chore(deps): Bump eventsource from 3.0.7 to 5.1.1

[dependabot]

Bumps eventsource from 3.0.7 to 5.1.1.

Release notes

Sourced from eventsource's releases.

v5.1.1

Patch Changes

• #358 de3c0ae Thanks @​pacocartones! - Fixed MessageEvent.lastEventId being empty when a message omits the id field

  The lastEventId attribute is the last event ID string of the event source, so an explicit id field persists until another one replaces it. Message events were dispatched with the current event's own id instead of that buffer, which left lastEventId empty on every event that omitted id, even though the buffer still held the earlier value and would have been sent as Last-Event-ID on reconnect.

• 17a9772 Thanks @​rexxars! - Fixed ID-only event blocks not updating MessageEvent.lastEventId or Last-Event-ID on reconnect.

v5.1.0

Minor Changes

• #355 d8370e4 Thanks @​rexxars! - Typed response body chunks as buffers instead of unknown

  ReaderLike typed chunks read off the response body as unknown, but they are handed to a TextDecoder, which only accepts buffers and throws on anything else. So a reader yielding anything else was never usable, and the type said otherwise. It also hid a type error in the client itself, which only surfaces when compiling against TypeScript's dom library: the node typings resolve the chunk to any, while the dom library resolves it to {}.

  Chunks are now typed as Uint8Array | DataView | ArrayBuffer, which is what both the node and DOM typings accept, and which every fetch() implementation yields. Nothing changes at runtime.

  If you pass a custom fetch() that returns a hand-rolled body, and your reader's chunk type is wider than the above, eg unknown or any, it will no longer be assignable. Returning a real Response, or a reader that yields Uint8Array chunks, is unaffected.

• #355 008f07e Thanks @​rexxars! - Declared the this type for the onerror, onmessage and onopen properties

  addEventListener() already declared that listeners are called with the EventSource instance as this, but the on* properties did not, so this was an implicit any in handlers assigned to them (an error under noImplicitThis). They now match addEventListener() and the native EventSource:

  eventSource.onmessage = function (event) {
    console.log(this.url, event.data) // `this` is now typed
  }

  Handlers that declare an incompatible this, eg an unbound class method typed with this: MyClass, will now be rejected where they were previously accepted. Arrow functions and handlers that ignore this are unaffected.

• #355 3512add Thanks @​rexxars! - Made the exported EventSource type structural, so other implementations can satisfy it

  EventSource was exported as a class holding hard-private (#) fields, which makes TypeScript emit a #private brand into the declaration file and turns the exported type nominal. A consumer writing function connect(es: EventSource) against this package could not pass the native EventSource, a mock, or any other implementation, even when the shape matched exactly.

  The implementation class is now internal, and EventSource is exported as an interface plus a const holding the constructor. As a result:

  • The native EventSource, along with mocks and stubs, is assignable to the exported EventSource type
  • The exported value and globalThis.EventSource are interchangeable in both directions, which helps libraries that accept an EventSource implementation to construct
  • A new EventSourceConstructor type is exported for that case

  Nothing changes at runtime: new EventSource(...), instanceof, subclassing, the readyState statics, EventSource.name, inspected output and the eventsource.supports-fetch-override symbol all behave as before, and the internal state is still held in real #private fields.

Patch Changes

• #357 8e5c691 Thanks @​rexxars! - Fixed origin and lastEventId being empty on Cloudflare Workers

  workerd accepts data from the MessageEvent constructor's init dictionary but silently drops origin and lastEventId, so message events dispatched on Cloudflare Workers arrived with origin set to null and lastEventId to an empty string. Both are now assigned explicitly when the constructor did not take them, which leaves every other runtime untouched.

v5.0.0

... (truncated)

Changelog

Sourced from eventsource's changelog.

5.1.1

Patch Changes

• #358 de3c0ae Thanks @​pacocartones! - Fixed MessageEvent.lastEventId being empty when a message omits the id field

  The lastEventId attribute is the last event ID string of the event source, so an explicit id field persists until another one replaces it. Message events were dispatched with the current event's own id instead of that buffer, which left lastEventId empty on every event that omitted id, even though the buffer still held the earlier value and would have been sent as Last-Event-ID on reconnect.

• 17a9772 Thanks @​rexxars! - Fixed ID-only event blocks not updating MessageEvent.lastEventId or Last-Event-ID on reconnect.

5.1.0

Minor Changes

• #355 d8370e4 Thanks @​rexxars! - Typed response body chunks as buffers instead of unknown

  ReaderLike typed chunks read off the response body as unknown, but they are handed to a TextDecoder, which only accepts buffers and throws on anything else. So a reader yielding anything else was never usable, and the type said otherwise. It also hid a type error in the client itself, which only surfaces when compiling against TypeScript's dom library: the node typings resolve the chunk to any, while the dom library resolves it to {}.

  Chunks are now typed as Uint8Array | DataView | ArrayBuffer, which is what both the node and DOM typings accept, and which every fetch() implementation yields. Nothing changes at runtime.

  If you pass a custom fetch() that returns a hand-rolled body, and your reader's chunk type is wider than the above, eg unknown or any, it will no longer be assignable. Returning a real Response, or a reader that yields Uint8Array chunks, is unaffected.

• #355 008f07e Thanks @​rexxars! - Declared the this type for the onerror, onmessage and onopen properties

  addEventListener() already declared that listeners are called with the EventSource instance as this, but the on* properties did not, so this was an implicit any in handlers assigned to them (an error under noImplicitThis). They now match addEventListener() and the native EventSource:

  eventSource.onmessage = function (event) {
    console.log(this.url, event.data) // `this` is now typed
  }

  Handlers that declare an incompatible this, eg an unbound class method typed with this: MyClass, will now be rejected where they were previously accepted. Arrow functions and handlers that ignore this are unaffected.

• #355 3512add Thanks @​rexxars! - Made the exported EventSource type structural, so other implementations can satisfy it

  EventSource was exported as a class holding hard-private (#) fields, which makes TypeScript emit a #private brand into the declaration file and turns the exported type nominal. A consumer writing function connect(es: EventSource) against this package could not pass the native EventSource, a mock, or any other implementation, even when the shape matched exactly.

  The implementation class is now internal, and EventSource is exported as an interface plus a const holding the constructor. As a result:

  • The native EventSource, along with mocks and stubs, is assignable to the exported EventSource type
  • The exported value and globalThis.EventSource are interchangeable in both directions, which helps libraries that accept an EventSource implementation to construct
  • A new EventSourceConstructor type is exported for that case

  Nothing changes at runtime: new EventSource(...), instanceof, subclassing, the readyState statics, EventSource.name, inspected output and the eventsource.supports-fetch-override symbol all behave as before, and the internal state is still held in real #private fields.

Patch Changes

• #357 8e5c691 Thanks @​rexxars! - Fixed origin and lastEventId being empty on Cloudflare Workers

  workerd accepts data from the MessageEvent constructor's init dictionary but silently drops origin and lastEventId, so message events dispatched on Cloudflare Workers arrived with origin set to null and lastEventId to an empty string. Both are now assigned explicitly when the constructor did not take them, which leaves every other runtime untouched.

... (truncated)

Commits

• e75a3fe chore(release): version packages (#359)
• bb6e59f chore: update lockfiles
• 17a9772 fix: id-only events updates last event id
• de3c0ae fix: preserve lastEventId when a later event omits the id field (#358)
• 83b2e32 docs: clarify minimum compatibility date for cloudflare workers
• c0f4cef chore(release): version packages (#356)
• 28fae57 test: allow cloudflare workers suite to pass
• b2a77c2 test: allow happy-dom suite to pass
• e24d2fa ci: stop known-failing suites from marking commits red
• 3da1ae8 docs: note partial Cloudflare Workers support
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eventsource since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codesolarlght]

🔆 CodeSolar review ✅ Looks good

Bumps eventsource from 3.0.7 to 5.1.1 in server/package.json. The change is a single version string update with no code modifications. The release notes describe bug fixes (lastEventId handling) and type tightenings (chunk types, this types for on* handlers) that are backward-compatible for normal usage. Without visibility into how eventsource is imported and used in the codebase, no compatibility issues can be verified or flagged.

✅ No issues worth flagging.

---

_{solar-pro4 (openrouter) · 1 files · +7/-3 · 69.3s · CodeSolar}

_{Comment /codesolar on this PR to re-run the review.}

[codesolarlght]

🔆 CodeSolar review ✅ Looks good

🔄 2nd review of this pull request · 365 new commit(s) since the last one

Bumps eventsource from 3.0.7 to 5.1.1 in server/package.json. Only the dependency version changes; no code is modified. The typecheck gate will catch any type incompatibilities introduced by the major version bump.

✅ No issues worth flagging.

---

_{solar-pro4 (openrouter) · 1 files · +8/-4 · 28.1s · CodeSolar}

_{Comment /codesolar on this PR to re-run the review.}

[codesolarlght]

🔆 CodeSolar review ✅ Looks good

🔄 3rd review of this pull request · 14 new commit(s) since the last one

Bumps eventsource from 3.0.7 to 5.1.1 in server/package.json. The release notes indicate only bug fixes (lastEventId handling) and type improvements (chunk types, this typing for event handlers) with no breaking changes. No code changes accompany the dependency update.

✅ No issues worth flagging.

---

_{solar-pro4 (openrouter) · 1 files · +7/-3 · 26.5s · CodeSolar}

_{Comment /codesolar on this PR to re-run the review.}

[yulmucoffee]

Closing: the MCP SDK still requires eventsource ^3, so this lock nests a second copy under it and the server's preload would guard the wrong one. It moves when the SDK does.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.