Dependencies

The Go modules Terraform Core relies on most heavily. The full list lives in go.mod and go.sum (1,141 entries in go.sum at the snapshot date).

HashiCorp libraries

These are the load-bearing dependencies and are typically updated in lockstep with Terraform Core.

Module	Used for	Where
github.com/hashicorp/hcl/v2	Configuration syntax (HCL2).	internal/configs/, internal/lang/, internal/stacks/stackconfig/
github.com/hashicorp/cli	CLI dispatch and help-text rendering.	commands.go, main.go, every command.<...>Command
github.com/hashicorp/go-plugin	gRPC plugin host (provider/provisioner subprocess management).	internal/plugin/, internal/plugin6/
github.com/hashicorp/terraform-svchost	Service discovery (resolving registry endpoints, HCP Terraform).	main.go, internal/cloud/, internal/getproviders/
github.com/hashicorp/terraform-svchost/auth	Credential helpers.	commands.go, internal/command/cliconfig/
github.com/hashicorp/go-getter	Multi-source artifact download (modules, mirrors).	internal/getmodules/
github.com/hashicorp/terraform-config-inspect	Lightweight config inspection (used by registry tooling).	shared with the registry
github.com/hashicorp/go-tfe	HCP Terraform API client.	internal/cloud/, internal/backend/remote/
github.com/hashicorp/go-version	Semantic version parsing/constraints.	internal/getproviders/, internal/configs/
github.com/hashicorp/go-multierror	Error aggregation in older paths.	scattered
github.com/hashicorp/copywrite (via scripts/copyright.sh)	License header maintenance.	tooling

Third-party libraries

Module	Used for	Where
github.com/zclconf/go-cty	Dynamic value type (cty.Value, cty.Type). The currency of the engine.	engine, language, providers — everywhere
github.com/zclconf/go-cty-yaml	YAML decoding for yamlencode/yamldecode.	internal/lang/funcs/
github.com/apparentlymart/go-shquot	Shell-style argument quoting (used in error messages and tracing).	main.go
github.com/apparentlymart/go-versions	Version-set algebra used in provider resolution.	internal/getproviders/
github.com/mattn/go-shellwords	Splitting TF_CLI_ARGS env values.	main.go
github.com/mitchellh/colorstring	Terminal color escapes.	internal/command/format/
github.com/mitchellh/cli	(Older predecessor of hashicorp/cli; some helpers still imported.)	scattered
github.com/mitchellh/copystructure	Deep-copy helpers for state internals.	internal/states/state_deepcopy.go
github.com/zclconf/go-cty-debug	Debug printing of cty values.	tests
google.golang.org/grpc	gRPC runtime.	plugin host, rpcapi
google.golang.org/protobuf	Protobuf runtime.	plugin host, rpcapi, plan files
go.opentelemetry.io/otel (and friends)	OpenTelemetry tracing (opt-in).	main.go, telemetry.go, internal/rpcapi/
github.com/agext/levenshtein	"Did you mean?" suggestions.	internal/didyoumean/, internal/getproviders/didyoumean.go
github.com/spf13/afero	In-memory file system used by tests and the parser.	internal/configs/parser.go
github.com/davecgh/go-spew	Debug-level structure printing.	tests
github.com/google/go-cmp	Diff helpers in tests.	most _test.go files

Cloud provider SDKs (for backend code only)

The internal/backend/remote-state/<name>/ directories pull in the relevant cloud-vendor SDKs:

• AWS: the github.com/aws/aws-sdk-go-v2 family.
• Azure: the github.com/Azure/azure-sdk-for-go family.
• GCS: cloud.google.com/go/storage.
• Kubernetes: k8s.io/client-go.
• Other backends pull their own clients.

These are only compiled into the binary because their backend implementations live in this repo. The dependency graph is large but isolated.

Licensing policy

The contribution guide explicitly limits acceptable dependency licenses to MPL 2.0, MIT, and BSD-style. Adding a new direct dependency under any other license requires team approval. Proprietary licenses and copyleft-style licenses (GPL, AGPL, etc.) are not accepted.

Updating

Updates use the standard Go toolchain:

go get github.com/hashicorp/hcl/v2@v2.20.0
go mod tidy

Per the contribution guide, dependency updates should be a separate commit from any code change that uses the new version. Aim for one dependency change per PR; conflict resolution on go.mod/go.sum is otherwise frequent.

Why some dependencies look unusual

• cty is by HashiCorp's Martin Atkins (under the zclconf org) but functions as a HashiCorp library for all practical purposes.
• apparentlymart/... is also Martin Atkins's personal namespace.
• agext/levenshtein is unusually old but does its job in a few hundred lines and has no security history that would justify replacing it.
• mitchellh/... modules are split across two namespaces because Mitchell Hashimoto wrote them at HashiCorp; the legacy is preserved.

Where the heavy weights live

go.sum has 1,141 entries; most are transitive dependencies of the cloud SDKs. The Terraform-Core-specific footprint (the modules in this page) is much smaller. If you want to understand the core of Terraform, you can mostly ignore the cloud SDKs — they're isolated to specific backend directories and only compiled because the backends live here.