docs: add deprecation notice recommending @vekexasia/bigint-buffer2

[vekexasia]

Summary

This PR adds a deprecation notice to the README and package.json, recommending users migrate to @vekexasia/bigint-buffer2.

Why deprecate bigint-buffer?

1. Security Vulnerability (CVE-2025-3194)

This package contains a known buffer overflow vulnerability (SNYK-JS-BIGINTBUFFER-3364597) that can crash applications when null is passed to toBigIntLE() or toBigIntBE(). This has been open since March 2023 with no fix.

2. Multiple Unresolved Issues

Several critical issues remain unaddressed:

• Issue Core dump when calling toBufferLE with length 0 #40: Core dump with width 0
• Issue Buffer Overflow #59: Buffer overflow with large values
• Issue First conversion sometimes returns array with all zeros. #12: First conversion returns zeros
• Issue Assertion failed: (status == napi_ok), function fromBigInt, file ../src/bigint-buffer.c, line 132. #22: Assertion failures with large values

3. Outdated Build System

The package uses deprecated N-API bindings with node-gyp, which:

• Requires Python and a C++ compiler on user machines
• Often fails to build on newer Node.js versions
• Has compatibility issues across platforms

4. No Maintenance Activity

The last commit was over 4 years ago, and there are 11 open issues with no response.

Why @vekexasia/bigint-buffer2?

It's a modern, drop-in replacement that:

• Fixes all known vulnerabilities - Comprehensive test coverage for CVE-2025-3194 and all reported issues
• Modern Rust bindings - Uses napi-rs instead of node-gyp, no build-time compilation needed
• Browser support - Automatic JS fallback, works everywhere
• TypeScript native - Full type definitions included
• API compatible - Same function signatures, just change the import
• Additional features - Signed integer support, zero-allocation toBufferBEInto/toBufferLEInto

Suggested npm deprecation

If you agree with this deprecation, please also run:

npm deprecate bigint-buffer "This package is deprecated. Please use @vekexasia/bigint-buffer2 instead - it fixes security vulnerabilities and is actively maintained."

This will show a warning to users when they install the package.

Changes

• Added deprecation notice to README with migration instructions
• Updated package.json description to indicate deprecation