v1.13.0 introduces lots of transitive dependencies to client library

[pgier]

I'm only using oapi-codegen to generate a client library against an openapi spec file. I noticed that when I changed my go.mod to use v1.13.0 instead of v1.12.4, there are lots of transitive dependencies added. There seems to be a lot of stuff added that relate to server code and maybe should not be necessary for a client library.

 go 1.20

-require github.com/deepmap/oapi-codegen v1.12.4
+require github.com/deepmap/oapi-codegen v1.13.0

 require (
        github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
+       github.com/bytedance/sonic v1.9.1 // indirect
+       github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
+       github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+       github.com/gin-contrib/sse v0.1.0 // indirect
+       github.com/gin-gonic/gin v1.9.1 // indirect
+       github.com/go-playground/locales v0.14.1 // indirect
+       github.com/go-playground/universal-translator v0.18.1 // indirect
+       github.com/go-playground/validator/v10 v10.14.0 // indirect
+       github.com/goccy/go-json v0.10.2 // indirect
        github.com/google/uuid v1.3.0 // indirect
-       github.com/stretchr/testify v1.8.3 // indirect
+       github.com/json-iterator/go v1.1.12 // indirect
+       github.com/klauspost/cpuid/v2 v2.2.4 // indirect
+       github.com/labstack/echo/v4 v4.10.2 // indirect
+       github.com/labstack/gommon v0.4.0 // indirect
+       github.com/leodido/go-urn v1.2.4 // indirect
+       github.com/mattn/go-colorable v0.1.13 // indirect
+       github.com/mattn/go-isatty v0.0.19 // indirect
+       github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+       github.com/modern-go/reflect2 v1.0.2 // indirect
+       github.com/pelletier/go-toml/v2 v2.0.8 // indirect
+       github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+       github.com/ugorji/go/codec v1.2.11 // indirect
+       github.com/valyala/bytebufferpool v1.0.0 // indirect
+       github.com/valyala/fasttemplate v1.2.2 // indirect
+       golang.org/x/arch v0.3.0 // indirect
+       golang.org/x/crypto v0.9.0 // indirect
+       golang.org/x/net v0.10.0 // indirect
+       golang.org/x/sys v0.8.0 // indirect
+       golang.org/x/text v0.9.0 // indirect
+       google.golang.org/protobuf v1.30.0 // indirect
+       gopkg.in/yaml.v3 v3.0.1 // indirect
 )

It appears to be caused by the runtime package as shown by go mod why:

> go mod why github.com/valyala/fasttemplate
# github.com/valyala/fasttemplate
github.com/datastax/pulsar-admin-client-go/src/pulsaradmin
github.com/deepmap/oapi-codegen/pkg/runtime
github.com/labstack/echo/v4
github.com/labstack/gommon/log
github.com/valyala/fasttemplate

I've attached a patch to show the diff of my go.mod and go.sum.
codege_1.12_to_1.13.patch

[pgier]

Digging into this a bit, it appears this is due to this change #1021
which added dependencies on labstack/echo and gin-gonic/gin to the runtime package.

[jamietanna]

Thanks for reporting - yeah that looks like it - I agree that we'd probably want to limit the scope of the imports, so we can reduce the tree of dependencies pulled - may be one for a next minor release, or a major release if we wanted to split them up into separate packages with their own go.mods.

I know at least in modern Go (I think since 1.17/1.18) Go will at least not vendor the dependencies it doesn't see in use, but it may still download them in non-vendoring mode 🤔

[jamietanna]

FYI @pgier I'm making progress on this in #1197, I can look at raising a (draft) PR to https://github.com/datastax/pulsar-admin-client-go to pin to the branch I'm working on and show:

• whether it's a straight-forward upgrade as a consumer
• whether it reduces the impact of our transitive dependencies

Right now the go.mod is very slimmed down, and should be much more palatable!

Edit: before I can do that, can you please add a license to the project, as right now it's not Open Source (it defaults to All Rights Reserved without an explicit license)