edfcore 0.6.312 → 0.6.314

package/dist/constants.d.ts

@@ -109,5 +109,5 @@ export declare const SIGNAL_FIELD_BLOCK_OFFSETS: {
     readonly reserved: 224;
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export declare const VERSION = "0.6.312";
+export declare const VERSION = "0.6.314";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -79,5 +79,5 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
     reserved: 224,
 };
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.312';
+export const VERSION = '0.6.314';
 //# sourceMappingURL=constants.js.map

package/docs/CHANGELOG.md

@@ -6,6 +6,38 @@ alone does not tell you whether you were affected.
 edfcore is pre-1.0. Patch releases have carried behaviour changes where the old behaviour was a
 defect; those are called out below.
 
+## 0.6.314
+
+- `vitest` 4.1.12 to **5.0.5**, a major, with the whole suite green on it: 630 files, 9,199 tests,
+  and both typecheck configs.
+- Checked against this repository rather than taken on faith. Of 5.0's breaking changes, two could
+  have applied and neither did: `sequential` test and suite options were removed in favour of
+  `concurrent`, and nothing here used them — every `sequential` in `tests/` is prose or a local
+  variable; and `$` title variables in `test.each` no longer quote string values, which this suite
+  uses heavily (`'$name -> $annotation'`) but only ever for reporter output, never in an assertion.
+- The Node floor is satisfied across the matrix. 5.0 requires `^22.12.0 || ^24.0.0 || >=26.0.0`,
+  `engines.node` here is `>=22.12.0`, and `ci.yml` runs 22.12, 24 and 26 — all three inside it.
+- `npm audit` stays at zero.
+- Noted and not acted on: the new reporter suggests `isolate: false` for about 3.7 s of the run.
+  Test isolation is not a performance knob to trade away in a suite that builds multi-megabyte
+  fixtures per file, and `config/vitest.config.ts` already explains why its one timing-related
+  setting is a hang detector rather than a budget.
+
+## 0.6.313
+
+- **Security.** `vitest` 4.1.11 to 4.1.12, and `npm audit` is back to zero.
+- This is not a regression in 0.6.305. That release closed GHSA-82fw-gwwq-j7x9 — path traversal and
+  arbitrary file read via `@vitest/mocker`'s redirect mock — by taking the fix the advisory named at
+  the time, 4.1.11, against a stated range of `2.1.0 - 4.1.10`. **The advisory has since been
+  widened** to `<= 4.1.11`, with the fix moved to 4.1.12, so the version that was the remedy became
+  one of the affected ones.
+- Worth noting for anyone reading the audit on this repository: `npm audit fix` cannot apply either
+  of these on its own, because every dev dependency except `@types/node` is pinned exactly. A
+  same-minor security fix still needs a manifest edit here, so a clean `npm audit` is a thing to
+  check rather than a thing to assume.
+- Nothing published is affected — `npm audit --omit=dev` was zero throughout, since the package has
+  no runtime dependencies. The whole suite ran on the new runner first: 9,199 tests across 630 files.
+
 ## 0.6.312
 
 - TypeScript 5.9.3 to **6.0.3**, which Microsoft's own 6.0 announcement calls "the bridge between

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edfcore",
-  "version": "0.6.312",
+  "version": "0.6.314",
   "description": "Modern, typed, zero-dependency reader for EDF, EDF+, BDF and BDF+ biosignal files. Works in browsers and Node with true random access.",
   "keywords": [
     "edf",
@@ -59,7 +59,7 @@
     "@types/node": "^26.6.5",
     "fast-check": "4.10.2",
     "typescript": "6.0.3",
-    "vitest": "4.1.11"
+    "vitest": "5.0.5"
   },
   "scripts": {
     "build": "tsc -p config/tsconfig.build.json",

package/src/constants.ts

@@ -93,4 +93,4 @@ export const SIGNAL_FIELD_BLOCK_OFFSETS = {
 } as const;
 
 /** Published package version. Kept in sync with package.json by a test. */
-export const VERSION = '0.6.312';
+export const VERSION = '0.6.314';