edfcore 0.6.304 → 0.6.306

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.6.304";
+export declare const VERSION = "0.6.306";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.304';
+export const VERSION = '0.6.306';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,36 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.6.306
+
+- **Fixed** CI typechecking against older Node types than a contributor's machine resolves. The
+  lockfile pinned `@types/node` at 26.1.2 while the manifest range was `^26.1.2` and 26.6.5 was
+  current — and every workflow installs with `npm ci`, which honours the lockfile, whereas a fresh
+  clone running `npm install` takes the newest match in the range.
+- So the two disagreed by five minor versions of the type definitions for the runtime this package
+  targets, in a repository whose `typecheck` script runs **two** configs specifically to control what
+  can see Node and DOM globals. A type error introduced against one would pass on the other, in
+  whichever direction the author happened not to be.
+- Lockfile and range both now name 26.6.5. Nothing in `src/` changed: both typecheck configs are
+  clean against the newer definitions, and the suite is unchanged at 9,191 tests across 628 files.
+
+## 0.6.305
+
+- **Security.** Four advisories in the dev toolchain, all now closed — `npm audit` reports zero.
+  Nothing here touches what is published: `npm audit --omit=dev` already found none, because the
+  package has no runtime dependencies and that is a permanent constraint rather than a current
+  state.
+- Two **high**, both transitive and fixed in the lockfile alone: `nanoid` 3.3.16 to 3.3.20
+  (GHSA-2v37-7h3g-55p8, a custom generator looping indefinitely at size zero) and `source-map-js`
+  1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q, event-loop denial of service through indexed source-map
+  section offsets).
+- Two **moderate**, both GHSA-82fw-gwwq-j7x9 — path traversal and arbitrary file read via
+  `@vitest/mocker`'s redirect mock — which needed `vitest` itself, 4.1.10 to 4.1.11. `npm audit fix`
+  could not reach it: every dev dependency here except `@types/node` is pinned to an exact version,
+  so a fix inside the same minor still requires editing the manifest.
+- The whole suite was run on the new runner before this shipped: 9,191 tests across 628 files, and
+  `npm run check` green end to end.
+
 ## 0.6.304
 
 - **Fixed** `actions/cache` sitting on `@v4` in the Corpus workflow, the one action in this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.6.304",
+  "version": "0.6.306",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",
@@ -56,10 +56,10 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.6",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.6.5",
     "fast-check": "4.9.0",
     "typescript": "5.9.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "scripts": {
     "build": "tsc -p config/tsconfig.build.json",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.304';
+export const VERSION = '0.6.306';