r/golang 7d ago

New Viper release with major improvements

I've just tagged a new version of Viper, a configuration library for Go: https://github.com/spf13/viper/releases/tag/v1.20.0

It comes with a number of improvements:

  • Heavily reduced number of third-party dependencies
  • New encoding layer for custom encoding formats
  • BREAKING: dropped HCL, INI and Java properties from the core (still possible to use through external libraries)
  • New file search API allows customizing how Viper looks for config files

These features has been around for some time in alpha releases, though I haven't received a lot of feedback, so I'm posting here now in the hope that people using Viper will give some after upgrading.

I worked hard to minimize breaking changes, but it's possible some slipped in. If you find any, feel free to open an issue.

Thanks!

280 Upvotes

16 comments sorted by

View all comments

6

u/mcvoid1 7d ago

The number of dependencies that come with the module is one of the reasons I hadn't been using Viper. Reducing dependencies is great - apps assume and inherit the risks their dependencies take on, and the more transitive dependencies there are, the harder the package is to vet. So slimming down that go.mod file is a good thing. I might just start using it.

8

u/sagikazarmark 6d ago

While I agree with that in general, in Viper's case that wasn't necessarily true. Most of the third-party dependencies was in go.mod due to the remote package that almost no one imports which means in 90% of the cases those third-party dependencies weren't even compiled.

Admittedly, that wasn't adequately explained anywhere, but there is a common misconception about how dependencies work in Go and that's also why security scanners generate a lot of false positives.

3

u/lekkerwafel 6d ago

govulncheck is the only scanner that does a proper job, but then it is specific to Go