CHANGELOG.md

📓 Changelog

5.1.1

Patch Changes

• #358 de3c0ae Thanks @pacocartones! - Fixed MessageEvent.lastEventId being empty when a message omits the id field

  The lastEventId attribute is the last event ID string of the event source, so an explicit id field persists until another one replaces it. Message events were dispatched with the current event's own id instead of that buffer, which left lastEventId empty on every event that omitted id, even though the buffer still held the earlier value and would have been sent as Last-Event-ID on reconnect.

• 17a9772 Thanks @rexxars! - Fixed ID-only event blocks not updating MessageEvent.lastEventId or Last-Event-ID on reconnect.

5.1.0

Minor Changes

• #355 d8370e4 Thanks @rexxars! - Typed response body chunks as buffers instead of unknown

  ReaderLike typed chunks read off the response body as unknown, but they are handed to a TextDecoder, which only accepts buffers and throws on anything else. So a reader yielding anything else was never usable, and the type said otherwise. It also hid a type error in the client itself, which only surfaces when compiling against TypeScript's dom library: the node typings resolve the chunk to any, while the dom library resolves it to {}.

  Chunks are now typed as Uint8Array | DataView | ArrayBuffer, which is what both the node and DOM typings accept, and which every fetch() implementation yields. Nothing changes at runtime.

  If you pass a custom fetch() that returns a hand-rolled body, and your reader's chunk type is wider than the above, eg unknown or any, it will no longer be assignable. Returning a real Response, or a reader that yields Uint8Array chunks, is unaffected.

• #355 008f07e Thanks @rexxars! - Declared the this type for the onerror, onmessage and onopen properties

  addEventListener() already declared that listeners are called with the EventSource instance as this, but the on* properties did not, so this was an implicit any in handlers assigned to them (an error under noImplicitThis). They now match addEventListener() and the native EventSource:

  eventSource.onmessage = function (event) {
    console.log(this.url, event.data) // `this` is now typed
  }

  Handlers that declare an incompatible this, eg an unbound class method typed with this: MyClass, will now be rejected where they were previously accepted. Arrow functions and handlers that ignore this are unaffected.

• #355 3512add Thanks @rexxars! - Made the exported EventSource type structural, so other implementations can satisfy it

  EventSource was exported as a class holding hard-private (#) fields, which makes TypeScript emit a #private brand into the declaration file and turns the exported type nominal. A consumer writing function connect(es: EventSource) against this package could not pass the native EventSource, a mock, or any other implementation, even when the shape matched exactly.

  The implementation class is now internal, and EventSource is exported as an interface plus a const holding the constructor. As a result:

  • The native EventSource, along with mocks and stubs, is assignable to the exported EventSource type
  • The exported value and globalThis.EventSource are interchangeable in both directions, which helps libraries that accept an EventSource implementation to construct
  • A new EventSourceConstructor type is exported for that case

  Nothing changes at runtime: new EventSource(...), instanceof, subclassing, the readyState statics, EventSource.name, inspected output and the eventsource.supports-fetch-override symbol all behave as before, and the internal state is still held in real #private fields.

Patch Changes

• #357 8e5c691 Thanks @rexxars! - Fixed origin and lastEventId being empty on Cloudflare Workers

  workerd accepts data from the MessageEvent constructor's init dictionary but silently drops origin and lastEventId, so message events dispatched on Cloudflare Workers arrived with origin set to null and lastEventId to an empty string. Both are now assigned explicitly when the constructor did not take them, which leaves every other runtime untouched.

5.0.0

Major Changes

• #349 b195e70 Thanks @rexxars! - - BREAKING CHANGE: The client now fails the connection, emitting an error without reconnecting, if the parser buffers 100 MB without receiving a valid, complete EventSource line. Configure a different limit with maxBufferSize; ideally, servers should emit smaller chunks or newlines more frequently.
  • BREAKING CHANGE: Node.js 22.12 or later is now required. Older Node.js versions may still work, but are not supported or guaranteed going forward because Node.js 20 is out of LTS.
  • BREAKING CHANGE: The separate CommonJS variant is no longer published. Node.js 22.12 and later transparently supports require() of ESM, so most CommonJS consumers should continue to work. This removes the dual-package hazard.
  • BREAKING CHANGE: Chrome versions before 84, Safari before 15, Firefox before 105, Edge before 84, and JavaScript environments without private fields, methods, and accessors are no longer supported.
  • BREAKING CHANGE: When both an on* property handler and an addEventListener() listener are registered for the same event, they now run in registration order instead of always running the on* handler first. Code that relied on the old order can observe a different callback sequence.
  • Unref reconnection timers where the runtime supports it, so pending reconnects do not keep the process alive.

4.1.1

Patch Changes

• #351 6127f40 Thanks @rexxars! - Allow a value of any type in ReaderLike done-results. TypeScript 5.9's DOM lib types ReadableStreamDefaultReader.read()'s done-result as {done: true, value: T | undefined}, so a custom fetch returning a Response-shaped body no longer satisfied FetchLikeResponse on TypeScript 5.9 and newer, forcing consumers to hand-wrap the reader.

4.1.0 (2025-11-19)

Features

• declare fetch override support symbol on class (5575122)

4.0.0 (2025-05-13)

⚠ BREAKING CHANGES

• FetchLikeInit is now removed. Use EventSourceFetchInit.
• Drop support for Node.js v18, as it is end-of-life.

Features

• require node.js v20 or higher (91a3a48)

Bug Fixes

• drop FetchLikeInit type. Use EventSourceFetchInit instead. (6786e46)

3.0.7 (2025-05-09)

Bug Fixes

• mark fetch init properties required in typings (1282872)

3.0.6 (2025-03-27)

Bug Fixes

• upgrade parser to latest version, improving performance (59a5ddd)

3.0.5 (2025-01-28)

Bug Fixes

• include message and code on errors when logging in node.js and deno (f2596b3)

3.0.4 (2025-01-28)

Bug Fixes

• ensure message is set on ErrorEvent on network errors (d1dc711)

3.0.3 (2025-01-27)

Bug Fixes

• bundle event listener typings (2c51349)

3.0.2 (2024-12-13)

Bug Fixes

• reference possibly missing event typings (d3b6849)

3.0.1 (2024-12-07)

Bug Fixes

• run build prior to publishing (f86df19)

3.0.0 (2024-12-07)

⚠ BREAKING CHANGES

• Drop support for Node.js versions below v18
• The module now uses a named export instead of a default export.
• UMD bundle dropped. Use a bundler.
• headers in init dict dropped, pass a custom fetch function instead.
• HTTP/HTTPS proxy support dropped. Pass a custom fetch function instead.
• https.* options dropped. Pass a custom fetch function that provides an agent/dispatcher instead.
• New default reconnect delay: 3 seconds instead of 1 second.
• Reconnecting after a redirect will now always use the original URL, even if the status code was HTTP 307.

Features

• modernize - use fetch, WebStreams, TypeScript, ESM (#330) (40655f7)

Bug Fixes

• dispatchEvent now emits entire event object (eb430c0)
• empty options no longer disable certificate checks (372d387)

2.0.2 (2022-05-12)

Bug Fixes

• strip sensitive headers on redirect to different origin (10ee0c4)

2.0.1 (2022-04-25)

Bug Fixes

• Fix URL is not a constructor error for browser (#268 Ajinkya Rajput)

2.0.0 (2022-03-02)

⚠ BREAKING CHANGES

• Node >= 12 now required (#152 @HonkingGoose)

Bug Fixes

• Preallocate buffer size when reading data for increased performance with large messages (#239 Pau Freixes)
• Removed dependency on url-parser. Fixes CVE-2022-0512 & CVE-2022-0691 (#249 Alex Hladin)

Bug Fixes

• NPM download badge links to malware (8954d63)

1.1.2 (2022-06-08)

Features

• Inline origin resolution, drops original dependency (#281 Espen Hovlandsdal)

1.1.1 (2022-05-11)

Bug Fixes

• Do not include authorization and cookie headers on redirect to different origin (#273 Espen Hovlandsdal)

1.1.0 (2021-03-18)

Features

• Improve performance for large messages across many chunks (#130 Trent Willis)
• Add createConnection option for http or https requests (#120 Vasily Lavrov)
• Support HTTP 302 redirects (#116 Ryan Bonte)

Bug Fixes

• Prevent sequential errors from attempting multiple reconnections (#125 David Patty)
• Add new to correct test (#111 Stéphane Alnet)
• Fix reconnections attempts now happen more than once (#136 Icy Fish)

1.0.7 (2018-08-27)

Features

• Add dispatchEvent to EventSource (#101 Ali Afroozeh)
• Added checkServerIdentity option (#104 cintolas)
• Surface request error message (#107 RasPhilCo)

1.0.6 (2018-08-23)

Bug Fixes

• Fix issue where a unicode sequence split in two chunks would lead to invalid messages (#108 Espen Hovlandsdal)

1.0.5 (2017-07-18)

Bug Fixes

• Check for window existing before polyfilling. (#80 Neftaly Hernandez)

1.0.4 (2017-06-19)

Bug Fixes

• Pass withCredentials on to the XHR. (#79 Ken Mayer)

1.0.2 (2017-05-28)

Bug Fixes

• Fix proxy not working when proxy and target URL uses different protocols. (#76 Espen Hovlandsdal)
• Make close() a prototype method instead of an instance method. (#77 Espen Hovlandsdal)

1.0.1 (2017-05-10)

Bug Fixes

• Reconnect if server responds with HTTP 500, 502, 503 or 504. (#74 Vykintas Narmontas)

1.0.0 (2017-04-17)

Features

• Add missing removeEventListener-method. (#51 Yucheng Tu / Espen Hovlandsdal)
• Add ability to customize https options. (#53 Rafael Alfaro)
• Add readyState constants to EventSource instances. (#66 Espen Hovlandsdal)

Bug Fixes

• Fix EventSource reconnecting on non-200 responses. (af84476 Espen Hovlandsdal)

0.2.3 (2017-04-17)

Bug Fixes

• Fix onConnectionClosed firing multiple times resulting in multiple connections. (#61 Phil Strong / Duncan Wong)

Reverts

• Revert "Protects against multiple connects" (3887a4a)

0.2.2 (2017-02-28)

Bug Fixes

• Don't include test files in npm package. (#56 eanplatter)

0.2.1 (2016-02-28)

Features

• Add http/https proxy function. (#46 Eric Lu)
• Drop support for Node 0.10.x and older (Aslak Hellesøy).

Bug Fixes

• Fix close() for polyfill. (#52 brian-medendorp)
• Fix reconnect for polyfill. Only disable reconnect when server status is 204. (Aslak Hellesøy).

0.2.0 (2016-02-11)

Features

• Renamed repository to eventsource (since it's not just Node, but also browser polyfill). (Aslak Hellesøy).
• Compatibility with webpack/browserify. (#44 Adriano Raiano).

0.1.6 (2015-02-09)

Bug Fixes

• Ignore headers without a value. (#41, #43 Adriano Raiano)

0.1.5 (2015-02-08)

Features

• Refactor tests to support Node.js 0.12.0 and Io.js 1.1.0. (Aslak Hellesøy)

0.1.4 (2014-10-31)

Features

• Expose status property on error events. (#40 Adriano Raiano)

Bug Fixes

• Added missing origin property. (#39, #38 Arnout Kazemier)

0.1.3 (2014-09-17)

Bug Fixes

• Made message properties enumerable. (#37 Golo Roden)

0.1.2 (2014-08-07)

Bug Fixes

• Blank lines not read. (#35, #36 Lesterpig)

0.1.1 (2014-05-18)

Bug Fixes

• Fix message type. (#33 Romain Gauthier)

0.1.0 (2014-03-07)

Bug Fixes

• High CPU usage by replacing Jison with port of WebKit's parser. (#25, #32, #18 qqueue)

0.0.10 (2013-11-21)

Features

• Provide Event argument on open and error event (#30, #31 Donghwan Kim)
• Expose lastEventId on messages. (#28 mbieser)

0.0.9 (2013-10-24)

Bug Fixes

• Old "last-event-id" used on reconnect (#27 Aslak Hellesøy)

0.0.8 (2013-09-12)

Features

• Allow unauthorized HTTPS connections by setting rejectUnauthorized to false. (Aslak Hellesøy)

Bug Fixes

• EventSource still reconnected when closed (#24 FrozenCow)

0.0.7 (2013-04-19)

Features

• Explicitly raise an error when server returns http 403 and don't continue (#20 Scott Moak)
• Added ability to send custom http headers to server (#21, #9 Scott Moak)
• Switched from testing with Nodeunit to Mocha (Aslak Hellesøy)

Bug Fixes

• Fix Unicode support to cope with Javascript Unicode size limitations (#23, #22 Devon Adkisson)
• Graceful handling of parse errors (#19 Aslak Hellesøy)

0.0.6 (2013-01-24)

Features

• Add Accept: text/event-stream header (#17 William Wicks)

0.0.5 (2012-02-12)

Features

• Add no-cache and https support (#10 Einar Otto Stangvik)
• Ensure that Last-Event-ID is sent to the server for reconnects, as defined in the spec (#8 Einar Otto Stangvik)
• Verify that CR and CRLF are accepted alongside LF (#7 Einar Otto Stangvik)
• Emit 'open' event (#4 Einar Otto Stangvik)

0.0.4 (2012-02-10)

Features

• Automatic reconnect every second if the server is down. Reconnect interval can be set with reconnectInterval (not in W3C spec). (Aslak Hellesøy)

0.0.3 (2012-02-10)

Features

• Jison based eventstream parser (#2 Einar Otto Stangvik)

0.0.2 (2012-02-08)

Features

• Use native EventListener (Aslak Hellesøy)

0.0.1 (2012-02-08)

Features

• First release (Aslak Hellesøy)