Support for Winston 3.x

[rosston]

Fixes https://github.com/bithavoc/express-winston/issues/163.

Proposed changes

• [x] Upgrade to winston@3
  • express-winston shouldn't have any breaking changes as a result.
  • winston@3 seems to have quite a few breaking changes though.
  • Biggest one to call out for users is probably that custom transports should be updated. Despite the winston changelog claiming that transports shouldn't break, my experience is that they definitely do (based on our MockTransport used in testing).
  • I think supporting both versions 2 and 3 of winston is going to cause too many headaches for it to be worth it. So just upgrade wholesale to version 3, and this will be a breaking change (and major version bump).
• [x] Upgrade all other dependencies
  • Might as well do it now just in case there are any other breaking changes lurking in other dependencies.
• [x] Update node version support
  • Dropping support for old versions of node should count as a breaking change and therefore require a major version bump, in my opinion. Since we're about to do one for winston@3, might as well throw this in.
  • We're working with some very old versions of node (0.10!). I think we should only support the currently-supported versions of node at any given time (with maybe a slight grace period for newly-EOL'd versions). Right now, that means we'll support only versions 6, 8, and 10.
  • winston also dropped support for node versions < 6 in v3
• [ ] ~Use standard~ (postponed until after 3.x)
  • The lack of consistent code formatting makes the code difficult to work with.
  • I want to avoid bikeshedding about code style, so use something that 1) requires no configuration, and 2) is pretty popular.
  • I want to update this now so that it doesn't sit as a longstanding to-do.
• [ ] ~Add package-lock.json (maybe?)~
  • ~Since we'll be on a newer node version, we could take advantage of newer npm features.~
  • ~I'm not sure this makes sense for a library. Thoughts?~

Anything else that really needs to get into the major version bump? Non-breaking changes (almost all of them) should wait until after the major version bump. I don't want this major version bump to have too much scope creep.

[dmichelin]

As per https://github.com/sindresorhus/ama/issues/479#issuecomment-310661514 It doesn't seem like having a package lock is a good idea. Given that this is a library and largely unopinionated adding a package-lock.json could introduce bloat.

[bithavoc]

@rosston I think shalk and lodash should be peer dependencies.

[bithavoc]

agree with @dmichelin It shouldn't need package-lock.

[rosston]

@bithavoc From looking at the original intent behind peerDependencies on the npm blog and the way they're described in npm's docs, I don't think chalk and lodash should be peer dependencies. They are packages that express-winston depends on but that the end user of express-winston doesn't need to know anything about. I believe peerDependencies should only be used for plugin-type situations.

Admittedly, it's a little bit of a stretch to think of express-winston as a plugin for winston (the one peer dependency we do have), but I think the usage kind of makes sense there if you squint at it just right. 🙂

[rosston]

Alright, I think this is ready for a review (mostly looking at you, @bithavoc 🙂).

The number of changes that prettier + standard introduces is annoying, but I also tried running prettier + eslint (with the eslint:recommended config) and got a similarly large number of changes. I don't like the amount of changes in either version, but I'd rather pay the price of all the changes once than semi-arbitrarily tweak a linter/formatter config. I'm open to opinions/thoughts here though.

[rosston]

@bithavoc I just pulled the styling changes out. You're right, it makes sense to handle/review those separately/later.

[bithavoc]

looks good @rosston can you also bump the version? Thanks.

[rosston]

Yep, I'll bump the version and update the changelog before release. I'll get this out in the next day or so, I think.

[bithavoc]

awesome nicely done @rosston I'd be great to add an explanation to the Readme that v2.6.0 is the last version to support express-winston@2, etc.

[YasharF]

@rosston Thank you for the great work!

[bithavoc]

@rosston we're ready to merge this, right?

[rosston]

Just published this as v3.0.0.