Dependencies

CockroachDB pins all third-party Go modules in go.mod/go.sum, mirrored into Bazel via DEPS.bzl. The binary statically links a small number of C/C++ libraries described in c-deps/.

Module manifest

Sizes (current go.mod): ~570 lines, ~3,400 lines of go.sum, ~11,750 lines of DEPS.bzl. The manifest is large because of cloud-provider SDKs; trimming it is a project-managed effort.

Module path: github.com/cockroachdb/cockroach. Go version: as pinned by the repo's .go-version (currently 1.26.x).

CockroachDB-owned modules

Crucial libraries written by Cockroach Labs:

Module	Used for
github.com/cockroachdb/pebble	The storage engine
github.com/cockroachdb/errors	Structured, redactable errors
github.com/cockroachdb/redact	Redaction primitives
github.com/cockroachdb/datadriven	Golden-file tests
github.com/cockroachdb/logtags	Context-attached log tags
github.com/cockroachdb/crlib	Misc helpers
github.com/cockroachdb/swiss	Faster maps
github.com/cockroachdb/tokenbucket	Rate-limit primitive
github.com/cockroachdb/cmux	TLS/Pgwire mux
github.com/cockroachdb/apd/v3	Arbitrary-precision decimals
github.com/cockroachdb/version	Semver helpers
github.com/cockroachdb/changefeedpb	CDC wire types
github.com/cockroachdb/cockroach-go/v2	Test driver
github.com/cockroachdb/ttycolor	Terminal colors

Cloud SDKs

• AWS — aws-sdk-go (v1) + aws-sdk-go-v2 for many services (S3, KMS, EC2, RDS, IAM, STS, SSO, Kafka).
• Azure — azure-sdk-for-go and the newer modular SDKs (azcore, azidentity, keyvault, compute, monitor, storage).
• Google Cloud — cloud.google.com/go/... (Storage, KMS, Pub/Sub, monitoring).
• IBM Cloud — IBM/go-sdk-core/v5 and provisioning SDKs (used by roachprod).

Cloud SDK dependencies dominate the dependency graph by raw line count.

Postgres compatibility libraries

• github.com/jackc/pgconn, pgx/v4, pgproto3/v2, pgtype — for client-side tools and tests.
• github.com/lib/pq — used in some legacy paths.

Storage and compression

• github.com/golang/snappy — snappy compression for SSTs.
• github.com/pierrec/lz4/v4 — lz4 used by Pebble and SSTs.
• github.com/klauspost/compress — Pebble and parquet.
• github.com/cespare/xxhash/v2 — hashing.

Observability

• go.opentelemetry.io/otel and exporters — tracing.
• github.com/getsentry/sentry-go — crash reporting.
• github.com/google/pprof — profile parsing.
• github.com/DataDog/datadog-api-client-go/v2 — Datadog uploads.
• github.com/prometheus/client_golang (transitively via OTEL) — metrics.

SQL

• github.com/lib/pq — Postgres types.
• github.com/blevesearch/snowballstem — stemmers for FTS.
• github.com/golang/geo — spherical geometry primitives.
• github.com/twpayne/go-geom — planar geometry.

CLI / TUI

• github.com/spf13/cobra, pflag, viper — CLI framework.
• github.com/charmbracelet/bubbles, bubbletea, lipgloss — TUI for demo.
• github.com/peterh/liner, chzyer/readline — readline-equivalents in tests.

Vendored C/C++ dependencies

c-deps/ contains the C/C++ libraries the binary links statically:

• geos/ — the GEOS spatial library (vendored as a git submodule).
• proj/ — PROJ for spatial reference systems.
• libjemalloc/ — jemalloc allocator (Linux only).
• libedit/ — readline replacement for cockroach sql.

These build via Bazel rules in build/ and require a working C/C++ toolchain.

How dependencies enter the tree

1. go get -u <module> against go.mod.
2. Run ./dev gen go-mod-tidy (regenerates go.sum).
3. Run ./dev gen mirror to vendor into DEPS.bzl for Bazel.
4. Run ./dev gen bazel to update BUILD.bazel files.
5. Submit through the dependency-update process (often via pkg/cmd/mirror).

The repository discourages pulling in new dependencies casually — every addition expands the supply-chain attack surface and CI runtime.

Related pages

• How to contribute / tooling — build, lint, codegen.
• How to contribute / development workflow — module-update procedure.