edfcore 0.6.311 → 0.6.313

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.6.311";
+export declare const VERSION = "0.6.313";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.311';
+export const VERSION = '0.6.313';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,45 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.6.313
+
+- **Security.** `vitest` 4.1.11 to 4.1.12, and `npm audit` is back to zero.
+- This is not a regression in 0.6.305. That release closed GHSA-82fw-gwwq-j7x9 — path traversal and
+  arbitrary file read via `@vitest/mocker`'s redirect mock — by taking the fix the advisory named at
+  the time, 4.1.11, against a stated range of `2.1.0 - 4.1.10`. **The advisory has since been
+  widened** to `<= 4.1.11`, with the fix moved to 4.1.12, so the version that was the remedy became
+  one of the affected ones.
+- Worth noting for anyone reading the audit on this repository: `npm audit fix` cannot apply either
+  of these on its own, because every dev dependency except `@types/node` is pinned exactly. A
+  same-minor security fix still needs a manifest edit here, so a clean `npm audit` is a thing to
+  check rather than a thing to assume.
+- Nothing published is affected — `npm audit --omit=dev` was zero throughout, since the package has
+  no runtime dependencies. The whole suite ran on the new runner first: 9,199 tests across 630 files.
+
+## 0.6.312
+
+- TypeScript 5.9.3 to **6.0.3**, which Microsoft's own 6.0 announcement calls "the bridge between
+  TypeScript 5.9 and 7.0". 7.0 is the native Go port and is deliberately not taken here: it ships no
+  compiler API until 7.1, and the documented migration runs through 6.0 — "practically any TypeScript
+  code that compiles cleanly with TypeScript 6.0... should compile identically in TypeScript 7.0".
+- **The emitted output is byte-identical.** All 55 declaration files, their maps and the JavaScript
+  are unchanged across the compiler major, which is the evidence that matters for a package whose
+  `.d.ts` is its public surface. `verify:package` and `verify:tarball` both pass.
+- Nothing in the three tsconfigs needed changing: `rootDir`, `types`, `target`, `module` and
+  `moduleResolution` are all set explicitly, so none of 6.0's default flips applied, and none of the
+  options it removed — `baseUrl`, `outFile`, `downlevelIteration`, `node10`, `classic` — was in use.
+- **What did break: three test harnesses that shell out to `tsc <file>`.** TypeScript 6 refuses named
+  files when a `tsconfig.json` sits in the working directory — TS5112 — where 5.9 ignored the config
+  silently. `demo-sample.test.ts` compiles the inspector's sample generator, and
+  `doc-snippets-compile.test.ts` and `documented-signatures.test.ts` compile the documentation
+  examples and the printed signatures. All three pass `--ignoreConfig` now; the flags they already
+  passed were the whole configuration, so the refusal was never about a setting they needed.
+- `doc-snippets-compile.test.ts` caught its own harness breaking, by the assertion written for
+  exactly that — "Fragments MUST produce diagnostics. Zero of them would mean tsc never ran". It
+  failed with `expected 0 to be greater than 10` rather than passing on an empty run.
+- `demo-sample.test.ts`'s docblock had stated the old behaviour as its design premise — "`tsc`
+  invoked on a named file reads no tsconfig at all" — and is corrected.
+
 ## 0.6.311
 
 - **Fixed** the documentation site being built in CI from versions nobody developing it would have.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.6.311",
+  "version": "0.6.313",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",
@@ -58,8 +58,8 @@
     "@biomejs/biome": "2.5.15",
     "@types/node": "^26.6.5",
     "fast-check": "4.10.2",
-    "typescript": "5.9.3",
-    "vitest": "4.1.11"
+    "typescript": "6.0.3",
+    "vitest": "4.1.12"
   },
   "scripts": {
     "build": "tsc -p config/tsconfig.build.json",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.311';
+export const VERSION = '0.6.313';