go.mod pins cobra v1.8.0 and viper v1.18.2 (both old). go mod why confirms afero, hashicorp/hcl, ini.v1, go-toml/v2, fsnotify, cast, mapstructure, magiconair/properties exist solely for viper — most of the 19 indirect requirements — yet viper is used at only 24 call sites for "read one YAML file + 3 BindPFlag". Notably cmd/setup.go already writes the same config with plain yaml.v3 structs, bypassing viper.
Tier 1 — do now (S): bump cobra → latest 1.x and viper → ≥1.20. Recent viper dropped the HCL/INI/Java-properties encoders, removing several transitive deps; cobra 1.x upgrades have been low-risk. CI validates. (Verify changelogs at upgrade time.)
Tier 2 — optional, only when next touching config code (M): replace viper with a ~100-line loader reusing setup.go's existing setupConfig structs, deleting the whole subtree. Not worth a standalone project — binary size is irrelevant for a brew tool; the win is supply-chain surface. Pairs with the reliability epic's "surface config parse errors" fix.
Effort: S (tier 1).
go.modpins cobra v1.8.0 and viper v1.18.2 (both old).go mod whyconfirmsafero,hashicorp/hcl,ini.v1,go-toml/v2,fsnotify,cast,mapstructure,magiconair/propertiesexist solely for viper — most of the 19 indirect requirements — yet viper is used at only 24 call sites for "read one YAML file + 3 BindPFlag". Notablycmd/setup.goalready writes the same config with plainyaml.v3structs, bypassing viper.Tier 1 — do now (S): bump cobra → latest 1.x and viper → ≥1.20. Recent viper dropped the HCL/INI/Java-properties encoders, removing several transitive deps; cobra 1.x upgrades have been low-risk. CI validates. (Verify changelogs at upgrade time.)
Tier 2 — optional, only when next touching config code (M): replace viper with a ~100-line loader reusing setup.go's existing
setupConfigstructs, deleting the whole subtree. Not worth a standalone project — binary size is irrelevant for a brew tool; the win is supply-chain surface. Pairs with the reliability epic's "surface config parse errors" fix.Effort: S (tier 1).