v5.0.0

Breaking Changes

• Empty-record skipping is enabled by default in the parser, file validation and CLI. It now includes delimiter-only and quoted-empty records; quoted whitespace remains data. Set skipEmptyLines: false or use csv-parser input.csv --no-skip-empty-lines to preserve empty records. Strict physical widths still apply, except for skipped unquoted blank/whitespace-only lines. Nonboolean empty-skipping options are rejected.

Features

• Opt-in sanitizeRightPadding removes only a contiguous suffix of exactly empty source header names. Interior unnamed columns, named columns and deliberately named mapped headers remain. Any nonempty discarded cell, including whitespace, fails before value mapping; strict widths use the original physical schema.
• validateFiles and replayFiles support ordered multipart preflight/replay with frozen schema, retained-boundary and cleanup metadata. Optional file-only sanitizeBottom removes the final empty-record suffix across the logical set. Parts are parsed independently, without buffering the empty suffix or modifying sources.

Ordinary streams do not trim bottom records and may emit earlier rows before a later padding error. Complete preflight before destructive work; keep source bytes and deterministic mappings unchanged between validation and replay. Strict delimiter/quoted-empty width errors and enabled strict quote errors remain fatal at EOF. Native ESM and Node.js ^22.22.2 || >=24.15.0 support are unchanged.

Full Changelog: v4.3.0...v5.0.0

v4.3.0

Features

• Add opt-in skipEmptyLines to the parser, validateFile, TypeScript options and CLI. Empty and whitespace-only unquoted records are skipped without dropping quoted blanks or delimiter-only records; existing defaults are unchanged.

Improvements

• Assemble fragmented records once instead of repeatedly copying their growing prefix.
• Honor readable backpressure within input chunks and release parser-owned final-record references at EOF. Memory still depends on the current record, input chunk and caller-retained raw buffers; performance varies by workload.

Bugfixes

• Recognize complete comment markers before CSV quotes, including Unicode markers split across chunks.
• Terminate on strict width errors and reject colliding overflow row keys instead of losing values.
• Correct CLI handling of strict mode, removed columns, custom quotes and escapes, bare/custom comment markers, and stream failures. For a bare comment flag with file input, use csv-parser input.csv --skipComments; a following value remains a custom marker.
• Make the checkout benchmark count rows without retaining them and await pipeline completion.

Native ESM, the Node.js requirement (^22.22.2 || >=24.15.0) and zero runtime dependencies are unchanged. Data Loader consumer adoption remains separate and deferred.

Full Changelog: v4.2.0...v4.3.0

v4.2.0

Features

• Add opt-in bom: true to the parser factory and validateFile to remove exactly one leading UTF-8 BOM, including BOM bytes split across stream chunks and raw-mode input.
• Preserve original-input byte offsets, while excluding the removed BOM from maxRowBytes. Supplied headers are unchanged; later BOMs remain data.

The option defaults to false, preserving existing behavior. This does not add encoding conversion or a CLI --bom flag. Data Loader adoption is separate.

Full Changelog: v4.1.1...v4.2.0

v4.1.1

Chores

• Refresh development dependencies, including AVA, JSDoc linting, benchmark helpers and subprocess tooling.
• Update Unicorn to version 79 and adapt the affected checks, with additional quote-boundary and invalid-path regressions.

The parser API, CSV/TSV behavior, CLI, TypeScript declarations and Node.js requirement remain unchanged. The package still has no runtime dependencies. Data Loader adoption is separate and deferred.

Full Changelog: v4.1.0...v4.1.1

v4.1.0

Features

• Add the named validateFile(path, optionsOrHeaders?) export to stream a whole CSV or TSV file through the same parser and return effective headers plus a data-record count without retaining rows or caching validation results.
• Add opt-in strictQuotes: true checking for unterminated quoted fields and invalid characters after a closing quote. It is independent of strict column-count validation; both remain disabled by default.

The default factory API, CLI and Node.js requirement are unchanged. Empty and header-only files can validate successfully with zero data records; applications must enforce their own nonempty policy. Validation does not guarantee source-file identity or transactions. Data Loader adoption remains separate and deferred.

Full Changelog: v4.0.7...v4.1.0

v4.0.7

Development tooling

• Upgrade AVA from 3.15.0 to 8.1.1, migrate callback-based tests to awaited checks, and update the coverage runner for the current AVA CLI.
• Migrate snapshot containers without changing saved expected values.
• Fresh same-registry audits report development findings decreasing from five moderate findings to zero; production findings remain at zero. These results reflect the advisories returned during that audit window, not historical totals or a guarantee against future advisories.

Parser behavior, the native ESM API, CLI, declarations and Node.js requirement are unchanged. Runtime dependencies remain at zero.

Full Changelog: v4.0.6...v4.0.7

v4.0.6

Bugfixes

• Discard records selected by skipLines before calling mapValues. Explicit-header and headerless mappings no longer receive skipped header or preamble values, avoiding unwanted callback side effects and conversion errors.
• Preserve inferred headers, comment counting, quoted multiline record boundaries, record-size limits, and byte offsets into the original input.

Related upstream reports

This fork corrects the skipped-record callback behavior described in these records; it does not claim the upstream issue or pull request is closed.

mafintosh#222
mafintosh#254

Full Changelog: v4.0.5...v4.0.6

v4.0.5

Bugfixes

• Preserve explicit __proto__ columns as ordinary own data properties, including raw Buffer values and object-valued mapValues results, without replacing an individual row's prototype. String values are retained too.
• Rows retain their ordinary Object.prototype. Existing inferred dangerous-header removal and duplicate-header rejection remain unchanged. This fixes row-local prototype mutation; it does not claim global Object.prototype pollution or resolve every scenario described upstream.

Related upstream reports

These records concern dangerous header names. The related pull request sanitizes inferred headers; this fork's correction addresses the remaining explicit-header write path.

mafintosh#247
mafintosh#250

Full Changelog: v4.0.4...v4.0.5

v4.0.4

Bugfixes

• Restore named row properties when raw: true infers headers. Headers are decoded as UTF-8 strings before mapHeaders and sanitization, while data cells remain Buffers, including Unicode and empty values.
• Preserve duplicate-header rejection and dangerous inferred-header removal. Explicit headers and headers: false are unchanged.

This independently implemented fork correction addresses the raw-header problem described in the related upstream records below; it does not claim those upstream records are closed.

mafintosh#251
mafintosh#252

Full Changelog: v4.0.3...v4.0.4

v4.0.3

Bugfixes

• Reject duplicate retained header names by default instead of silently overwriting earlier column values. Explicit header arrays fail when the parser is created; inferred headers fail after mapping and sanitization, before the first data row is emitted, so no import row is produced from that parser stream.
• This is an intentional duplicate-input behavior correction in the 4.0.3 patch. Empty names are checked; removed columns and headers: false retain their behavior. The fork rejects ambiguous input rather than renaming columns, collecting arrays or keeping the last value.
• Valid CSV/TSV values, native ESM API and streaming behavior are unchanged. This parser validation does not guarantee transaction or pre-clear safety in importing consumers. Consumer adoption is not part of this release.

Related original upstream reports, addressed independently in this fork; no upstream closure is claimed:

mafintosh#224
mafintosh#218

Full Changelog: v4.0.2...v4.0.3