Development policy: how are new dependencies added, existing updated or old ones removed? #11468
Description
I noticed the GitHub cli dependency list is now 54 packages at https://github.com/cli/cli/blob/trunk/go.mod#L7-L63
require (
github.com/AlecAivazis/survey/v2 v2.3.7
github.com/MakeNowJust/heredoc v1.0.0
github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2
github.com/briandowns/spinner v1.23.2
github.com/cenkalti/backoff/v4 v4.3.0
github.com/cenkalti/backoff/v5 v5.0.2
github.com/charmbracelet/glamour v0.10.0
github.com/charmbracelet/huh v0.7.0
github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834
github.com/cli/go-gh/v2 v2.12.1
github.com/cli/go-internal v0.0.0-20241025142207-6c48bcd5ce24
github.com/cli/oauth v1.2.0
github.com/cli/safeexec v1.0.1
github.com/cpuguy83/go-md2man/v2 v2.0.7
github.com/creack/pty v1.1.24
github.com/digitorus/timestamp v0.0.0-20250524132541-c45532741eea
github.com/distribution/reference v0.6.0
github.com/gabriel-vasile/mimetype v1.4.9
github.com/gdamore/tcell/v2 v2.8.1
github.com/golang/snappy v1.0.0
github.com/google/go-cmp v0.7.0
github.com/google/go-containerregistry v0.20.6
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/gorilla/websocket v1.5.3
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/go-version v1.7.0
github.com/henvic/httpretty v0.1.4
github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec
github.com/in-toto/attestation v1.1.2
github.com/joho/godotenv v1.5.1
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
github.com/mattn/go-colorable v0.1.14
github.com/mattn/go-isatty v0.0.20
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
github.com/microsoft/dev-tunnels v0.1.13
github.com/muhammadmuzzammil1998/jsonc v1.0.0
github.com/opentracing/opentracing-go v1.2.0
github.com/rivo/tview v0.0.0-20250625164341-a4a78f1e05cb
github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7
github.com/sigstore/protobuf-specs v0.5.0
github.com/sigstore/sigstore-go v1.1.0
github.com/spf13/cobra v1.9.1
github.com/spf13/pflag v1.0.6
github.com/stretchr/testify v1.10.0
github.com/theupdateframework/go-tuf/v2 v2.1.1
github.com/yuin/goldmark v1.7.12
github.com/zalando/go-keyring v0.2.6
golang.org/x/crypto v0.40.0
golang.org/x/sync v0.16.0
golang.org/x/term v0.33.0
golang.org/x/text v0.27.0
google.golang.org/grpc v1.73.0
google.golang.org/protobuf v1.36.6
gopkg.in/h2non/gock.v1 v1.1.2
gopkg.in/yaml.v3 v3.0.1
)
Are all these dependencies really required?
What is the development policy, how do you vet and decide to add new dependencies?
Not more than 18 months ago the dependency list had only 41 packages at https://github.com/cli/cli/blob/v2.46.0/go.mod#L5C1-L47C2
Graphical diff for reference:
Among these dependencies that were added is Netflix/go-expect and hinshun/vt10x which have no updates in past 3 years and might not be maintained anymore. Do you trust these to still get e.g. security updates?
Of the previous dependencies, google/shlex has not had any updates in 6 years and is officially archived already, and kballard/go-shellquote has not had any updates in 7 years. Package MakeNowJust/heredoc is at version v1.0.0 that is 6 years old, instead of using the latest v2 series. Package hashicorp/go-multierror stopped making tagged releases in 2021, you might want to stop referring to v1.1.1 of it and use git head from 2025 instead. Package gopkg.in/yaml.v3 has been archived last year and seems people have moved to use kubernetes-sigs/yaml instead.
Should GitHub cli perhaps adopt some policy on how dependencies are updated or removed to ensure they don't become too outdated?
Additionally I noticed there are two versions of the same backoff library. Ideally the code base would be updated to only need v5 so that v4 can be dropped.
github.com/cenkalti/backoff/v4 v4.3.0
github.com/cenkalti/backoff/v5 v5.0.2
None of these dependencies is urgent to fix. I am only posting this issue here for discussion and input for a potential development policy on how to add/update/remove dependencies going forward. I maintain the package gh in Debian, so I have a vested interest in seeing that the dependencies don't sprawl out and the ones that are used are kept at their latest versions.