Dependencies

The full dependency list is in go.mod. This page lists the direct dependencies and what they're used for.

Core CLI and config

Package	Used by	Purpose
github.com/spf13/cobra	cmd/	CLI framework
github.com/spf13/viper	cmd/, config/	TOML parsing / config resolution
github.com/rs/zerolog	logging/	Structured logging (wrapped by the project's logging/ package)

Detection engine

Package	Used by	Purpose
github.com/BobuSumisu/aho-corasick	detect/, config/	Multi-string matcher used for the keyword prefilter and stopwords
github.com/fatih/semgroup	detect/, sources/	Bounded-concurrency wrapper over errgroup
github.com/gitleaks/go-gitdiff	sources/	Git diff parser. Project-owned fork.
github.com/wasilibs/go-re2	regexp/	Optional WebAssembly RE2 backend (build tag gore2regex)

Sources / archive handling

Package	Used by	Purpose
github.com/mholt/archives	sources/file.go	Archive identification, extraction, decompression for zip / tar / 7z / gzip / bzip2 / xz / lzip / brotli / etc.
github.com/h2non/filetype	sources/file.go	MIME-type detection for binary files (skip non-archive binaries)

Reporting

Package	Used by	Purpose
github.com/Masterminds/sprig/v3	report/template.go	Template function library for --report-format=template (with env, expandenv, getHostByName removed)
github.com/charmbracelet/lipgloss	report/finding.go, detect/utils.go	Terminal color styles for verbose output

Misc

Package	Used by	Purpose
github.com/hashicorp/go-version	config/config.go	Semver comparison for minVersion
github.com/google/go-cmp	tests	Comparison helpers in test code
github.com/stretchr/testify	tests	Assertions in test code
github.com/lucasjones/reggen	tests	Generate strings matching a regex (rule fixture generation)
golang.org/x/exp	various	maps.Keys and other slice/map helpers

Indirect highlights

A few transitive dependencies worth knowing about:

• github.com/STARRY-S/zip, github.com/bodgit/sevenzip, github.com/nwaples/rardecode/v2, github.com/sorairolake/lzip-go, github.com/therootcompany/xz, github.com/ulikunitz/xz, github.com/dsnet/compress, github.com/klauspost/compress, github.com/klauspost/pgzip, github.com/pierrec/lz4/v4, github.com/andybalholm/brotli, github.com/minio/minlz — all pulled in via mholt/archives for individual archive/compression formats.
• github.com/tetratelabs/wazero — the WebAssembly runtime that powers the wasilibs/go-re2 backend.
• github.com/spf13/cast, github.com/spf13/afero, github.com/spf13/pflag — supporting infrastructure for Cobra/Viper.

Versioning

The project pins exact versions in go.mod. Updates are usually done in batched dependency-bump PRs by maintainers. There is no automated Dependabot-driven cadence visible in the workflows; bumps are manual.

The Go toolchain is currently go 1.24.11 per go.mod, with CI running on Go 1.25 (see .github/workflows/test.yml).