# Dependencies

## Direct Dependencies

| Package | Version | Purpose | Usage Location |
|---------|---------|---------|---------------|
| `github.com/gorilla/websocket` | v1.5.1 | WebSocket protocol implementation | `internal/hub/hub.go` |
| `github.com/prometheus/client_golang` | v1.17.0 | Prometheus metrics client library | `internal/metrics/metrics.go`, `main.go` |
| `gopkg.in/yaml.v3` | v3.0.1 | YAML configuration parsing | `internal/config/config.go` |

## Dependency Graph

```mermaid
graph TD
    subgraph "Application"
        MAIN[main.go]
        HUB[internal/hub]
        CFG[internal/config]
        MET[internal/metrics]
    end

    subgraph "Direct Dependencies"
        GWS[gorilla/websocket v1.5.1]
        PROM[prometheus/client_golang v1.17.0]
        YAML[gopkg.in/yaml.v3 v3.0.1]
    end

    subgraph "Transitive Dependencies"
        NET[golang.org/x/net v0.17.0]
        PROTO[google.golang.org/protobuf v1.31.0]
        PROMMOD[prometheus/client_model v0.4.1]
        PROMCOM[prometheus/common v0.44.0]
        PROMPROC[prometheus/procfs v0.11.1]
    end

    HUB --> GWS
    HUB --> MET
    MET --> PROM
    CFG --> YAML
    MAIN --> PROM
    GWS --> NET
    PROM --> PROTO
    PROM --> PROMMOD
    PROM --> PROMCOM
    PROM --> PROMPROC
```

## Indirect (Transitive) Dependencies

| Package | Version | Required By |
|---------|---------|-------------|
| `github.com/beorn7/perks` | v1.0.1 | prometheus/client_golang |
| `github.com/cespare/xxhash/v2` | v2.2.0 | prometheus/client_golang |
| `github.com/golang/protobuf` | v1.5.3 | prometheus/client_golang |
| `github.com/kr/text` | v0.2.0 | prometheus (testing) |
| `github.com/matttproud/golang_protobuf_extensions` | v1.0.4 | prometheus/client_golang |
| `github.com/prometheus/client_model` | v0.4.1 | prometheus/client_golang |
| `github.com/prometheus/common` | v0.44.0 | prometheus/client_golang |
| `github.com/prometheus/procfs` | v0.11.1 | prometheus/client_golang |
| `golang.org/x/net` | v0.17.0 | gorilla/websocket |
| `golang.org/x/sys` | v0.13.0 | prometheus/procfs |
| `google.golang.org/protobuf` | v1.31.0 | prometheus/client_golang |

## Dependency Usage Details

### gorilla/websocket

- **Used for:** WebSocket protocol handling (upgrade, read, write)
- **Key APIs used:**
  - `websocket.Upgrader` — HTTP to WebSocket upgrade
  - `websocket.Conn.ReadMessage()` — Read frames from client
  - `websocket.Conn.WriteMessage()` — Write frames to client
  - `websocket.TextMessage` — Message type constant

### prometheus/client_golang

- **Used for:** Application observability metrics
- **Key APIs used:**
  - `promauto.NewGauge()` — Auto-registering gauge metrics
  - `prometheus.GaugeOpts` — Metric configuration
  - `promhttp.Handler()` — HTTP handler for `/metrics` endpoint

### gopkg.in/yaml.v3

- **Used for:** Configuration file parsing
- **Key APIs used:**
  - `yaml.Unmarshal()` — Deserialize YAML into Go structs

## Build & CI Dependencies

| Tool | Purpose | Used In |
|------|---------|---------|
| Go 1.21 | Compiler and runtime | CI, Release |
| golangci-lint | Static analysis / linting | CI |
| make | Build automation | Local dev, CI |
| Gitea Actions | CI/CD pipeline runner | `.gitea/workflows/` |

## Security Considerations

| Dependency | Known Issues | Notes |
|-----------|--------------|-------|
| `golang.org/x/net` | v0.17.0 | Check for CVEs periodically |
| `gorilla/websocket` | Archived repository | Consider migration to `nhooyr.io/websocket` or `coder/websocket` long-term |
| TLS certificates | Local dev certs in repo | Not for production use |