refactor: use sophisticated logger

[jase88]

fixes: #158

• add node logger with npm package pino. See GitHub or Docs
• Why pino?
  • one of the newer logging packages with very active community
  • node core member is maintainer
• add --verbosity level with options
  • debug
  • error
  • fatal
  • warn (default)
  • info
  • trace
  • silent
• all log streams are going through STDERR

[jkowalleck]

Thank you for the contribution, @jase88 .
I had a quick review and found some remarks.

[jase88]

Thank you for the contribution, @jase88 . I had a quick review and found some remarks.

Thank you @jkowalleck. I have made some changes and am happy to receive further feedback

[jkowalleck]

the node: notation, this might not work on node14.0 -- which is a supported branch.
will add additional CI tests and have it tested

[jkowalleck]

test run including node 14.0.0

https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/7114640707/job/19369091011?pr=1129

[jkowalleck]

tests with node14.0.0 do not complete due to a transitive dependency that is not installable.

[jkowalleck]

first of all, thanks you for the contribution.

Some (transitive) dependencies are not available for node14.0.0. see https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/7114640707/job/19369116439?pr=1129#step:4:2384
So the min-version of node would have to be adjusted. Meaning, this would be a breaking change. No worries, this is not a problem.
Anyway, I'd rather drop the support for color and such, than raising the deps.

I tried out your implementation, and here are the things i don't like:

• the output is sent to STDOUT, not STDERROR (even though the code suggests otherwise)
• the output is sent on program exit as a bulk, not in serial as soon as they are issued
• I do not like the output of a timestamp

[jase88]

Some (transitive) dependencies are not available for node14.0.0. see https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/7114640707/job/19369116439?pr=1129#step:4:2384 So the min-version of node would have to be adjusted. Meaning, this would be a breaking change. No worries, this is not a problem. Anyway, I'd rather drop the support for color and such, than raising the deps.

so raising to node >=14.17.0 would be no problem? or even raise it to 16 (node 14 security support ended 7 months ago).

• the output is sent to STDOUT, not STDERROR (even though the code suggests otherwise)

should be fixed by now.

• the output is sent on program exit as a bulk, not in serial as soon as they are issued

couldn't figure out why, will have a closer look at the docs next days.

• I do not like the output of a timestamp

you don't want to see any timestamp or you don't like the format of the timestamp?

[jase88]

• the output is sent on program exit as a bulk, not in serial as soon as they are issued

It is no bulk output at the end.

You can test it with some deferral like await new Promise(resolve => setTimeout(resolve, 20_000))

[jkowalleck]

• I do not like the output of a timestamp

you don't want to see any timestamp or you don't like the format of the timestamp?

Do not want to see any timestamps at all.

• the output is sent on program exit as a bulk, not in serial as soon as they are issued

It is no bulk output at the end.

for my tests, it was. for a second of delay no output was sent at all, then all was sent as a bulk. sometimes right BEFORE the SBOM, sometimes right after the SBOM.
try it:

$ ./bin/cyclonedx-npm-cli.js --verbosity debug 
{
  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "version": 1,
  ....
      "ref": "@oozcitak/url@1.0.4",
      "dependsOn": [
        "@oozcitak/infra@1.0.8",
        "@oozcitak/util@8.3.8"
      ]
    },
    {
      "ref": "@oozcitak/util@8.3.8"
    }
  ]
}[2023-12-07 12:02:20.950] DEBUG: options: {"verbosity":"debug","ignoreNpmErrors":false,"packageLockOnly":false,"omit":[],"flattenComponents":false,"shortPURLs":false,"specVersion":"1.4","outputFormat":"JSON","outputFile":"-","validate":true,"mcType":"application"}
[2023-12-07 12:02:20.951] DEBUG: packageFile: .../cyclonedx-node-npm/package.json
[2023-12-07 12:02:20.951] INFO: projectDir: .../cyclonedx-node-npm
[2023-12-07 12:02:20.951] DEBUG: detected a node_modules dir
[2023-12-07 12:02:20.953] DEBUG: BomBuilder > makeNpmRunner caused execSync "npm"
[2023-12-07 12:02:20.953] INFO: BomBuilder > detect NPM version ...
[2023-12-07 12:02:21.673] DEBUG: BomBuilder > detected NPM version '9.4.2'
[2023-12-07 12:02:21.673] INFO: BomBuilder > gather dependency tree ...
[2023-12-07 12:02:21.673] DEBUG: BomBuilder > npm-ls: run npm with ["ls","--json","--long","--all"] in '.../cyclonedx-node-npm'
[2023-12-07 12:02:23.267] INFO: BomBuilder > build BOM ...

[jkowalleck]

see #1131