Dependencies

Languages, frameworks, and major libraries.

Ruby

• Ruby: 3.3.10 (.tool-versions, .ruby-version).
• Rails: 7.2.x (Gemfile.lock).
• Bundler: 2.x.

Significant gems (selected):

• rails, actionpack, activerecord, activejob.
• puma — application server.
• sidekiq, sidekiq-cron — background processing.
• grape — REST API DSL.
• graphql, graphiql-rails — GraphQL.
• devise, devise-two-factor, omniauth-* — auth.
• doorkeeper — OAuth provider.
• jwt — JWTs.
• pg — Postgres driver.
• redis, connection_pool — Redis.
• gitaly, gitlab/gitaly — gRPC client.
• prometheus-client-mmap — metrics.
• gitlab-labkit — logging/tracing/context.
• oj, multi_json — JSON.
• ruby-saml, omniauth-saml — SAML.
• carrierwave, fog-aws, fog-google, fog-openstack, fog-azure-rm, fog-aliyun — uploads.
• gettext_i18n_rails — i18n extraction.
• rouge — syntax highlighting.
• kramdown, commonmarker, asciidoctor — Markdown / AsciiDoc.
• nokogiri, loofah, sanitize — HTML parsing/sanitization.
• rails-i18n.
• request_store.
• state_machines-activerecord.
• bullet (dev) — N+1 detection.
• factory_bot_rails, rspec-rails (test).
• selenium-webdriver, capybara (test).
• database_cleaner-active_record (test).
• 26 monorepo gems under gems/.

Total ~700 direct + transitive gems.

JavaScript / Frontend

• Node: 22.x (.tool-versions).
• Yarn: classic (yarn.lock). The repo also has pnpm-lock.yaml for the frontend-islands subtree.

Significant packages (selected):

• vue (2 + compat for migration).
• vuex and Pinia (some islands).
• apollo-client, vue-apollo.
• webpack, vite (islands).
• babel-loader, swc-loader.
• @gitlab/ui — design system (Bootstrap-Vue + GitLab tokens).
• @gitlab/svgs — icon set.
• @gitlab/fonts.
• @gitlab/eslint-config, @gitlab/eslint-plugin.
• eslint, prettier, stylelint.
• jest, @testing-library/vue.
• tailwindcss (islands).
• vue-router, vue-i18n.
• bootstrap-vue (legacy).
• monaco-editor and friends.
• mermaid, d3.
• marked, unified, rehype-* (Markdown rendering on the client).
• prosemirror-* (rich text editor).

Go

Used for:

• Workhorse (workhorse/go.mod).
• Backup CLI build helpers.
• Various small tools in scripts/.

Pinned via go.mod per subtree.

Rust

Selected gems compile native extensions in Rust. There's no top-level Rust crate in this repo.

Python

The CI YAML editor and AI Gateway are separate repos. Python is not a runtime dependency of the monolith. Some Python may appear in qa/ for test scaffolding.

CSS / SCSS

• app/assets/stylesheets/ — SCSS.
• Tailwind config in frontend_islands/.
• The legacy CSS engine is sass-rails; new components prefer utility classes.

Database

• PostgreSQL: 16+ (production); 14+ minimum supported.
• Redis: 7+ (multi-instance per role).
• ClickHouse: 24+ (optional; required for some analytics).
• Elasticsearch / OpenSearch: optional, for advanced search.
• Zoekt: optional, for code search.

External services

• Gitaly — separate repo, gRPC.
• GitLab Shell — separate repo, SSH entry point.
• GitLab Pages — separate repo, static site hosting.
• GitLab Workhorse — in this repo (workhorse/).
• KAS — separate repo.
• GitLab Runner — separate repo.
• AI Gateway — separate repo, Python.
• Container Registry — Docker registry fork; separate repo.
• Spamcheck, Suggested Reviewers — separate repos.

Updating dependencies

• Ruby gems: bundle update <gem>. CI runs the full pipeline. Renovate auto-bumps minors weekly.
• Node packages: yarn upgrade <pkg> or pnpm update for islands. Same Renovate flow.
• Major upgrades (Rails, Vue, Webpacker) follow a tracked upgrade plan with feature flags.

Related

• Configuration.
• Deployment.