[dependabot]

Bumps eventsource from 2.0.2 to 5.1.4.

Release notes

Sourced from eventsource's releases.

v5.1.4

Patch Changes

• #372 0769591 Thanks @​edsonsims! - Copy URL objects during construction so later caller mutations do not change the exposed URL or reconnection target.

v5.1.3

Patch Changes

• #369 d3fe0d3 Thanks @​rexxars! - Accept case variations of text/event-stream and reject different MIME subtypes such as text/event-streaming.

• #370 02634eb Thanks @​rexxars! - Avoid double-encoding non-ASCII event IDs when reconnecting with Cloudflare Workers' native fetch.

• #367 fd62d79 Thanks @​OsamaAnsar! - Fixed Last-Event-ID not being sent as UTF-8 on reconnect

  The event ID was passed to fetch() as a plain string header value, but header values are byte strings. An ID containing a character above U+00FF, eg €, made fetch() throw a TypeError on every reconnect attempt, so the connection was never re-established. An ID with characters in the U+0080 to U+00FF range, eg é, was sent as a single Latin-1 byte instead of its UTF-8 encoding. The header now carries the UTF-8 bytes of the ID, as the specification requires.

v5.1.2

Patch Changes

• #363 c4d6b9a Thanks @​brennanbutler01! - Abort the underlying request when a response fails EventSource validation.

• #362 627eb17 Thanks @​brennanbutler01! - Stop dispatching buffered messages when an event listener closes the connection.

v5.1.1

Patch Changes

• #358 de3c0ae Thanks @​pacocartones! - Fixed MessageEvent.lastEventId being empty when a message omits the id field

  The lastEventId attribute is the last event ID string of the event source, so an explicit id field persists until another one replaces it. Message events were dispatched with the current event's own id instead of that buffer, which left lastEventId empty on every event that omitted id, even though the buffer still held the earlier value and would have been sent as Last-Event-ID on reconnect.

• 17a9772 Thanks @​rexxars! - Fixed ID-only event blocks not updating MessageEvent.lastEventId or Last-Event-ID on reconnect.

v5.1.0

Minor Changes

• #355 d8370e4 Thanks @​rexxars! - Typed response body chunks as buffers instead of unknown

  ReaderLike typed chunks read off the response body as unknown, but they are handed to a TextDecoder, which only accepts buffers and throws on anything else. So a reader yielding anything else was never usable, and the type said otherwise. It also hid a type error in the client itself, which only surfaces when compiling against TypeScript's dom library: the node typings resolve the chunk to any, while the dom library resolves it to {}.

  Chunks are now typed as Uint8Array | DataView | ArrayBuffer, which is what both the node and DOM typings accept, and which every fetch() implementation yields. Nothing changes at runtime.

  If you pass a custom fetch() that returns a hand-rolled body, and your reader's chunk type is wider than the above, eg unknown or any, it will no longer be assignable. Returning a real Response, or a reader that yields Uint8Array chunks, is unaffected.

• #355 008f07e Thanks @​rexxars! - Declared the this type for the onerror, onmessage and onopen properties

  addEventListener() already declared that listeners are called with the EventSource instance as this, but the on* properties did not, so this was an implicit any in handlers assigned to them (an error under noImplicitThis). They now match addEventListener() and the native EventSource:

  eventSource.onmessage = function (event) {
    console.log(this.url, event.data) // `this` is now typed

... (truncated)

Changelog

Sourced from eventsource's changelog.

5.1.4

Patch Changes

• #372 0769591 Thanks @​edsonsims! - Copy URL objects during construction so later caller mutations do not change the exposed URL or reconnection target.

5.1.3

Patch Changes

• #369 d3fe0d3 Thanks @​rexxars! - Accept case variations of text/event-stream and reject different MIME subtypes such as text/event-streaming.

• #370 02634eb Thanks @​rexxars! - Avoid double-encoding non-ASCII event IDs when reconnecting with Cloudflare Workers' native fetch.

• #367 fd62d79 Thanks @​OsamaAnsar! - Fixed Last-Event-ID not being sent as UTF-8 on reconnect

  The event ID was passed to fetch() as a plain string header value, but header values are byte strings. An ID containing a character above U+00FF, eg €, made fetch() throw a TypeError on every reconnect attempt, so the connection was never re-established. An ID with characters in the U+0080 to U+00FF range, eg é, was sent as a single Latin-1 byte instead of its UTF-8 encoding. The header now carries the UTF-8 bytes of the ID, as the specification requires.

5.1.2

Patch Changes

• #363 c4d6b9a Thanks @​brennanbutler01! - Abort the underlying request when a response fails EventSource validation.

• #362 627eb17 Thanks @​brennanbutler01! - Stop dispatching buffered messages when an event listener closes the connection.

5.1.1

Patch Changes

• #358 de3c0ae Thanks @​pacocartones! - Fixed MessageEvent.lastEventId being empty when a message omits the id field

  The lastEventId attribute is the last event ID string of the event source, so an explicit id field persists until another one replaces it. Message events were dispatched with the current event's own id instead of that buffer, which left lastEventId empty on every event that omitted id, even though the buffer still held the earlier value and would have been sent as Last-Event-ID on reconnect.

• 17a9772 Thanks @​rexxars! - Fixed ID-only event blocks not updating MessageEvent.lastEventId or Last-Event-ID on reconnect.

5.1.0

Minor Changes

• #355 d8370e4 Thanks @​rexxars! - Typed response body chunks as buffers instead of unknown

  ReaderLike typed chunks read off the response body as unknown, but they are handed to a TextDecoder, which only accepts buffers and throws on anything else. So a reader yielding anything else was never usable, and the type said otherwise. It also hid a type error in the client itself, which only surfaces when compiling against TypeScript's dom library: the node typings resolve the chunk to any, while the dom library resolves it to {}.

  Chunks are now typed as Uint8Array | DataView | ArrayBuffer, which is what both the node and DOM typings accept, and which every fetch() implementation yields. Nothing changes at runtime.

  If you pass a custom fetch() that returns a hand-rolled body, and your reader's chunk type is wider than the above, eg unknown or any, it will no longer be assignable. Returning a real Response, or a reader that yields Uint8Array chunks, is unaffected.

• #355 008f07e Thanks @​rexxars! - Declared the this type for the onerror, onmessage and onopen properties

... (truncated)

Commits

• 8524c39 chore(release): version packages (#373)
• 0769591 fix: clone passed URL to prevent mutations (#372)
• 888f056 chore(release): version packages (#368)
• c878bfc chore: upgrade to vitest 5 (#371)
• d3fe0d3 fix: match the event stream MIME type exactly (#369)
• c866ce6 fix: document utf-8 last-event-id limitation on webkit
• 02634eb fix: workerd last-event-id encoding
• fd62d79 fix: send Last-Event-ID header as UTF-8 (#367)
• 8037c3b chore(release): version packages (#365)
• c4d6b9a fix: abort rejected response requests (#363)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eventsource since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🔍 Preview environment ready — PR #1838 (c20bc35)

Service	URL
Frontend preview	https://pr-1838.flowfi-preview.local
Backend preview	https://flowfi-pr-1838.fly.dev
Backend health	https://flowfi-pr-1838.fly.dev/health

Database: ephemeral flowfi_preview_pr_1838 migrated + seeded with demo streams/users.
Closing this PR deallocates all preview resources automatically.