feat!: max buffer size, require node 22.12 or higher, drop commonjs

.changeset/bright-bottles-wait.md

@@ -0,0 +1,10 @@
+---
+"eventsource": major
+---
+
+- **BREAKING CHANGE:** The client now fails the connection, emitting an error without reconnecting, if the parser buffers 100 MB without receiving a valid, complete EventSource line. Configure a different limit with `maxBufferSize`; ideally, servers should emit smaller chunks or newlines more frequently.
+- **BREAKING CHANGE:** Node.js 22.12 or later is now required. Older Node.js versions may still work, but are not supported or guaranteed going forward because Node.js 20 is out of LTS.
+- **BREAKING CHANGE:** The separate CommonJS variant is no longer published. Node.js 22.12 and later transparently supports `require()` of ESM, so most CommonJS consumers should continue to work. This removes the dual-package hazard.
+- **BREAKING CHANGE:** Chrome versions before 84, Safari before 15, Firefox before 105, Edge before 84, and JavaScript environments without private fields, methods, and accessors are no longer supported.
+- **BREAKING CHANGE:** When both an `on*` property handler and an `addEventListener()` listener are registered for the same event, they now run in registration order instead of always running the `on*` handler first. Code that relied on the old order can observe a different callback sequence.
+- Unref reconnection timers where the runtime supports it, so pending reconnects do not keep the process alive.

.github/workflows/test.yml

@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: ['18.x', '20.x', '22.x', '24.x', '26.x']
+        node-version: ['22.x', '24.x', '26.x']
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7

.oxfmtrc.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": false,
+  "printWidth": 100,
+  "bracketSpacing": false,
+  "singleQuote": true
+}

CONTRIBUTING.md

@@ -27,7 +27,6 @@ npm test
 - Commit to that branch locally and regularly push your work to the same named branch on the remote.
 - Rebase your feature branch regularly against `main`. Make sure its even with `main` while it is awaiting review.
 - Pull requests should be as ready as possible for merge. Unless stated otherwise, it should be safe to assume that:
-
   - The changes/feature are reviewed and tested by you
   - You think it's production ready
   - The code is linted and the test suite is passing

MIGRATION.md

@@ -1,5 +1,27 @@
 # Migration guide
 
+## v4 to v5
+
+### Runtime support
+
+Node.js 22.12 or later is now required. Older Node.js versions may still work, but are not supported or guaranteed going forward because Node.js 20 is out of LTS.
+
+Support for Chrome versions before 84, Safari before 15, Firefox before 105, and Edge before 84 has been dropped. This also applies to JavaScript environments that do not support private fields, methods, and accessors.
+
+### CommonJS distribution
+
+The separate CommonJS variant is no longer published. Node.js 22.12 and later transparently supports `require()` of ESM, so most CommonJS consumers should continue to work. Removing the CommonJS variant avoids the dual-package hazard.
+
+### Parser buffer limit
+
+The client now fails the connection, emits an `error` event, and does not reconnect if it buffers 100 MB without receiving a valid, complete EventSource line. Pass `maxBufferSize` in the constructor options to configure another limit.
+
+Servers should ideally emit smaller chunks or newlines more frequently rather than requiring a larger buffer.
+
+### Event handler order
+
+When both an `on*` property handler and an `addEventListener()` listener are registered for the same event, they now run in registration order. Previously, the `on*` handler always ran first. Code that relied on the old order can observe a different callback sequence.
+
 ## v3 to v4
 
 ### Runtime support

README.md

@@ -14,12 +14,12 @@ npm install --save eventsource
 
 ## Supported engines
 
-- Node.js >= 20
-- Chrome >= 71
-- Safari >= 11.3
-- Firefox >= 65
-- Edge >= 79
-- Deno >= 1.30
+- Node.js >= 22.12
+- Chrome >= 84
+- Safari >= 15
+- Firefox >= 105
+- Edge >= 84
+- Deno >= 2
 - Bun >= 1.1.23
 
 Basically, any environment that supports:
@@ -29,9 +29,12 @@ Basically, any environment that supports:
 - [TextDecoder](https://developer.mozilla.org/en-US/docs/Web/API/TextDecoder)
 - [URL](https://developer.mozilla.org/en-US/docs/Web/API/URL)
 - [Event](https://developer.mozilla.org/en-US/docs/Web/API/Event), [MessageEvent](https://developer.mozilla.org/en-US/docs/Web/API/MessageEvent), [EventTarget](https://developer.mozilla.org/en-US/docs/Web/API/EventTarget)
+- [Private class fields, methods, and accessors](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes/Private_elements)
 - [Symbol.for](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol/for)
 
-If you need to support older runtimes, try the `2.x` branch/version range (note: 2.x branch is primarily targetted at Node.js, not browsers).
+If you need to support runtimes without private class fields, methods and accessors, try the `4.x` branch/version range.
+
+If you need to support even older runtimes, try the `2.x` branch/version range (note: 2.x branch is primarily targeted at Node.js, not browsers).
 
 ## Usage
 
@@ -84,7 +87,7 @@ Make sure you have configured your TSConfig so it matches the environment you ar
 }
 ```
 
-If you're using Node.js, ensure you have `@types/node` installed (and it is version 18 or higher). Cloudflare workers have `@cloudflare/workers-types` etc.
+If you're using Node.js, ensure you have `@types/node` installed (and it is version 22 or higher). Cloudflare workers have `@cloudflare/workers-types` etc.
 
 The following errors are caused by targetting an environment that does not have the necessary types available:
 
@@ -112,6 +115,18 @@ es.addEventListener('error', (err) => {
 })
 ```
 
+### Limit parser buffer size
+
+The parser buffers up to 100 MB while waiting for a complete EventSource line. To change that limit, pass `maxBufferSize` in the constructor options:
+
+```ts
+const es = new EventSource('https://my-server.com/sse', {
+  maxBufferSize: 10 * 1024 * 1024, // 10 MB
+})
+```
+
+If the limit is exceeded, the connection fails and emits an `error` event, and will not reconnect. Prefer servers that emit smaller chunks or newlines more frequently over increasing this limit.
+
 ### Specify `fetch` implementation
 
 The `EventSource` constructor accepts an optional `fetch` property in the second argument that can be used to specify the `fetch` implementation to use.

SECURITY.md

@@ -4,9 +4,9 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 3.x.x   | :white_check_mark: |
-| 2.x.x   | :white_check_mark: |
-| < 2.0   | :x:                |
+| 5.x.x   | :white_check_mark: |
+| 4.x.x   | :white_check_mark: |
+| < 3.0   | :x:                |
 
 ## Reporting a Vulnerability