Dependencies

The non-trivial external Go modules Traefik pulls in. Everything is declared in go.mod (github.com/traefik/traefik/v3, Go 1.25). The list below is grouped by purpose, not exhaustive.

Configuration loading

Module	Used for
github.com/traefik/paerser	The reflection-based configuration loader. Provides cli.ResourceLoader implementations (file, flag, env, deprecation).
github.com/BurntSushi/toml	TOML parsing.
gopkg.in/yaml.v3	YAML parsing.
github.com/Masterminds/sprig/v3	Template helpers used by the file provider.

Logging, metrics, tracing

Module	Used for
github.com/rs/zerolog	Structured logger, used everywhere.
go.opentelemetry.io/otel and otlptrace/otlpmetric exporters	Tracing and OTLP metrics.
github.com/go-kit/kit (metrics)	Common counters/gauges/histograms abstraction over backends.
github.com/prometheus/client_golang	Prometheus exporter.
github.com/influxdata/influxdb-client-go/v2	InfluxDB v2 exporter.
github.com/DataDog/datadog-go	DogStatsD client.
github.com/cactus/go-statsd-client	StatsD client.

TLS, ACME, identity

Module	Used for
github.com/go-acme/lego/v4	ACME client and dozens of DNS challenge providers.
github.com/spiffe/go-spiffe/v2	SPIFFE Workload API client.
github.com/quic-go/quic-go	HTTP/3 / QUIC.

HTTP and networking

Module	Used for
github.com/gorilla/mux	The internal API and version routes.
github.com/gorilla/websocket	WebSocket handling in the proxy.
github.com/andybalholm/brotli	Brotli compression.
github.com/klauspost/compress	gzip/deflate/zstd compression.
github.com/abbot/go-http-auth	Basic / Digest authentication.
github.com/containous/alice	Middleware chain helper (mirrors justinas/alice with bug fixes).
github.com/vulcand/oxy	Circuit breaker and forwarder primitives.
github.com/vulcand/predicate	Circuit-breaker expression engine.

Providers

Module	Used for
k8s.io/client-go, apimachinery, apiextensions-apiserver	Kubernetes clients.
sigs.k8s.io/gateway-api	Gateway API types.
knative.dev/serving, networking	Knative APIs.
github.com/docker/docker and github.com/docker/cli	Docker / Swarm API client.
github.com/hashicorp/consul/api	Consul client (Catalog and KV).
go.etcd.io/etcd/client/v3	etcd KV client.
github.com/redis/go-redis	Redis client.
github.com/go-zookeeper/zk	ZooKeeper client.
github.com/hashicorp/nomad/api	Nomad client.
github.com/aws/aws-sdk-go-v2 (config, credentials, ECS, EC2, SSM)	ECS provider.

Plugins

Module	Used for
github.com/traefik/yaegi	Go interpreter for Yaegi plugins.
github.com/tetratelabs/wazero	WebAssembly runtime for Wasm plugins.

Utilities

Module	Used for
github.com/cenkalti/backoff/v4	Exponential backoff for provider reconnects.
github.com/coreos/go-systemd/v22	Notification readiness for systemd.
github.com/sirupsen/logrus	Used by a few transitive dependencies; Traefik's own logging is zerolog.
github.com/stretchr/testify	Test assertions and require/assert helpers.
github.com/google/go-github/v28	Used by the version-check feature in pkg/version/version.go.
github.com/hashicorp/go-version	Semver comparisons in version checks.

Pinned without tags

A few replacements are pinned by pseudo-version because the upstream project has no tagged releases:

github.com/abbot/go-http-auth v0.0.0-00010101000000-000000000000 // No tag on the repo.
github.com/containous/alice    v0.0.0-20181107144136-d83ebdd94cbd // No tag on the repo.
github.com/armon/go-socks5     v0.0.0-20160902184237-e75332964ef5

The comments are part of go.mod and explain why the pseudo-versions are stable.

Go toolchain

go.mod requires Go 1.25; .go-version pins the minor version used by maintainers (currently 1.25). Both numbers must move together when bumping.

Tracking updates

Dependency bumps land through human-attributed PRs (see By the numbers for the bot ratio). They are typically reviewed for:

• License compatibility (Traefik is MIT — see LICENSE.md).
• Behavior changes that affect tests in integration/.
• Indirect dependencies of lego and the AWS SDK, since those bring large transitive trees.

For the full list, run:

go list -m -json all