Dependencies

The Go repository has very few external dependencies. Two go.mod files exist:

• src/go.mod — for the standard library (module std).
• src/cmd/go.mod — for the toolchain commands under src/cmd/... (module cmd).

Both vendor their dependencies (src/vendor/, src/cmd/vendor/) so the toolchain builds without network access.

Standard library dependencies

src/go.mod declares:

module std

go 1.27

require (
    golang.org/x/crypto v0.50.0
    golang.org/x/net v0.53.1-0.20260420212600-f70faeaf29ed
)

require (
    golang.org/x/sys v0.43.0 // indirect
    golang.org/x/text v0.36.0 // indirect
)

The standard library uses these golang.org/x/... modules to:

• golang.org/x/crypto — supply some packages re-exported via crypto/... and FIPS-140 helpers, plus algorithms not in the public library yet.
• golang.org/x/net — the source of truth for HTTP/2 (under net/http/internal/http2/), HPACK, and a few other protocol pieces.
• golang.org/x/sys — low-level OS/arch support that's too volatile to live in syscall (which is frozen). Used indirectly.
• golang.org/x/text — Unicode tables and BiDi/IDNA support. Used indirectly.

Vendored copies live at src/vendor/golang.org/.... A src/vendor/modules.txt tracks versions.

The vendoring direction is deliberate: many of these golang.org/x/... packages started in the standard library, were extracted to golang.org/x/... for faster iteration, then have parts re-vendored back as needed.

Toolchain dependencies

src/cmd/go.mod is richer because the toolchain has more concerns (testing, profiling, build infrastructure):

module cmd

go 1.27

require (
    github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83
    golang.org/x/arch v0.23.1-0.20260109160903-657d90bd6695
    golang.org/x/build v0.0.0-20260122183339-3ba88df37c64
    golang.org/x/mod v0.35.0
    golang.org/x/sync v0.20.0
    golang.org/x/sys v0.43.0
    golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa
    golang.org/x/term v0.39.0
    golang.org/x/tools v0.44.1-0.20260414062052-55fb96ff894f
)

require (
    github.com/ianlancetaylor/demangle v0.0.0-20250417193237-f615e6bd150b // indirect
    golang.org/x/text v0.36.0 // indirect
    rsc.io/markdown v0.0.0-20240306144322-0bf8f97ee8ef // indirect
)

What each is used for:

• github.com/google/pprof — backs cmd/pprof (the in-tree pprof viewer). Forked from upstream pprof.
• golang.org/x/arch — disassembler libraries used by cmd/objdump. One package per architecture.
• golang.org/x/build — shared types/protocols with the build infrastructure. Some packages are imported by the trybot integration in cmd/dist.
• golang.org/x/mod — module-related parsing (go.mod, version comparisons). Imported by cmd/go/internal/modload and friends.
• golang.org/x/sync — errgroup, singleflight, semaphore. Used by various cmd/* packages.
• golang.org/x/sys — same low-level OS support as the std-lib version.
• golang.org/x/telemetry — the Go toolchain's opt-in telemetry library. Counter declarations live in cmd/internal/telemetry/.
• golang.org/x/term — terminal helpers (size, raw mode).
• golang.org/x/tools — large utility set: analysis framework (used by cmd/vet), AST utilities, etc.
• github.com/ianlancetaylor/demangle — C++ name demangling for tools (cmd/objdump).
• rsc.io/markdown — Markdown rendering used by some tooling.

Vendoring discipline

To regenerate the vendored copies:

cd src
go mod tidy
go mod vendor

cd src/cmd
go mod tidy
go mod vendor

src/README.vendor and src/cmd/README.vendor document additional rules (e.g., the toolchain may not import packages that depend on cgo).

Why so few dependencies?

The Go project's ethos is "what we ship, we own." Adding a dependency to the standard library would mean carrying its bug fixes, its security advisories, and its API across every Go release for as long as the language exists. The bar is set very high: each of the modules listed above is maintained by the Go team itself.

Where to read next

• Standard library — what's in vs. out of std.
• Go command — how go mod and the build cache resolve dependencies for user code.
• src/README.vendor, src/cmd/README.vendor — vendoring rules.