build(deps-dev): bump eventsource from 4.1.1 to 5.1.0

[dependabot]

Bumps eventsource from 4.1.1 to 5.1.0.

Release notes

Sourced from eventsource's releases.

v5.1.0

Minor Changes

• #355 d8370e4 Thanks @​rexxars! - Typed response body chunks as buffers instead of unknown

  ReaderLike typed chunks read off the response body as unknown, but they are handed to a TextDecoder, which only accepts buffers and throws on anything else. So a reader yielding anything else was never usable, and the type said otherwise. It also hid a type error in the client itself, which only surfaces when compiling against TypeScript's dom library: the node typings resolve the chunk to any, while the dom library resolves it to {}.

  Chunks are now typed as Uint8Array | DataView | ArrayBuffer, which is what both the node and DOM typings accept, and which every fetch() implementation yields. Nothing changes at runtime.

  If you pass a custom fetch() that returns a hand-rolled body, and your reader's chunk type is wider than the above, eg unknown or any, it will no longer be assignable. Returning a real Response, or a reader that yields Uint8Array chunks, is unaffected.

• #355 008f07e Thanks @​rexxars! - Declared the this type for the onerror, onmessage and onopen properties

  addEventListener() already declared that listeners are called with the EventSource instance as this, but the on* properties did not, so this was an implicit any in handlers assigned to them (an error under noImplicitThis). They now match addEventListener() and the native EventSource:

  eventSource.onmessage = function (event) {
    console.log(this.url, event.data) // `this` is now typed
  }

  Handlers that declare an incompatible this, eg an unbound class method typed with this: MyClass, will now be rejected where they were previously accepted. Arrow functions and handlers that ignore this are unaffected.

• #355 3512add Thanks @​rexxars! - Made the exported EventSource type structural, so other implementations can satisfy it

  EventSource was exported as a class holding hard-private (#) fields, which makes TypeScript emit a #private brand into the declaration file and turns the exported type nominal. A consumer writing function connect(es: EventSource) against this package could not pass the native EventSource, a mock, or any other implementation, even when the shape matched exactly.

  The implementation class is now internal, and EventSource is exported as an interface plus a const holding the constructor. As a result:

  • The native EventSource, along with mocks and stubs, is assignable to the exported EventSource type
  • The exported value and globalThis.EventSource are interchangeable in both directions, which helps libraries that accept an EventSource implementation to construct
  • A new EventSourceConstructor type is exported for that case

  Nothing changes at runtime: new EventSource(...), instanceof, subclassing, the readyState statics, EventSource.name, inspected output and the eventsource.supports-fetch-override symbol all behave as before, and the internal state is still held in real #private fields.

Patch Changes

• #357 8e5c691 Thanks @​rexxars! - Fixed origin and lastEventId being empty on Cloudflare Workers

  workerd accepts data from the MessageEvent constructor's init dictionary but silently drops origin and lastEventId, so message events dispatched on Cloudflare Workers arrived with origin set to null and lastEventId to an empty string. Both are now assigned explicitly when the constructor did not take them, which leaves every other runtime untouched.

v5.0.0

Major Changes

• #349 b195e70 Thanks @​rexxars! - - BREAKING CHANGE: The client now fails the connection, emitting an error without reconnecting, if the parser buffers 100 MB without receiving a valid, complete EventSource line. Configure a different limit with maxBufferSize; ideally, servers should emit smaller chunks or newlines more frequently.
  • BREAKING CHANGE: Node.js 22.12 or later is now required. Older Node.js versions may still work, but are not supported or guaranteed going forward because Node.js 20 is out of LTS.
  • BREAKING CHANGE: The separate CommonJS variant is no longer published. Node.js 22.12 and later transparently supports require() of ESM, so most CommonJS consumers should continue to work. This removes the dual-package hazard.
  • BREAKING CHANGE: Chrome versions before 84, Safari before 15, Firefox before 105, Edge before 84, and JavaScript environments without private fields, methods, and accessors are no longer supported.
  • BREAKING CHANGE: When both an on* property handler and an addEventListener() listener are registered for the same event, they now run in registration order instead of always running the on* handler first. Code that relied on the old order can observe a different callback sequence.
  • Unref reconnection timers where the runtime supports it, so pending reconnects do not keep the process alive.

Changelog

Sourced from eventsource's changelog.

5.1.0

Minor Changes

• #355 d8370e4 Thanks @​rexxars! - Typed response body chunks as buffers instead of unknown

  ReaderLike typed chunks read off the response body as unknown, but they are handed to a TextDecoder, which only accepts buffers and throws on anything else. So a reader yielding anything else was never usable, and the type said otherwise. It also hid a type error in the client itself, which only surfaces when compiling against TypeScript's dom library: the node typings resolve the chunk to any, while the dom library resolves it to {}.

  Chunks are now typed as Uint8Array | DataView | ArrayBuffer, which is what both the node and DOM typings accept, and which every fetch() implementation yields. Nothing changes at runtime.

  If you pass a custom fetch() that returns a hand-rolled body, and your reader's chunk type is wider than the above, eg unknown or any, it will no longer be assignable. Returning a real Response, or a reader that yields Uint8Array chunks, is unaffected.

• #355 008f07e Thanks @​rexxars! - Declared the this type for the onerror, onmessage and onopen properties

  addEventListener() already declared that listeners are called with the EventSource instance as this, but the on* properties did not, so this was an implicit any in handlers assigned to them (an error under noImplicitThis). They now match addEventListener() and the native EventSource:

  eventSource.onmessage = function (event) {
    console.log(this.url, event.data) // `this` is now typed
  }

  Handlers that declare an incompatible this, eg an unbound class method typed with this: MyClass, will now be rejected where they were previously accepted. Arrow functions and handlers that ignore this are unaffected.

• #355 3512add Thanks @​rexxars! - Made the exported EventSource type structural, so other implementations can satisfy it

  EventSource was exported as a class holding hard-private (#) fields, which makes TypeScript emit a #private brand into the declaration file and turns the exported type nominal. A consumer writing function connect(es: EventSource) against this package could not pass the native EventSource, a mock, or any other implementation, even when the shape matched exactly.

  The implementation class is now internal, and EventSource is exported as an interface plus a const holding the constructor. As a result:

  • The native EventSource, along with mocks and stubs, is assignable to the exported EventSource type
  • The exported value and globalThis.EventSource are interchangeable in both directions, which helps libraries that accept an EventSource implementation to construct
  • A new EventSourceConstructor type is exported for that case

  Nothing changes at runtime: new EventSource(...), instanceof, subclassing, the readyState statics, EventSource.name, inspected output and the eventsource.supports-fetch-override symbol all behave as before, and the internal state is still held in real #private fields.

Patch Changes

• #357 8e5c691 Thanks @​rexxars! - Fixed origin and lastEventId being empty on Cloudflare Workers

  workerd accepts data from the MessageEvent constructor's init dictionary but silently drops origin and lastEventId, so message events dispatched on Cloudflare Workers arrived with origin set to null and lastEventId to an empty string. Both are now assigned explicitly when the constructor did not take them, which leaves every other runtime untouched.

5.0.0

Major Changes

• #349 b195e70 Thanks @​rexxars! - - BREAKING CHANGE: The client now fails the connection, emitting an error without reconnecting, if the parser buffers 100 MB without receiving a valid, complete EventSource line. Configure a different limit with maxBufferSize; ideally, servers should emit smaller chunks or newlines more frequently.
  • BREAKING CHANGE: Node.js 22.12 or later is now required. Older Node.js versions may still work, but are not supported or guaranteed going forward because Node.js 20 is out of LTS.
  • BREAKING CHANGE: The separate CommonJS variant is no longer published. Node.js 22.12 and later transparently supports require() of ESM, so most CommonJS consumers should continue to work. This removes the dual-package hazard.
  • BREAKING CHANGE: Chrome versions before 84, Safari before 15, Firefox before 105, Edge before 84, and JavaScript environments without private fields, methods, and accessors are no longer supported.
  • BREAKING CHANGE: When both an on* property handler and an addEventListener() listener are registered for the same event, they now run in registration order instead of always running the on* handler first. Code that relied on the old order can observe a different callback sequence.

... (truncated)

Commits

• c0f4cef chore(release): version packages (#356)
• 28fae57 test: allow cloudflare workers suite to pass
• b2a77c2 test: allow happy-dom suite to pass
• e24d2fa ci: stop known-failing suites from marking commits red
• 3da1ae8 docs: note partial Cloudflare Workers support
• 8e5c691 fix: set MessageEvent origin and lastEventId on runtimes that drop them
• a1bdb09 test: replace waffletest with vitest across six environments
• 1c87ac4 chore: reformat
• f5ebb9d chore: set package manager field
• d8370e4 fix(types): type response body chunks as buffers
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)