Dependencies

A high-level look at what etcd builds on. The source of truth is bill-of-materials.json (regenerated by make verify-bom/make fix-bom); this page summarizes the most important ones.

Runtime (server)

Module	Used for
go.etcd.io/raft/v3	The Raft library; this repo only contains the integration layer
go.etcd.io/bbolt	Embedded B+tree key-value store under MVCC
go.uber.org/zap	Structured logging
google.golang.org/grpc	gRPC server + client
google.golang.org/grpc/health/grpc_health_v1	gRPC health probe
google.golang.org/protobuf	Protobuf runtime
github.com/grpc-ecosystem/grpc-gateway/v2	REST/JSON gateway
go.opentelemetry.io/otel (and its OTLP exporter)	Distributed tracing
github.com/prometheus/client_golang	Metrics
golang.org/x/crypto/bcrypt	Password hashing
github.com/golang-jwt/jwt/v4	JWT auth tokens
github.com/coreos/go-semver	Cluster version comparisons
github.com/spf13/cobra, pflag	CLI scaffolding (etcdctl/etcdutl)
github.com/dustin/go-humanize	Human-readable byte / time formatting
gopkg.in/natefinch/lumberjack.v2	Log file rotation
sigs.k8s.io/yaml	YAML parsing for config files
github.com/soheilhy/cmux	Connection multiplexing on a single port
github.com/jonboulle/clockwork	Time abstractions for tests
github.com/xiang90/probing	Peer-to-peer health probing in rafthttp
golang.org/x/time/rate	Token-bucket rate limiting

Testing

Module	Used for
github.com/stretchr/testify	Asserts
go.uber.org/goleak	Goroutine leak detection
golang.org/x/tools/cmd/stress	Recommended for reproducing flakes
github.com/anishathalye/porcupine (vendored under tests/robustness/validate/)	Linearizability checker
github.com/etcd-io/gofail	Compile-time failpoints

Build / tools

Pinned in tools/mod/go.mod:

Tool	Source
protoc-gen-go, protoc-gen-go-grpc	Protobuf code generation
protoc-gen-grpc-gateway, protoc-gen-openapiv2	REST gateway + OpenAPI
gofail	Compile-in failpoints
golangci-lint	Linting (installed via scripts/verify_golangci-lint_version.sh)
protoc 3.20.3	Pinned via CONTRIBUTING.md; downloaded by scripts/genproto.sh

License management

bill-of-materials.json is the canonical license inventory. bill-of-materials.override.json records hand-chosen licenses for modules whose own LICENSE files are ambiguous. make verify-bom enforces that both files match the resolved Go module graph.

Dependency policies

• gomodguard (server/.gomodguard.yaml, client/v3/.gomodguard.yaml, ...) restricts which modules can import which. New cross-module edges require a config update.
• Govuln (make run-govulncheck) checks for known vulnerable dependencies.
• Dependabot opens PRs for outdated modules; the project keeps Go and gRPC versions reasonably current.

Cross-references

• how-to-contribute/tooling — how the build / lint / verify scripts use these dependencies.
• security — supply-chain concerns.