feat!: max buffer size, require node 22.19 or higher, drop commonjs

.github/workflows/release.yml

@@ -35,10 +35,9 @@ jobs:
           # Need to fetch entire commit history to
           # analyze every commit since last release
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: lts/*
-          cache: npm
       - run: npm ci
       - run: npx semantic-release --dry-run
         if: always()
@@ -59,10 +58,9 @@ jobs:
           # Need to fetch entire commit history to
           # analyze every commit since last release
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: lts/*
-          cache: npm
       - run: npm ci
       - run: npx semantic-release
         # Don't allow interrupting the release step if the job is cancelled, as it can lead to an inconsistent state

.github/workflows/test.yml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
       - name: Cache node modules
         id: cache-node-modules
         uses: actions/cache@v4
@@ -39,10 +39,10 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: ['18.x', '20.x', '22.x']
+        node-version: ['22.x', '24.x']
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
       - name: Cache node modules

.oxfmtrc.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": false,
+  "printWidth": 100,
+  "bracketSpacing": false,
+  "singleQuote": true
+}

CONTRIBUTING.md

@@ -27,7 +27,6 @@ npm test
 - Commit to that branch locally and regularly push your work to the same named branch on the remote.
 - Rebase your feature branch regularly against `main`. Make sure its even with `main` while it is awaiting review.
 - Pull requests should be as ready as possible for merge. Unless stated otherwise, it should be safe to assume that:
-
   - The changes/feature are reviewed and tested by you
   - You think it's production ready
   - The code is linted and the test suite is passing

MIGRATION.md

@@ -1,5 +1,13 @@
 # Migration guide
 
+## v4 to v5
+
+### Runtime support
+
+Dropped support for Node.js versions below 22.19, as they are no longer maintained. While there are no explicit changes that make it incompatible, we make no guarantees of it being supported going forward.
+
+Also dropped support for any JavaScript environment where private fields, methods and accessors are not supported - which includes older browsers.
+
 ## v3 to v4
 
 ### Runtime support

README.md

@@ -14,12 +14,12 @@ npm install --save eventsource
 
 ## Supported engines
 
-- Node.js >= 20
-- Chrome >= 71
-- Safari >= 11.3
-- Firefox >= 65
-- Edge >= 79
-- Deno >= 1.30
+- Node.js >= 22.19
+- Chrome >= 84
+- Safari >= 15
+- Firefox >= 105
+- Edge >= 84
+- Deno >= 2
 - Bun >= 1.1.23
 
 Basically, any environment that supports:
@@ -29,9 +29,12 @@ Basically, any environment that supports:
 - [TextDecoder](https://developer.mozilla.org/en-US/docs/Web/API/TextDecoder)
 - [URL](https://developer.mozilla.org/en-US/docs/Web/API/URL)
 - [Event](https://developer.mozilla.org/en-US/docs/Web/API/Event), [MessageEvent](https://developer.mozilla.org/en-US/docs/Web/API/MessageEvent), [EventTarget](https://developer.mozilla.org/en-US/docs/Web/API/EventTarget)
+- [Private class fields, methods, and accessors](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes/Private_elements)
 - [Symbol.for](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol/for)
 
-If you need to support older runtimes, try the `2.x` branch/version range (note: 2.x branch is primarily targetted at Node.js, not browsers).
+If you need to support runtimes without private class fields, methods and accessors, try the `4.x` branch/version range.
+
+If you need to support even older runtimes, try the `2.x` branch/version range (note: 2.x branch is primarily targeted at Node.js, not browsers).
 
 ## Usage
 
@@ -84,7 +87,7 @@ Make sure you have configured your TSConfig so it matches the environment you ar
 }
 ```
 
-If you're using Node.js, ensure you have `@types/node` installed (and it is version 18 or higher). Cloudflare workers have `@cloudflare/workers-types` etc.
+If you're using Node.js, ensure you have `@types/node` installed (and it is version 22 or higher). Cloudflare workers have `@cloudflare/workers-types` etc.
 
 The following errors are caused by targetting an environment that does not have the necessary types available:
 
@@ -112,6 +115,18 @@ es.addEventListener('error', (err) => {
 })
 ```
 
+### Limit parser buffer size
+
+The parser buffers up to 100 MB while waiting for a complete EventSource line. To change that limit, pass `maxBufferSize` in the constructor options:
+
+```ts
+const es = new EventSource('https://my-server.com/sse', {
+  maxBufferSize: 10 * 1024 * 1024, // 10 MB
+})
+```
+
+If the limit is exceeded, the connection fails and emits an `error` event, and will not reconnect.
+
 ### Specify `fetch` implementation
 
 The `EventSource` constructor accepts an optional `fetch` property in the second argument that can be used to specify the `fetch` implementation to use.

SECURITY.md

@@ -4,9 +4,9 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 3.x.x   | :white_check_mark: |
-| 2.x.x   | :white_check_mark: |
-| < 2.0   | :x:                |
+| 5.x.x   | :white_check_mark: |
+| 4.x.x   | :white_check_mark: |
+| < 3.0   | :x:                |
 
 ## Reporting a Vulnerability