Dependencies

The full list lives in go.mod. The Go module path is github.com/cli/cli/v2. Go toolchain pinned via go 1.26.0 and toolchain go1.26.2. Below are the direct dependencies grouped by purpose.

Core CLI framework

Module	Why
github.com/spf13/cobra	Command tree.
github.com/spf13/pflag	Flag parsing.
github.com/MakeNowJust/heredoc	Multi-line literal help text.
github.com/google/shlex	Splits alias values that contain shell-style arguments.

GitHub API and auth

Module	Why
github.com/cli/go-gh/v2	The shared low-level GitHub client (REST + GraphQL + auth + config helpers).
github.com/cli/oauth	OAuth device flow client.
github.com/cli/safeexec	Locating git, ssh, and external editors safely.
github.com/cli/go-internal	Internal shared utilities released by the team.
github.com/shurcooL/githubv4	GraphQL struct-driven queries.
github.com/cli/shurcooL-graphql	GraphQL request transport (transitive but used by api).
github.com/zalando/go-keyring	OS keyring access.

Terminal, color, and TUIs

Module	Why
github.com/mattn/go-colorable / mattn/go-isatty	Terminal capability detection.
github.com/mgutz/ansi	Legacy ANSI helpers.
github.com/AlecAivazis/survey/v2	Older interactive prompts.
github.com/briandowns/spinner	Progress spinner.
charm.land/bubbletea/v2 / charm.land/bubbles/v2 / charm.land/lipgloss/v2 / charm.land/huh/v2	Newer Bubble Tea-based menus.
github.com/charmbracelet/glamour / lipgloss / colorprofile	Markdown rendering.
github.com/rivo/tview / github.com/gdamore/tcell/v2	Used by gh extension browse.
github.com/yuin/goldmark	Markdown parser.
github.com/atotto/clipboard	Clipboard support.
github.com/creack/pty	Pty allocation for codespace ssh.

Codespaces

Module	Why
github.com/microsoft/dev-tunnels	Dev Tunnels client used by gh codespace.
github.com/gorilla/websocket	Underlying transport.
github.com/opentracing/opentracing-go	Tracing spans for tunnel ops.
github.com/twitchtv/twirp	Used by Codespaces and telemetry RPC.
google.golang.org/grpc / protobuf	gRPC for telemetry.
github.com/kballard/go-shellquote	Shell-quote args for remote shells.

Sigstore + attestation

Module	Why
github.com/sigstore/sigstore-go	Attestation verifier.
github.com/sigstore/sigstore / protobuf-specs / rekor / rekor-tiles/v2 / timestamp-authority/v2	Sigstore stack.
github.com/theupdateframework/go-tuf/v2	TUF root validation.
github.com/in-toto/attestation	In-toto statement parsing.
github.com/digitorus/timestamp / digitorus/pkcs7	Timestamp authority parsing.
github.com/google/go-containerregistry	OCI artifact loading.

Test, mock, and utility

Module	Why
github.com/stretchr/testify	Assertions.
github.com/google/go-cmp	Deep diffs in tests.
gopkg.in/h2non/gock.v1	HTTP mocking in some packages (alongside pkg/httpmock).
github.com/Netflix/go-expect / github.com/hinshun/vt10x	Pseudo-terminal-based interactive tests.
github.com/henvic/httpretty	GH_DEBUG=api request/response logging.
github.com/cenkalti/backoff/v4 and v5	Retry helpers.
github.com/google/uuid	UUID generation.
github.com/itchyny/gojq	jq for --jq.
github.com/joho/godotenv	.env parsing.
github.com/muhammadmuzzammil1998/jsonc	JSONC parser (devcontainer config).
github.com/cpuguy83/go-md2man/v2	Manpage generation.
github.com/gabriel-vasile/mimetype	Asset MIME-type detection.
github.com/distribution/reference	Container reference parsing.
github.com/klauspost/compress	Faster compression for artifact downloads.
github.com/vmihailenco/msgpack/v5	Telemetry payload encoding.

Crypto and OS

Module	Why
golang.org/x/crypto	NaCl box for secret encryption, age decryption.
golang.org/x/sync	Cancellable goroutine groups.
golang.org/x/sys / term	Terminal window size.
golang.org/x/text	Width-aware text rendering.

Vendoring policy

The CLI does not vendor (vendor/ is absent). License attributions are regenerated from go.sum by script/licenses and persisted under internal/licenses/ so they can be embedded in the binary and printed by gh licenses.