How to Find Indirect Dependency in Golang?

Go, also known as Golang, is a statically typed, compiled language with a rich standard library and a robust ecosystem of packages. When building Go applications, it’s common to use third-party packages to avoid reinventing the wheel. However, these packages can have their own dependencies, known as indirect dependencies. This article provides a detailed guide on how to find indirect dependencies in Go.

Understanding Direct and Indirect Dependencies

In Go, a direct dependency is a package that your code imports directly. An indirect dependency, on the other hand, is a package that your direct dependencies import.

For example, if your Go application imports package A, and package A imports package B, then package A is a direct dependency and package B is an indirect dependency.

The Go Modules

• Go Modules is the official dependency management solution in Go. It was introduced in Go 1.11 and became the default in Go 1.16. With Go Modules, you can manage your project’s dependencies in a straightforward and reproducible way.
• The go.mod file in your project root defines the module path (the import path used in Go source code) and the Go version your project is using. It also lists the specific versions of the direct dependencies your project uses.
• The go.sum file, on the other hand, includes cryptographic checksums of the exact code for each dependency your project uses, both direct and indirect. This ensures that you’re always using the same code for each dependency, improving the reproducibility of your builds.

How to Find Indirect Dependencies In Golang?

You can use the go list command to find the indirect dependencies of your Go application. The -m flag tells go list to list modules instead of packages, and the all keyword tells it to list all modules needed to build packages in your module.

Here’s how you can use it:

1. go list -m all
2. This will print a list of all direct and indirect dependencies your application uses, along with their versions.
3. If you want to list only the indirect dependencies, you can use the go mod graph command and filter out the direct dependencies:
4. go mod graph | awk '{if ($1 != "main") print $2}' | sort | uniq
5. In this command, go mod graph prints the module requirement graph, awk filters out the direct dependencies, and sort | uniq sorts the list and removes duplicates.

Conclusion

Understanding and managing dependencies, both direct and indirect, is a crucial part of developing Go applications. With Go Modules and the built-in Go commands, you can easily find and manage your application’s dependencies in a straightforward and reproducible way.

Remember, keeping your dependencies up-to-date and minimizing the number of unnecessary dependencies can help you avoid potential issues and vulnerabilities. Happy coding!