Reduce package dependencies

[wildfiremedia]

Echo is great for writing complex app, simplify Echo go-isatty and go-colorable could be remove when we don't need any attractive indentation and colors on console?

github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
github.com/labstack/gommon v0.3.1 // indirect
github.com/mattn/go-colorable v0.1.12 // indirect
github.com/mattn/go-isatty v0.0.14 // indirect
github.com/valyala/bytebufferpool v1.0.0 // indirect
github.com/valyala/fasttemplate v1.2.1 // indirect

[aldas]

This probably will not happen in v4 but these dependencies are removed in v5. This is how go.mod would look like in v5

[wildfiremedia]

Great that I didn’t notice on v5, fasttemplate for logger seem like it’s a hard requirements. Could it alllw devs to choose between stdlib and fasttemplate? I have no issue with other packages.

https://github.com/labstack/echo/blob/8da8e161380fd926d4341721f0328f1e94d6d0a2/middleware/logger.go

[aldas]

There are 2 different logger middlewares that Echo provide. Old Logger and newer RequestLogger. RequestLogger allows you to choose how and what is logged by forcing you to implement logging function.

I think in 2022 it would make more sense to use newer logger middleware as you can use it with any of your favorite logging library (zap, zerolog etc)

See some of the examples in this file

echo/middleware/request_logger.go

Lines 20 to 33 in d5f8837

	// Example for Zerolog (https://github.com/rs/zerolog)
	// logger := zerolog.New(os.Stdout)
	// e.Use(middleware.RequestLoggerWithConfig(middleware.RequestLoggerConfig{
	// LogURI: true,
	// LogStatus: true,
	// LogValuesFunc: func(c echo.Context, v middleware.RequestLoggerValues) error {
	// logger.Info().
	// Str("URI", v.URI).
	// Int("status", v.Status).
	// Msg("request")
	//
	// return nil
	// },
	// }))

[wildfiremedia]

Thanks for the newer logger! I will use that. I think it’s a good time when the requirements for fasttemplate can be removed and devs can use the newer logger unlike in Java, most libraries are affected by Java Log4Shell vulnerabilities.

[wildfiremedia]

Assume on the fasttemplatr readme, one reason thst it doesn’t do escaping which could allows other devs to misuse for other purpose and more effort to audit.