I would like to have fewer security fix PRs opened by dependabot. Reducing actual dependencies would go a long way to helping out with that. We just ship log4js so we should be able to define an interface that we can wrap log4js in and then people can use whatever logging library they want.
Remove need for log4js by injecting logging library and just making it an interface
Exclude development dependencies from regular dependabot scan
Bump major version so that breaking changes don't actually break anybody
I would like to have fewer security fix PRs opened by dependabot. Reducing actual dependencies would go a long way to helping out with that. We just ship
log4jsso we should be able to define an interface that we can wraplog4jsin and then people can use whatever logging library they want.