Gitea Ecosystem

Gitea’s architecture relies on specific high-impact libraries to handle critical subsystems. Here is how the source code consumes these dependencies in practice.

Web Framework and Routing with Chi

The github.com/go-chi/chi/v5 package serves as Gitea’s primary HTTP router and middleware stack. In cmd/web.go, the application wires together routing, CORS handling, and session management using these dependencies.

import (
    "github.com/go-chi/chi/v5"
    "github.com/go-chi/cors"
)

func router() http.Handler {
    r := chi.NewRouter()
    r.Use(cors.AllowAll().Handler)
    r.Get("/ping", func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("pong"))
    })
    return r
}

This pattern appears throughout the codebase to define API endpoints and web routes.

Database Access with XORM

Gitea uses xorm.io/xorm as its primary ORM, combined with specific database drivers declared in go.mod. The models/repo.go file demonstrates how Gitea initializes database engines using these dependencies.

import (
    "xorm.io/xorm"
    _ "github.com/go-sql-driver/mysql"
)

func initEngine() (*xorm.Engine, error) {
    return xorm.NewEngine("mysql", "user:pwd@/gitea?charset=utf8")
}

The go.mod file explicitly pins xorm.io/xorm at line 128, ensuring consistent query behavior across MySQL, PostgreSQL, and SQLite backends.

Authentication and Security Libraries

The modules/auth/auth.go file integrates multiple authentication providers through dependencies like github.com/markbates/goth for OAuth and github.com/go-webauthn/webauthn for passwordless authentication. These libraries appear in the direct dependencies section (lines 24-94) and are critical for Gitea’s multi-source identity management.

Gitea SDK Integration

For programmatic interaction with Gitea instances, the codebase imports its own SDK:

import (
    "code.gitea.io/sdk/gitea"
)

func listRepos(client *gitea.Client) ([]*gitea.Repository, error) {
    return client.ListMyRepos()
}

This dependency is declared at line 12 of go.mod as code.gitea.io/sdk/gitea v0.23.2.

How to Inspect Gitea Dependencies Locally

To view the complete dependency tree for any version of Gitea:

1. Clone the repository: git clone https://github.com/go-gitea/gitea.git
2. Navigate to the root directory and open go.mod
3. Run go list -m all to see the resolved versions of all transitive dependencies
4. Use go mod graph to visualize the dependency relationships between modules

Each line in go.mod follows the pattern <module> <version>, with indirect dependencies explicitly marked with the // indirect comment suffix.

Summary

• Central Manifest: All Gitea modules dependencies are declared in the root go.mod file, which spans approximately 284 lines on the main branch.
• Three-Tier Structure: Dependencies are categorized as direct Gitea-specific modules (lines 10-18), primary third-party libraries (lines 24-94), and indirect transitive dependencies (lines 31-284).
• Core Technologies: The application relies on Chi for routing, XORM for database operations, and specialized libraries like WebAuthn and Goth for authentication.
• Version Pinning: Every dependency is explicitly versioned to ensure reproducible builds across different Gitea installations.
• Import Patterns: Key files like cmd/web.go, modules/auth/auth.go, and models/repo.go demonstrate how these dependencies are integrated into the application logic.

Frequently Asked Questions

Where is the go.mod file located in the Gitea repository?

The go.mod file is located at the repository root (go.mod) on the main branch of go-gitea/gitea. This file contains all direct and indirect dependency declarations required to build the application.

How does Gitea handle database driver dependencies?

Gitea declares specific database drivers (github.com/go-sql-driver/mysql, github.com/lib/pq, github.com/mattn/go-sqlite3) as direct dependencies in go.mod, then imports them with blank identifiers in database initialization code to register the drivers with Go’s database/sql package, as seen in models/repo.go.

What is the difference between direct and indirect dependencies in Gitea’s go.mod?

Direct dependencies are explicitly imported by Gitea’s source code and include libraries like Chi, XORM, and the Gitea SDK. Indirect dependencies are pulled in automatically by direct dependencies to satisfy their own requirements, such as cloud provider SDKs and protocol buffer libraries, and are marked with // indirect in the manifest.

Can I use the Gitea SDK independently of the main application?

Yes. The code.gitea.io/sdk/gitea module is maintained as a separate dependency (declared at line 12 of go.mod) and can be imported into any Go project to programmatically interact with Gitea instances via their REST API.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}