edfcore 0.6.303 → 0.6.305

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.6.303";
+export declare const VERSION = "0.6.305";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.303';
+export const VERSION = '0.6.305';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,39 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.6.305
+
+- **Security.** Four advisories in the dev toolchain, all now closed — `npm audit` reports zero.
+  Nothing here touches what is published: `npm audit --omit=dev` already found none, because the
+  package has no runtime dependencies and that is a permanent constraint rather than a current
+  state.
+- Two **high**, both transitive and fixed in the lockfile alone: `nanoid` 3.3.16 to 3.3.20
+  (GHSA-2v37-7h3g-55p8, a custom generator looping indefinitely at size zero) and `source-map-js`
+  1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q, event-loop denial of service through indexed source-map
+  section offsets).
+- Two **moderate**, both GHSA-82fw-gwwq-j7x9 — path traversal and arbitrary file read via
+  `@vitest/mocker`'s redirect mock — which needed `vitest` itself, 4.1.10 to 4.1.11. `npm audit fix`
+  could not reach it: every dev dependency here except `@types/node` is pinned to an exact version,
+  so a fix inside the same minor still requires editing the manifest.
+- The whole suite was run on the new runner before this shipped: 9,191 tests across 628 files, and
+  `npm run check` green end to end.
+
+## 0.6.304
+
+- **Fixed** `actions/cache` sitting on `@v4` in the Corpus workflow, the one action in this
+  repository not on a current major. v4 targets the Node 20 runtime, which GitHub has deprecated and
+  is currently FORCING onto Node 24 — every run of the job printed "Node.js 20 is deprecated... being
+  forced to run on Node.js 24" — so it works only until the forcing stops. `v5.0.0` is exactly that
+  fix upstream, "Upgrade to use node24"; `v6.0.0` changes only internals, and `path` and `key` are
+  the inputs this step uses, which neither major touched.
+- The break would have been quiet, which is why it was worth doing now rather than when it happened:
+  it is the cache step, so the fetch below it still runs and the job still passes — it would simply
+  download ~102 MB from third-party servers every week instead of restoring. 0.6.303 is about the
+  other way this job had stopped reporting what it was built to report.
+- The pin is a floor of v5 rather than "the same major as its siblings": actions version
+  independently, and `cache` is at v6 while `checkout` and `setup-node` are at v7, so that rule
+  would have been false the day it was written.
+
 ## 0.6.303
 
 - **Fixed** the weekly Corpus workflow, which had been failing on every run. It executed `npm test`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.6.303",
+  "version": "0.6.305",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",
@@ -59,7 +59,7 @@
     "@types/node": "^26.1.2",
     "fast-check": "4.9.0",
     "typescript": "5.9.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "scripts": {
     "build": "tsc -p config/tsconfig.build.json",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.303';
+export const VERSION = '0.6.305';