HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
spf13
viper
Go2017–2026
spf13 / viper

viper

Go configuration with fangs

18Distinct people
19Mentions
0Explicit recommenders
30.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Go configuration with fangs

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year19 dated mentions

Observed mentions: 2017-09-07 20:00:36 UTC to 2026-07-16 15:44:45 UTC.

02462017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 7 mentions; 2 submissions, 5 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC101
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC404
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC303
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC725
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC110
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC000
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

What Hacker News says

19 sources
> I've said for a long time that composability in software is a bit like playing Tetris: the lines have to clear. I love this analogy, and I find it darkly hilarious that most sibling commenters don't seem to understand. Maybe you need to have worked within a million-line codebase to get it. The only way to "clear the lines" in software is to eject them from the main codebase and into imported libraries with stable, well-documented, well-tested APIs that you very rarely if ever (security vulnerabilities?) need to touch after "stabilizing" them. Great public examples: the Go standard library, https://github.com/spf13/viper , https://github.com/uber-go/zap . Viper and zap combined are more than 20,000 lines of code (according to cloc) that I don't need to read or understand how they work - their lines have been "cleared" and all I need to
Read the rest
know is the abstraction. Half the joy to be found when working within massive codebases is successfully clearing lines.
In The Tower Keeps Rising
elpookie·Oct 6, 2024Submission

Show HN: CREV – A Go-based CLI tool for AI code reviews and codebase exports

I’ve recently built CREV, a Go-based CLI tool designed to get AI-powered code reviews from your terminal. The idea came from my frustration with manually copying code into ChatGPT or Claude to get feedback on my projects. Although ChatGPT could provide me with useful suggestions, it lacked the full context of my project, which often resulted in incomplete reviews since it didn’t know my entire directory structure and the content of all the files. I wanted to fix that, while also eliminating the constant switching between VSCode and my browser. So after a month of development, I’m excited to share CREV: - GitHub: https://github.com/vossenwout/crev - Website: https://crevcli.com/ Features: - Full Codebase Export: Exports your entire directory structure and the content of all the files of your project into a single text file. - AI-Powered Co
Read the rest
de Reviews: CREV reviews your bundled codebase and outputs the review as a markdown file. - Terminal-Based Workflow: CREV is a CLI tool, removing the need to switch between your editor and the browser. I have written the CREV CLI tool in Go as I was interested in learning the language and I heard many good things about its efficiency and speed. I used Cobra https://github.com/spf13/cobra to manage the CLI commands and Viper https://github.com/spf13/viper for handling configurations. This is the first project I have done with Go but I find the language interesting and the Go routines also help with reading in your entire codebase. For the code reviews themselves I use google cloud functions which invoke GPT-4o (am also planning to add Claude 3.5 and GPT-o1). I’d love to hear your feedback—whether it’s ideas for new features or reasons why you believe this tool is useful or useless to you. I am using it daily so it at least solved my own problem :)
2 points · Open discussion
I contribute to open source projects as well - in various capacities - and it's fine for a maintainer of a huge project to use that wording. He pushed hugo and viper in 2013-2014: https://github.com/gohugoio/hugo/commits/v0.7, viper: https://github.com/spf13/viper/commit/98be071 Steve is a very accomplished programmer, with what hugo / viper became in the go ecosystem by itself. In my view, the projects also jumpstarted a lot of new users who were trying out golang who weren't sold on it yet. I didn't really notice his leadership or advisory roles until now, that's just icing on the cake. Thanks for your contributions, Steve! Edit: If it's really big ecosystem, _indirect_ contributions also matter. e.g. in python, even if you're not writing CPython patches or PEPs, community based projects do a lot to shape best practices and even bubble
Read the rest
up into standard library.
In Spf13 is leaving Google
Use viper with care. It has some dangerous fundamental flaws [1]. We got bitten hard, submitted a PR [2] and followed up for a year and a half to no avail, before I went ahead and reinvented the wheel and wrote koanf (plug), specifically to avoid viper's flaws. Most importantly: - Breaks JSON, YAML, TOML etc. language specs by forcibly lowercasing all keys internally. Dangerous because it can silently merge differently cased config keys into lowercase. - Hard codes big unnecessary dependencies into the core, significantly bloating build sizes. No separation or abstraction. [1] https://github.com/spf13/viper/pull/635 [2] https://github.com/knadh/koanf#alternative-to-viper
In Viper – Go Configuration with Fangs
https://github.com/spf13/viper/blob/master/go.mod 16 direct dependencies, 39 transitive dependencies, and nearly 7000 lines of code -- for a package that handles flags and config files. I can't help feeling that frameworks like this are a little overwrought. It's the sort of project that succeeds because thousands of people just need something that works, right away, so they search for "golang config" and click the top result. Whereas if you can afford to slow down a little, you might find that the stdlib (with a bit of glue) is a perfectly serviceable option for the majority of apps.
In Viper – Go Configuration with Fangs
> From a security stand point, reduced application code decreases risk. It was service discovery code he removed, what if it reached out to discover services on application start up, that's a potential attack vector. Agreed. I've see a similar pattern with certain open source libraries. The first example I think of is the spf13/viper [1] library, used to load configuration into go applications. Viper is equipped with code for reading config from various file formats, environment variables, as well as remote config sources such as etcd, consul. If you introduce the viper library as a dependency of your application to merely read config from environment variables and YAML files in the local filesystem, then your go application suddenly gains a bunch of transitive dependencies on modules related to remote config loading for various species
Read the rest
of remote config provider. It's not uncommon for these kind of remote config loading dependencies to have security vulnerabilities. As well as the potential increased attack surface if a bunch of unnecessary code to load application configuration from all manner of remote config providers ends up in your application binary [2], if you work in an environment that monitors for vulnerabilities in open source dependencies, if you depend on an open source library that drags in dozens of transitive dependencies you don't really need, it adds a fair bit of additional overhead re: detecting, investigating and patching the potential vulnerabilities. I guess there's arguably a "Hickean" simple-vs-easy tradeoff in how such libraries are designed. The "easy" design, that makes it quick for developers to get started and achieve immediate success with a config loading library, is to include code to load config from all popular supported config sources into the default configuration of the library, reducing the amount of steps a new user has to do to get the library to work for their use case. A less easy but arguably "simpler" design might be to only include a common config-provider interface in the core module and push all config-provider-specific client/adaptor code into separate modules, and force the user to think about which config sources they want to read from and then manually add and integrate the dependencies for the corresponding modules that contain the additional code they want. edit: there has indeed been some discussion about the proliferation of dependencies, and what to do about them, in viper's issue tracker [3] [4] [1] https://github.com/spf13/viper [2] this may or may not actually happen, depending on which function calls you actually use and what the compiler figures out. If your application doesn't call any remote-config-provider library functions then you shouldn't expect to find any in your resulting application binary, even if the dependency is there at the coarser-grain module dependency level [3] https://github.com/spf13/viper/issues/887 [4] https://github.com/spf13/viper/issues/707
In Can I have a smaller Prometheus
My impression is that nobody bothers with the Go flags package and most people use the POSIX compatible pflag [1] library for argument parsing, usually via the awsome cobra [2] cli framework. Or they just use viper [3] for both command line and general configuration handling. No point reinventing the wheel or trying to remember some weird non-standard quirks. [1] https://github.com/spf13/pflag [2] https://github.com/spf13/cobra [3] https://github.com/spf13/viper
In Conventions for Command Line Options

Showing the 15 most recent of 19 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.