v2 beta - switch from lodash to es-toolkit and add features

[cuzzlor]

1 Problem: ESM output does not work, only CJS works

The prior PR adding dual ESM + CJS output does not actually work for ESM due to the continued use of CJS only lodash.
Lodash does not have a single dual output library, lodash-es is ESM only.

We cannot just replace lodash with a simple function because the omit-by-dot-notation keys functionality is important and is used for omit logging config.

Solution

Swap to es-toolkit which provides modern dual ESM + CJS output with 100% lodash compatibility.

Implementation notes

• Bumping to the next major version, since consumers will no longer get "full lodash" installed automatically via the peer dep.
• Keeping use of es-toolkit as a peer dep vs hard dep, since:
  • we don't want to force version numbers or constantly update this package past vulnerabilities
  • we expect ESM consumers may prefer opting in to control and use the version of es-toolkit at the consumer level (no loss)

2 Problem: formats (e.g. for omitPaths applied to console transport)

... however OTEL does not receive log data at the transport level, so this would not apply for OTEL received log data

• Refactor application of formats to the logger level so that omitPaths and other format-based options apply equally to all log output regardless of transport

3 Add functionality we normally use:

• New redactPaths / redactedValue options replace values at dot-notation paths across every transport. Also available as the standalone redactFormat, and the redactValues / redactValuesWith helpers for direct use.
• New flatten / flattenReplacer options serialise every top-level value on the log info to a JSON string, producing a flat { key: string } shape suited to OTEL + Azure Log Analytics and other scalar-only aggregators..
• Errors nested inside structured metadata are now fully serialised at the logger level (not just the Console transport) via the new serializeErrorFormat. It walks the whole info object — including nested objects and arrays — replacing every Error with a plain object that carries name, message and stack.
• Add audit log level by default
• createLogger is now generic over the level map. When you pass loggerOptions.levels, the returned logger's method signatures narrow to your level keys (logger.fatal(...) becomes valid, logger.audit becomes a type error).

[Copilot]

Pull request overview

This PR fixes broken ESM consumption by replacing lodash (CJS-only) imports with es-toolkit/compat (dual ESM+CJS), and bumps the package major version to reflect the peer dependency change.

Changes:

• Replace lodash imports with es-toolkit/compat in the omit-related winston formats.
• Swap the peer dependency from lodash to es-toolkit and remove @types/lodash.
• Update README to reference es-toolkit omit docs and bump package major version.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/omit-nil-format.ts	Switch isNil/omitBy import to es-toolkit/compat for ESM compatibility.
src/omit-format.ts	Switch omit import to es-toolkit/compat for ESM compatibility.
package.json	Major version bump; peer dep swap from lodash to es-toolkit; remove @types/lodash.
package-lock.json	Reflect peer dep swap and lockfile package entries.
README.md	Update docs link/wording to reference es-toolkit compat omit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.