Dependencies

Selected third-party libraries Argo CD depends on, drawn from go.mod and ui/package.json.

Go (go.mod)

The full list is large (go.mod is ~18 KB). Highlights:

Library	Why
github.com/argoproj/argo-cd/gitops-engine	Diff/sync/health primitives. Argo CD vendors a snapshot under gitops-engine/.
github.com/argoproj/notifications-engine	The notifications service registry and trigger/template engine.
github.com/argoproj/pkg/v2	Shared utilities (stats, time, etc.).
github.com/spf13/cobra	All command-line UIs.
github.com/sirupsen/logrus	Logging.
github.com/redis/go-redis/v9	Redis client.
github.com/casbin/casbin/v2 + github.com/casbin/govaluate	RBAC engine.
github.com/coreos/go-oidc/v3 + github.com/go-jose/go-jose/v4	OIDC + JWT.
k8s.io/client-go, k8s.io/apimachinery, sigs.k8s.io/controller-runtime	Kubernetes interaction.
github.com/go-git/go-git/v5	In-process Git library.
code.gitea.io/sdk/gitea, github.com/google/go-github/..., github.com/xanzy/go-gitlab, github.com/gfleury/go-bitbucket-v1, github.com/ktrysmt/go-bitbucket	SCM provider clients used by ApplicationSet generators.
github.com/aws/aws-sdk-go-v2	CodeCommit + STS for AWS-hosted repos and EKS auth.
github.com/Azure/azure-sdk-for-go/sdk/azidentity + github.com/Azure/kubelogin	Azure auth (AKS, Azure DevOps).
github.com/bradleyfalzon/ghinstallation/v2	GitHub App auth.
github.com/dlclark/regexp2, github.com/expr-lang/expr	RE2-incompatible regexes (e.g., for diff suppressions) and the expression engine for notifications.
github.com/Masterminds/sprig/v3, github.com/Masterminds/semver/v3	Templating helpers used in ApplicationSet templates and Helm.
github.com/cyphar/filepath-securejoin	Safe path joining (used widely in util/security/).
github.com/alicebob/miniredis/v2	In-process Redis for tests.
github.com/bombsimon/logrusr/v4	logrus → logr adapter so klog can pipe through.
gopkg.in/yaml.v3, sigs.k8s.io/yaml, github.com/evanphx/json-patch, dario.cat/mergo	YAML/JSON tooling used throughout.
helm.sh/helm/v3 (transitive)	Helm primitives — invoked through util/helm/cmd.go for shelling out, but the Go API is also used in places.
github.com/cenkalti/backoff/v5	Retry/backoff utility.
github.com/cespare/xxhash/v2	Cheap hashes for cache keys.

UI (ui/package.json)

The UI is React 16/17-era, currently maintained against a pinned set of libraries. Highlights (from ui/package.json and ui/pnpm-lock.yaml):

• react, react-dom, react-router-dom.
• argo-ui (component library shared with the rest of the Argo project).
• rxjs for streaming UI state.
• monaco-editor for the in-UI YAML/JSON editor.
• dagre, @zoom/lightbox, react-form and other helpers.
• webpack, babel, typescript, jest, prettier, eslint for build/test/lint.
• pnpm is the package manager; pnpm-lock.yaml is checked in.

Vendored sub-trees

Two non-go.mod sub-trees live in the repo:

• gitops-engine/ — a snapshot of the upstream Argo gitops-engine library, brought in so the controller and engine can ship in lockstep.
• notifications_catalog/ — pre-baked notification triggers/templates shipped as a built-in catalog ConfigMap.

Renovate / dependabot

renovate.json and the bots open continuous chore(deps): bump … PRs. The repo scopes bump groups (e.g., aws-sdk-v2 group) and pinned-version comments in go.mod (// DO NOT BUMP UNTIL ...) constrain what may move.

Snyk and CodeQL

hack/snyk-*.sh produce SARIF reports for docs/snyk/. .github/workflows/codeql.yml runs CodeQL on every push.