chore(deps): bump tslog from 4.10.2 to 5.1.0

[dependabot]

Bumps tslog from 4.10.2 to 5.1.0.

Release notes

Sourced from tslog's releases.

v5.1.0

Added

• Named sub-loggers on tslog/lite — LiteLogger gains name/nameSeparator options and getSubLogger()/child(). The label is partially applied with Function.prototype.bind, so a sub-logger's level methods are still the bound native console.* functions and the devtools file:line badge keeps pointing at the caller. Every % in a label is escaped so a (possibly runtime-derived) name can never act as a console format specifier and consume a logged value. Sub-loggers nest to any depth, join names with the parent's nameSeparator (default ":"), and inherit minLevel and the sink unless overridden; an unresolvable minLevel override inherits the parent's level, matching the full Logger. Known trade-off (documented): on a named lite logger the label occupies the console's format-string slot, so printf-style specifiers in messages print literally.
• Bundle-size budget for tslog/lite — check-bundle-size now probes the lite subpath (~0.8 KB gzip measured, 1 KB budget).

---

fullstack-build/tslog@v5.0.2...v5.1.0

v5.0.2

• Readable default styling on light devtools themes — the default pretty styles color timestamps, log positions, and logger names white, which the browser CSS path rendered as a near-white hex: invisible on light consoles (the Safari/Chrome default theme). Foreground white/whiteBright now contribute no color: declaration, so that text keeps the console's own default color and is readable in both light and dark themes. Terminal ANSI output is unchanged; background tokens keep their palette hex.

---

fullstack-build/tslog@v5.0.1...v5.0.2

v5.0.1

A patch release that makes source-mapped error positions work out of the box with modern bundler output (Turbopack/Next.js dev, Rollup, Webpack) — verified end-to-end against live Next.js 16 (next dev --turbopack) and TanStack Start (Vite) dev servers — and fixes the default browser console output (error styling, stack parsing, log positions), verified in real Chromium, Firefox, and WebKit. No API or settings changes.

---

fullstack-build/tslog@v5.0.0...v5.0.1

v5.0.0

[5.0.0] - 2026-07-14

A ground-up rewrite. tslog is now ESM-only, zero-dependency, Node >=20, and built with TypeScript 7 / ES2022. Settings are grouped, JSON output is fields-first, and the logger gains a middleware pipeline, async transports, JSONPath masking, OpenTelemetry/pino/GenAI presets, ready-made file/http/ringbuffer/worker transports, and tree-shakeable subpath modules. v5 also adds first-class support for agents and LLMs — fields-first calls, agent/session correlation, and OTel-GenAI attributes; OpenClaw uses tslog for its agent logging. This is a breaking release — see https://github.com/fullstack-build/tslog/blob/HEAD/MIGRATION_v4_to_v5.md for the upgrade path.

Added

• Grouped settings — related options now live under pretty, json, mask, stack, and meta groups instead of a flat list of prettyLog*/maskValues* keys. Sub-loggers merge groups rather than overwrite them.
• Fields-first JSON output — every level method is overloaded pino-style: info(fields, message?, ...args) as well as info(message, ...args). A single object spreads its fields to the top level, a leading object plus string spreads fields and sets message, and positional args land under message/"1"/… Runtime metadata moves under _logMeta carrying a v: 5 schema marker. All JSON keys are configurable via the json group.
• Middleware pipeline — logger.use(middleware) runs functions over each log context to mutate logObj/meta or drop the log entirely (return null/false).
• Async transports with attachTransport() returning a detach function, logger.flush(), and Symbol.asyncDispose/Symbol.dispose support (await using). Each transport may declare its own minLevel and format ("pretty", "json", or a custom formatter).
• Advanced masking — mask.paths (JSONPath-ish patterns such as user.password or *.token), mask.regex, and a mask.censor of "remove", "hash", a string, or a function (with mask.hashLabel).
• Presets — tslog/presets/pino (pinoFormat, pinoTransport, toPinoLevel), tslog/otel (otelFormat, toOtelRecord, levelToSeverityNumber, OtelSeverityNumber, otelTraceContext, stringifyOtelRecord), and tslog/presets/genai (genai, genaiAttributes, genaiSummary emitting OTel gen_ai.* fields).
• Built-in transports — tslog/transports/file (fileTransport, non-blocking, flush/dispose), tslog/transports/http (httpTransport, batched), tslog/transports/ringbuffer (ringBufferTransport with .dump()/.clear()), and tslog/transports/worker (workerTransport, Node-only off-thread sink I/O).
• Standard serializers — tslog/serializers exports stdSerializers (err, req, res, user), the individual serializers, and a serialize(map) middleware helper.
• Context propagation — runInContext(ctx, fn) uses AsyncLocalStorage to attach context fields to _logMeta when meta.attachContext is enabled. Auto-resolves on Node/Deno/Bun; on Cloudflare Workers inject one via the contextStorage setting (graceful no-op in browsers, with a one-time development warning).
• Custom levels via the customLevels setting and log(levelId, levelName, ...args).
• New API surface — child() (alias of getSubLogger()), isLevelEnabled(), getContext(), addLevel(), logger.if(condition), Logger.fromEnv(), defineConfig(), and TslogConfigError (thrown when strictConfig is on).
• Subpath modules (all tree-shakeable) — tslog/lite (minimal console wrappers preserving native line numbers), tslog/cli (also the tslog bin, an NDJSON pretty-printer for stdin), tslog/testing (createTestLogger, mockLogger), tslog/throttle (rate-limit middleware), tslog/pretty/box (box, tree), and tslog/console (wrapConsole, restoreConsole, isConsoleWrapped).
• Env-aware colorization — when type is omitted, output is pretty everywhere (server, CI, browser, React Native); only the coloring adapts to the environment: colored on an interactive TTY (CSS in the browser) and uncolored when stdout is piped/redirected/CI, so no ANSI escapes leak into files or log collectors. Structured JSON is opt-in via type: "json", TSLOG_TYPE=json, or a JSON transport. NO_COLOR strips colors without switching the format; FORCE_COLOR forces styled pretty. Applies to both new Logger() and the ready-made log.
• React Native support — detected via navigator.product (_logMeta.runtime: "react-native", Hermes engine version when available), Hermes/JSC stack frames parsed with a hybrid parser, pretty output by default.
• Real hostname in server JSON logs — _logMeta.hostname resolves from HOSTNAME/HOST/COMPUTERNAME, then the OS hostname (Deno.hostname() / node:os via process.getBuiltinModule), instead of defaulting to "unknown".
• Tree-shakeable exports — sideEffects: false (audited) with per-runtime conditional exports.
• tslog/slim — the smallest structured-JSON build (~9KB gzip vs ~19KB for the full browser entry, budget-checked in CI): the same pipeline minus masking, pretty output, and stack capture; mask settings and type: "pretty" throw instead of silently degrading.
• Buffered stdout sink (Node) — the Node entry writes type: "json" lines through a batched process.stdout.write (one write per event-loop turn, early flush past ~8KB) instead of per-line console.log; drained by logger.flush(), await using, and guarded beforeExit/exit hooks (a bare process.exit() loses nothing). Browser/universal entries keep console.log.
• Time seam — an injectable top-level clock: () => Date (deterministic tests, offset/monotonic stamping; inherited by sub-loggers, hostile clocks ignored) and json.time: "iso" | "epoch" | false | fn controlling the top-level timestamp representation (_logMeta.date stays UTC ISO).
• Deterministic test output — createTestLogger(settings, { now, normalize }): now freezes only that logger's clock (no fake-timer sledgehammer), normalize: true yields snapshot-stable records/lines; plus a standalone normalizeMeta(recordOrLine) scrubber (all in tslog/testing).
• Real OTLP/JSON in tslog/otel — otlpFormat/toOtlpJson/toOtlpLogRecord/toOtlpAnyValue/stringifyOtlpRequest emit the collector wire format (camelCase proto3 fields, typed attributes, resourceLogs[].scopeLogs[].logRecords[] envelope, exception.* semconv mapping for logged errors), and otlpBatchBody pairs with the http transport's new encodeBody option to POST merged batches straight to /v1/logs.

... (truncated)

Changelog

Sourced from tslog's changelog.

[5.1.0] - 2026-07-17

Added

• Named sub-loggers on tslog/lite — LiteLogger gains name/nameSeparator options and getSubLogger()/child(). The label is partially applied with Function.prototype.bind, so a sub-logger's level methods are still the bound native console.* functions and the devtools file:line badge keeps pointing at the caller. Every % in a label is escaped so a (possibly runtime-derived) name can never act as a console format specifier and consume a logged value. Sub-loggers nest to any depth, join names with the parent's nameSeparator (default ":"), and inherit minLevel and the sink unless overridden; an unresolvable minLevel override inherits the parent's level, matching the full Logger. Known trade-off (documented): on a named lite logger the label occupies the console's format-string slot, so printf-style specifiers in messages print literally.
• Bundle-size budget for tslog/lite — check-bundle-size now probes the lite subpath (~0.8 KB gzip measured, 1 KB budget).

[5.0.2] - 2026-07-16

Fixed

• Readable default styling on light devtools themes — the default pretty styles color timestamps, log positions, and logger names white, which the browser CSS path rendered as a near-white hex: invisible on light consoles (the Safari/Chrome default theme). Foreground white/whiteBright now contribute no color: declaration, so that text keeps the console's own default color and is readable in both light and dark themes. Terminal ANSI output is unchanged; background tokens keep their palette hex.

Added

• Next.js full-stack logging recipe — new RECIPES §12c: the full Logger on the server (pretty with original .ts positions in dev, JSON in production; optionally guarded with server-only) and tslog/lite in "use client" components, whose level methods are the bound native console.* functions — so the devtools file:line badge points at your component instead of a logger wrapper in a bundled chunk, and logged objects stay live and collapsible. The same split works for TanStack Start and other Vite-SSR frameworks.

[5.0.1] - 2026-07-16

A patch release that makes source-mapped error positions work out of the box with modern bundler output (Turbopack/Next.js dev, Rollup, Webpack) — verified end-to-end against live Next.js 16 (next dev --turbopack) and TanStack Start (Vite) dev servers — and fixes the default browser console output (error styling, stack parsing, log positions), verified in real Chromium, Firefox, and WebKit. No API or settings changes.

Added

• Framework E2E suite (e2e/, CI job test-e2e-apps) — boots real Next.js + Turbopack and TanStack Start + Vite dev servers against the packed tslog tarball and asserts that logged error frames and call-site positions resolve to the original .ts sources. The fixtures track the latest framework releases, so upstream bundler changes surface in CI instead of in user issues.

Fixed

• Indexed source maps (sections) — the resolver now understands the sectioned map format emitted by Turbopack (Next.js dev) and other concatenating bundlers: section offsets are walked, positions are shifted into the section's coordinate space, and per-section sub-maps (inline map or external url) resolve like flat maps. Previously such frames kept pointing at the generated chunk. Everything — including section sub-maps — is parsed once per file and cached, so logging through a sectioned map stays as cheap as through a flat one. Verified against real Rollup and Webpack (ts-loader) output in the test suite.
• Source-map resolution inside bundled server apps — bundlers rewrite tslog's dynamic require(name) into an always-throwing stub (Turbopack: "expression is too dynamic"), which silently disabled resolution in bundled apps even when the maps were fine. node:fs is now acquired via process.getBuiltinModule first (a plain runtime call bundlers leave untouched), with createRequire kept as the fallback for Node < 20.16.
• Percent-encoded sourceMappingURLs — the reference is a URL, so file names with [/] arrive percent-encoded (Turbopack: %5Broot-of-the-server%5D__x._.js.map); it is now decoded for the on-disk lookup, with the raw name as fallback for files literally containing %.
• Turbopack virtual source paths — bracket-prefixed sources such as [project]/src/app.ts now reduce to the clean project-relative src/app.ts in log output (as webpack:// sources already did) instead of being wrongly anchored to the map's directory.
• Caller detection around bundler runtime frames — unremapped Turbopack runtime chunks ([root-of-the-server]__….js, [turbopack]_runtime.js) are skipped when locating the user's call site.
• Browser console error styling — pretty-printed errors (logger.error(new Error(…))) reached the browser console carrying raw ANSI escape codes, which only Chromium's DevTools interprets; Firefox and Safari printed literal [97m[101m… noise. Error blocks are now re-expressed as %c CSS segments (same red badge and colors as the terminal output, styled in every engine); literal % in error text is escaped so it can never consume a %c style argument. When pretty.passObjectsNatively trails native args, the error text follows them ANSI-stripped instead.
• Browser stack parsing on dev servers — a host:port authority (i.e. every localhost:5173-style dev server) broke browser stack-frame matching, and root-level scripts (/app.js) were rejected by the parser's two-segment minimum: log-position meta came up empty and pretty errors printed a bare error stack: label with no frames. The scheme + authority is now stripped before path matching (the full URL still lands in fullFilePath), so filePath is consistently the origin-relative path — previously port-less hosts leaked into it as a bogus first segment (/example.com/script.js).
• Error message noise on Firefox/Safari — Firefox stamps fileName/lineNumber/columnNumber and WebKit line/column/sourceURL as own properties on every Error, and the pretty message line (which joins own properties) rendered them: Error http://localhost:5173/app.js, 3, 14, test. Engine position properties are now excluded, as is an own name property (the this.name = "HttpError" subclass pattern) — the name is already rendered as the error badge, so HttpError Not Found, HttpError, 404 collapses to HttpError Not Found, 404. Custom properties (err.code etc.) still join the message.
• Log position pointed into the tslog bundle for <script src>/CDN usage — the browser IIFE has no import.meta.url, so tslog couldn't recognize its own stack frames and caller auto-detection reported tslog's internal frame (tslog.js:24) as every log's position. The browser provider now detects the file it is served from at construction time (from a stack capture inside tslog code) and skips that file's frames — exact-match, so same-origin app scripts are unaffected, and when tslog is inlined into the app bundle behavior falls back to the previous first-frame result.

[5.0.0] - 2026-07-14

A ground-up rewrite. tslog is now ESM-only, zero-dependency, Node >=20, and built with TypeScript 7 / ES2022. Settings are grouped, JSON output is fields-first, and the logger gains a middleware pipeline, async transports, JSONPath masking, OpenTelemetry/pino/GenAI presets, ready-made file/http/ringbuffer/worker transports, and tree-shakeable subpath modules. v5 also adds first-class support for agents and LLMs — fields-first calls, agent/session correlation, and OTel-GenAI attributes; OpenClaw uses tslog for its agent logging. This is a breaking release — see https://github.com/fullstack-build/tslog/blob/master/MIGRATION_v4_to_v5.md for the upgrade path.

Added

• Grouped settings — related options now live under pretty, json, mask, stack, and meta groups instead of a flat list of prettyLog*/maskValues* keys. Sub-loggers merge groups rather than overwrite them.
• Fields-first JSON output — every level method is overloaded pino-style: info(fields, message?, ...args) as well as info(message, ...args). A single object spreads its fields to the top level, a leading object plus string spreads fields and sets message, and positional args land under message/"1"/… Runtime metadata moves under _logMeta carrying a v: 5 schema marker. All JSON keys are configurable via the json group.
• Middleware pipeline — logger.use(middleware) runs functions over each log context to mutate logObj/meta or drop the log entirely (return null/false).
• Async transports with attachTransport() returning a detach function, logger.flush(), and Symbol.asyncDispose/Symbol.dispose support (await using). Each transport may declare its own minLevel and format ("pretty", "json", or a custom formatter).
• Advanced masking — mask.paths (JSONPath-ish patterns such as user.password or *.token), mask.regex, and a mask.censor of "remove", "hash", a string, or a function (with mask.hashLabel).
• Presets — tslog/presets/pino (pinoFormat, pinoTransport, toPinoLevel), tslog/otel (otelFormat, toOtelRecord, levelToSeverityNumber, OtelSeverityNumber, otelTraceContext, stringifyOtelRecord), and tslog/presets/genai (genai, genaiAttributes, genaiSummary emitting OTel gen_ai.* fields).
• Built-in transports — tslog/transports/file (fileTransport, non-blocking, flush/dispose), tslog/transports/http (httpTransport, batched), tslog/transports/ringbuffer (ringBufferTransport with .dump()/.clear()), and tslog/transports/worker (workerTransport, Node-only off-thread sink I/O).
• Standard serializers — tslog/serializers exports stdSerializers (err, req, res, user), the individual serializers, and a serialize(map) middleware helper.
• Context propagation — runInContext(ctx, fn) uses AsyncLocalStorage to attach context fields to _logMeta when meta.attachContext is enabled. Auto-resolves on Node/Deno/Bun; on Cloudflare Workers inject one via the contextStorage setting (graceful no-op in browsers, with a one-time development warning).
• Custom levels via the customLevels setting and log(levelId, levelName, ...args).
• New API surface — child() (alias of getSubLogger()), isLevelEnabled(), getContext(), addLevel(), logger.if(condition), Logger.fromEnv(), defineConfig(), and TslogConfigError (thrown when strictConfig is on).

... (truncated)

Commits

• c857dd4 5.1.0
• 53aee8b Harden tslog/lite sub-loggers and document Sentry integration
• 1c7467c Add named sub-loggers to tslog/lite and document the full-stack retrofit
• fcc0961 5.0.2
• ce3db14 Bump docs workflow actions off deprecated Node 20 runtime
• 60929d0 Document Next.js full-stack logging with tslog/lite
• bfda3bc Keep default browser console styling readable on light devtools themes
• b766887 Merge pull request #350 from fullstack-build/dependabot/npm_and_yarn/lodash-4...
• 98506db Bump lodash from 4.17.23 to 4.18.1
• c43cf00 Merge pull request #349 from fullstack-build/dependabot/npm_and_yarn/postcss-...
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​tslog@​4.10.2 ⏵ 5.1.0

View full report