fix(deps): upgrade winston to 3.19.0

[wayne-grant]

Snyk has created this PR to upgrade winston from 3.17.0 to 3.19.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 5 versions ahead of your current version.

• The recommended version was released 3 months ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: winston

• 3.19.0 - 2025-12-07
  
  • Run npm audit fix e7ccdc4
  • Don't include jest.config.js in npm package 5a63c8c
  • fix: append error cause when using logger.child() (#2467) e74a7ae
  • Bump rimraf from 5.0.1 to 5.0.10 (#2517) 8a956fd
  • fix: ensure File transport flushes all data before emitting finish (#2594) 86c890f
  • Bump actions/setup-node from 4 to 6 (#2589) 3b8be02
  • Bump @ babel/core from 7.28.0 to 7.28.5 (#2591) f4c3e2c
  • Bump actions/checkout from 4 to 6 (#2593) dd7906e
  • chore: migrate test runner from mocha to jest (#2567) 2e9eb18

  ---

  v3.18.3...v3.19.0

• 3.18.3 - 2025-09-30
  
  • Update diagnostics dependency (removes fix-esm transitive dependency) a15a9e9

  ---

  v3.18.2...v3.18.3

• 3.18.2 - 2025-09-30
  
  • Bump diagnostics package to resolve #2583 (again) f4582c3

  ---

  v3.18.1...v3.18.2

• 3.18.1 - 2025-09-30
  
  • Bump diagnostics package to resolve #2583 e668c2c

  ---

  v3.18.0...v3.18.1

• 3.18.0 - 2025-09-30
  
  • Update diagnostics package to latest version to remove vulnerability 376e331
  • add @ initd.sg/winston-cloudwatch (#2532) 71ee92a
  • Update transports.md (#2549) 3547a95
  • docs: update transport.md (#2550) dc88db0
  • feat: adds helper function for highest log level (#2514) c69cdb0

  ---

  v3.17.0...v3.18.0

• 3.17.0 - 2024-11-10
  
  • Try winston-transport 4.9.0 3e87128
  • Revert "Try bumping winston-transport to 4.8.0" 69625fc
  • Revert "Try bumping winston-transport to 4.8.0" 876ef7a
  • Try bumping winston-transport to 4.8.0 7ef2c1d
  • Try bumping winston-transport to 4.8.0 fe4b64e
  • Bump logform c9fd9a4
  • Revert "Update logform and winston-transport" 14fef0f
  • Merge branch 'master' of github.com:winstonjs/winston 545b683
  • Update logform and winston-transport cceb265
  • Bump mocha from 10.7.3 to 10.8.2 (#2523) bb529b6
  • Bump async from 3.2.5 to 3.2.6 (#2516) ae847ab

  v3.16.0...v3.17.0

from winston GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Snyk has automatically assigned this pull request, set who gets assigned.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 👩‍💻 Set who automatically gets assigned
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[wayne-grant]

This minor version upgrade for winston includes bug fixes, dependency updates, and one notable change to its TypeScript definitions.

• TypeScript Definition Change: In version 3.19.0, the LogCallback type was removed. According to the release notes, this callback was not functionally supported by the library, so any code relying on it was not being executed. This change may cause build failures in TypeScript projects that reference this type, but it should not impact runtime behavior.
• Other Changes: The releases between 3.17.0 and 3.19.0 consist of bug fixes and dependency updates, including a security fix for a transitive dependency in v3.18.0.

Recommendation:
If you are using TypeScript and referencing the LogCallback type, you will need to remove those references. Otherwise, no action is required.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
🔚	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.