chore(deps): update eventsource to ^4.1.1, eventsource-parser to ^3.1.1 - #2744
Open
andriyor wants to merge 1 commit into
Open
chore(deps): update eventsource to ^4.1.1, eventsource-parser to ^3.1.1#2744andriyor wants to merge 1 commit into
andriyor wants to merge 1 commit into
Conversation
Bumps the two client SSE dependencies to the newest releases that keep the declared `engines: node >=20` floor intact. eventsource v4 dropped only the unused `FetchLikeInit` type (superseded by `EventSourceFetchInit`), which this repo never imported — `sse.ts` uses `ErrorEvent` and `EventSourceInit`, both still exported. No source changes required. The pairing is deliberate: eventsource@4 declares `eventsource-parser: ^3.0.1`, so parser v3 is the version it requires. pnpm dedupes to a single shared copy (`eventsource@4.1.1 -> eventsource-parser: 3.1.1`), the same instance `streamableHttp.ts` imports directly via `eventsource-parser/stream`. Bumping the parser to v4 while holding eventsource at v4 would nest a second parser copy in the bundle. Staying off the latest majors on purpose: eventsource@5 and eventsource-parser@4 both require Node >=22.12 and ship ESM only, which would break the `>=20` engines floor, the Node 20 CI leg, and `require()` of the client's CJS bundle on Node 20. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/core
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
eventsourceandeventsource-parserwere pinned at^3.0.2/^3.0.0. This bumps both to the newest releases that keep the declaredengines: node >=20floor intact.eventsource^3.0.2^4.1.1eventsource-parser^3.0.0^3.1.1Why not the latest majors.
eventsource@5andeventsource-parser@4both requirenode >=22.12and dropped their CommonJS builds. Adopting them would mean raising theenginesfloor from>=20across every package, dropping the Node 20 leg from the CI matrix, and breakingrequire()of@modelcontextprotocol/client's CJS bundle (dist/index.cjs) on Node 20 —eventsourceis an external dep there, so it resolves toERR_REQUIRE_ESM. That's a consumer-facing break and felt out of scope for a dependency refresh; happy to open it as a separate PR if a Node floor bump is on the roadmap.Why these two versions pair.
eventsource@4.1.1declareseventsource-parser: ^3.0.1, so parser v3 is the version it actually requires. pnpm dedupes to a single shared copy — the lock resolveseventsource@4.1.1 -> eventsource-parser: 3.1.1, the same instancestreamableHttp.tsimports directly viaeventsource-parser/stream. Bumping the parser to v4 while holdingeventsourceat v4 would nest a second parser copy in the bundle, so the two have to move together.How Has This Been Tested?
pnpm typecheck:all,pnpm lint:all,pnpm build:all— all cleanpnpm test:all— full suite passes (6,700+ tests across all packages)require('eventsource')andrequire('eventsource-parser/stream')both resolve, and the builtdist/index.cjsloadsOne note on
test/e2e: it exits non-zero from 2 unhandled rejections inscenarios/protocol.test.ts(a fake-timer request-timeout case) while reporting2639 passed | 147 expected fail. This is pre-existing onmainand unrelated to this change — I re-ran the suite on the unmodified dependency versions and got a byte-identical result.Breaking Changes
None.
eventsource@4's only removal was theFetchLikeInittype (superseded byEventSourceFetchInit), which this repo never imported —packages/client/src/client/sse.tsusesErrorEventandEventSourceInit, both still exported. No source changes were needed.Types of changes
Checklist
Additional context
Lockfile changes are limited to these two packages and their dedupe. There's no
.changeset/directory or Renovate/Dependabot config atHEAD, so no changeset file is included — let me know if the v2 line expects one and I'll add it.🤖 Generated with Claude Code