# What Are the Gitea Modules Dependencies? A Complete Guide to go.mod

> Explore Gitea modules dependencies managed by go.mod. Understand direct, third party, and indirect dependencies in this complete guide.

- Repository: [Gitea/gitea](https://github.com/go-gitea/gitea)
- Tags: deep-dive
- Published: 2026-03-07

---

**Gitea manages all module dependencies through the standard `go.mod` file located at the repository root, which categorizes dependencies into direct Gitea-specific modules, primary third-party libraries, and indirect transitive dependencies.**

The `go-gitea/gitea` repository relies on Go’s native module system to declare and version its extensive dependency tree. By examining the `go.mod` manifest, developers can understand exactly which external libraries power Gitea’s web server, database layer, authentication systems, and CI/CD integrations.

## Understanding the Gitea go.mod Structure

The `go.mod` file in the Gitea repository root serves as the single source of truth for dependency management. As implemented in `go-gitea/gitea`, this manifest organizes dependencies into three distinct logical sections that span from line 10 through line 284.

### Direct Gitea-Specific Modules

These are the core building blocks maintained by the Gitea project itself. Located primarily between lines 10 and 18 of `go.mod`, these modules provide Gitea’s own APIs, SDKs, and low-level utilities:

- **`code.gitea.io/actions-proto-go`** v0.4.1 – Protocol buffer definitions for Actions
- **`code.gitea.io/sdk/gitea`** v0.23.2 – The official Go SDK for interacting with Gitea instances
- **`gitea.com/go-chi/binding`** – Request binding utilities
- **`gitea.com/go-chi/cache`** – Caching middleware
- **`gitea.com/go-chi/captcha`** – CAPTCHA generation and validation
- **`gitea.com/go-chi/session`** – Session management middleware

### Primary Third-Party Libraries

This section (lines 24-94) contains widely-used Go packages that implement common functionality such as HTTP routing, database access, and authentication. These **direct dependencies** power Gitea’s core features:

- **Web Framework**: `github.com/go-chi/chi/v5` and `github.com/go-chi/cors` for HTTP routing and cross-origin resource sharing
- **Database Drivers**: `github.com/go-sql-driver/mysql`, `github.com/lib/pq`, and `github.com/mattn/go-sqlite3` for MySQL, PostgreSQL, and SQLite support
- **ORM**: `github.com/xorm/xorm` for database abstraction and query building
- **Caching**: `github.com/go-redsync/redsync/v4` for distributed locks
- **Authentication**: `github.com/go-webauthn/webauthn`, `github.com/markbates/goth`, and `github.com/gorilla/securecookie`
- **Observability**: `github.com/sirupsen/logrus` for structured logging and `github.com/prometheus/client_golang` for metrics
- **Utilities**: `github.com/google/uuid`, `github.com/gorilla/feeds`, `github.com/microcosm-cc/bluemonday`, and `github.com/blevesearch/bleve/v2` for search functionality

### Indirect Transitive Dependencies

Starting at line 31 and continuing through line 284, the second `require` block lists **indirect dependencies** pulled in automatically by the direct modules. These include SDK helpers for cloud providers (`github.com/azure/azure-sdk-for-go/sdk/azcore`, `cloud.google.com/go/compute/metadata`), protocol buffers, Docker client libraries, and `google.golang.org/grpc`.

## Key Dependencies in the Gitea Ecosystem

Gitea’s architecture relies on specific high-impact libraries to handle critical subsystems. Here is how the source code consumes these dependencies in practice.

### Web Framework and Routing with Chi

The `github.com/go-chi/chi/v5` package serves as Gitea’s primary HTTP router and middleware stack. In [`cmd/web.go`](https://github.com/go-gitea/gitea/blob/main/cmd/web.go), the application wires together routing, CORS handling, and session management using these dependencies.

```go
import (
    "github.com/go-chi/chi/v5"
    "github.com/go-chi/cors"
)

func router() http.Handler {
    r := chi.NewRouter()
    r.Use(cors.AllowAll().Handler)
    r.Get("/ping", func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("pong"))
    })
    return r
}

```

This pattern appears throughout the codebase to define API endpoints and web routes.

### Database Access with XORM

Gitea uses `xorm.io/xorm` as its primary ORM, combined with specific database drivers declared in `go.mod`. The [`models/repo.go`](https://github.com/go-gitea/gitea/blob/main/models/repo.go) file demonstrates how Gitea initializes database engines using these dependencies.

```go
import (
    "xorm.io/xorm"
    _ "github.com/go-sql-driver/mysql"
)

func initEngine() (*xorm.Engine, error) {
    return xorm.NewEngine("mysql", "user:pwd@/gitea?charset=utf8")
}

```

The `go.mod` file explicitly pins `xorm.io/xorm` at line 128, ensuring consistent query behavior across MySQL, PostgreSQL, and SQLite backends.

### Authentication and Security Libraries

The [`modules/auth/auth.go`](https://github.com/go-gitea/gitea/blob/main/modules/auth/auth.go) file integrates multiple authentication providers through dependencies like `github.com/markbates/goth` for OAuth and `github.com/go-webauthn/webauthn` for passwordless authentication. These libraries appear in the direct dependencies section (lines 24-94) and are critical for Gitea’s multi-source identity management.

### Gitea SDK Integration

For programmatic interaction with Gitea instances, the codebase imports its own SDK:

```go
import (
    "code.gitea.io/sdk/gitea"
)

func listRepos(client *gitea.Client) ([]*gitea.Repository, error) {
    return client.ListMyRepos()
}

```

This dependency is declared at line 12 of `go.mod` as `code.gitea.io/sdk/gitea` v0.23.2.

## How to Inspect Gitea Dependencies Locally

To view the complete dependency tree for any version of Gitea:

1. Clone the repository: `git clone https://github.com/go-gitea/gitea.git`
2. Navigate to the root directory and open `go.mod`
3. Run `go list -m all` to see the resolved versions of all transitive dependencies
4. Use `go mod graph` to visualize the dependency relationships between modules

Each line in `go.mod` follows the pattern `<module> <version>`, with indirect dependencies explicitly marked with the `// indirect` comment suffix.

## Summary

- **Central Manifest**: All Gitea modules dependencies are declared in the root `go.mod` file, which spans approximately 284 lines on the main branch.
- **Three-Tier Structure**: Dependencies are categorized as direct Gitea-specific modules (lines 10-18), primary third-party libraries (lines 24-94), and indirect transitive dependencies (lines 31-284).
- **Core Technologies**: The application relies on **Chi** for routing, **XORM** for database operations, and specialized libraries like **WebAuthn** and **Goth** for authentication.
- **Version Pinning**: Every dependency is explicitly versioned to ensure reproducible builds across different Gitea installations.
- **Import Patterns**: Key files like [`cmd/web.go`](https://github.com/go-gitea/gitea/blob/main/cmd/web.go), [`modules/auth/auth.go`](https://github.com/go-gitea/gitea/blob/main/modules/auth/auth.go), and [`models/repo.go`](https://github.com/go-gitea/gitea/blob/main/models/repo.go) demonstrate how these dependencies are integrated into the application logic.

## Frequently Asked Questions

### Where is the go.mod file located in the Gitea repository?

The `go.mod` file is located at the repository root (`go.mod`) on the main branch of `go-gitea/gitea`. This file contains all direct and indirect dependency declarations required to build the application.

### How does Gitea handle database driver dependencies?

Gitea declares specific database drivers (`github.com/go-sql-driver/mysql`, `github.com/lib/pq`, `github.com/mattn/go-sqlite3`) as direct dependencies in `go.mod`, then imports them with blank identifiers in database initialization code to register the drivers with Go’s `database/sql` package, as seen in [`models/repo.go`](https://github.com/go-gitea/gitea/blob/main/models/repo.go).

### What is the difference between direct and indirect dependencies in Gitea’s go.mod?

**Direct dependencies** are explicitly imported by Gitea’s source code and include libraries like Chi, XORM, and the Gitea SDK. **Indirect dependencies** are pulled in automatically by direct dependencies to satisfy their own requirements, such as cloud provider SDKs and protocol buffer libraries, and are marked with `// indirect` in the manifest.

### Can I use the Gitea SDK independently of the main application?

Yes. The `code.gitea.io/sdk/gitea` module is maintained as a separate dependency (declared at line 12 of `go.mod`) and can be imported into any Go project to programmatically interact with Gitea instances via their REST API.