Dependencies

The third-party landscape. The authoritative source is go.mod and web/ui/mantine-ui/package.json. This page summarises the major direct dependencies and explains why each is in the tree.

Go module facts

• Module path: github.com/prometheus/prometheus
• Go version: 1.25+ (CI runs on quay.io/prometheus/golang-builder:1.26-base)
• Direct dependencies: ~80 (in go.mod require block)
• Sub-modules: 4 (internal/tools, documentation/examples/remote_storage, web/ui/mantine-ui/src/promql/tools, compliance)

Major direct Go dependencies

Module	Purpose
github.com/prometheus/client_golang	Prometheus's own metrics SDK (used by every subsystem).
github.com/prometheus/common	Shared utilities: HTTP client config, model types, slog wrappers.
github.com/prometheus/exporter-toolkit	Web layer (TLS, basic auth, listener helpers).
github.com/prometheus/otlptranslator	OTLP <-> Prometheus translation library.
github.com/prometheus/sigv4	AWS sigv4 signing for remote write.
github.com/oklog/run	The actor model used by cmd/prometheus/main.go.
github.com/oklog/ulid/v2	Block IDs.
github.com/edsrzf/mmap-go	Cross-platform mmap.
github.com/cespare/xxhash/v2	Hash for sharding and fingerprinting.
github.com/grafana/regexp	Faster regex (used in label matchers).
github.com/dennwc/varint	Varint encoding.
github.com/golang/snappy	Snappy compression.
github.com/klauspost/compress	Zstd, gzip, etc.
github.com/gogo/protobuf	Protobuf runtime (legacy code paths).
google.golang.org/protobuf	Modern protobuf runtime.
github.com/json-iterator/go	Fast JSON encoder used by the API codec.
github.com/alecthomas/kingpin/v2	CLI flag parser.
github.com/alecthomas/units	Human duration / size parsing.
github.com/munnerz/goautoneg	Content-Type negotiation.
github.com/mwitkow/go-conntrack	Connection counting.
github.com/felixge/fgprof	Wall-clock profiler.
github.com/google/pprof	pprof helpers.
github.com/google/uuid	UUID generation.
go.uber.org/atomic / go.uber.org/automaxprocs	Atomic primitives + GOMAXPROCS detection.
github.com/KimMachineGun/automemlimit	Cgroup-aware GOMEMLIMIT.
golang.org/x/sync / golang.org/x/text / etc.	Standard extensions.
go.opentelemetry.io/otel/...	OpenTelemetry SDK + OTLP exporter.
gopkg.in/yaml.v2 / go.yaml.in/yaml/v2	YAML encoder/decoder.

Service discovery dependencies

Each SD has its own client library; bringing in ~20 modules from cloud vendors is unavoidable for a single-binary, all-SD release. Notable ones:

• github.com/Azure/azure-sdk-for-go/sdk/... — Azure Resource Manager.
• github.com/aws/aws-sdk-go-v2 and friends — every AWS SD (EC2, ECS, Elasticache, Kafka, Lightsail, RDS, STS).
• k8s.io/client-go, k8s.io/api, k8s.io/apimachinery — Kubernetes.
• github.com/digitalocean/godo, github.com/hetznercloud/hcloud-go, github.com/linode/linodego, github.com/scaleway/scaleway-sdk-go, github.com/vultr/govultr, github.com/ovh/go-ovh, github.com/ionos-cloud/sdk-go — vendor SDKs.
• github.com/hashicorp/consul/api, github.com/hashicorp/nomad/api — Hashicorp.
• github.com/gophercloud/gophercloud/v2 — OpenStack.
• github.com/go-zookeeper/zk — Zookeeper.
• github.com/envoyproxy/go-control-plane/envoy — Envoy xDS.

The 3.10 build-tag rework (#17736) makes it possible to omit specific SD modules from the binary via remove_all_sd + enable_<sd>_sd.

Test dependencies

• github.com/stretchr/testify — assertions for newer tests.
• github.com/google/go-cmp — deep equality with diffs.
• github.com/dustin/go-humanize — pretty-prints in test output.
• github.com/mattn/go-isatty — TTY detection.

Internal tools (internal/tools/)

A dedicated module pinning the versions of internal tools so make targets are reproducible:

• github.com/prometheus/promu
• golang.org/x/tools/cmd/goyacc
• github.com/golangci/golangci-lint
• github.com/jsonnet-bundler/jsonnet-bundler
• (Several lint plugins.)

make install-goyacc and friends pull these from this sub-module.

UI dependencies

web/ui/mantine-ui/package.json direct deps include:

• @mantine/core, @mantine/hooks, @mantine/notifications — UI framework (currently 9.x; 8 -> 9 migration in April 2026).
• @codemirror/*, @lezer/highlight — PromQL editor and syntax highlighting.
• @nivo/line — chart rendering.
• react, react-dom, react-router-dom.
• vite, vitest — build + test.
• eslint, prettier — formatting and linting.

The legacy web/ui/react-app carries its own (older) set of dependencies; it remains a separate npm workspace because the dep trees are incompatible.

Dependency hygiene

• Renovate manages updates with eager bumps.
• govulncheck runs daily.
• Major upgrades (Go major version, AWS SDK v1 -> v2) are coordinated in dedicated PR series.
• The release notes always mention dependency-driven behavioural changes.

Where to look for the live list

• Authoritative: go.mod, web/ui/mantine-ui/package.json, web/ui/react-app/package.json.
• Live in a Prometheus instance: /api/v1/status/buildinfo (Go module + build details) and /api/v1/status/runtimeinfo.
• For licenses: make npm_licenses produces npm_licenses.tar.bz2 shipped with each release.