[dependabot]

Bumps sse-stream from 0.2.6 to 0.3.0.

Release notes

Sourced from sse-stream's releases.

sse-stream 0.3.0

Changes

• Shared SSE decoding for HTTP bodies and byte streams, with explicit terminal-error behavior.
• Validated encoding: reject invalid event/id metadata; preserve multiline data and encode keep-alive comments safely.
• Optional strict-fields feature: unknown fields become terminal errors. Disabled by default; Cargo feature unification applies this policy crate-wide.
• Clarified raw-block semantics, metadata handling, and migration requirements.
• Added a GPT-6 astra AI-assistance disclosure; MIT OR Apache-2.0 licensing is unchanged.

Breaking changes and migration

• Replace Bytes::from(event) / event.into() with event.encode()? or Bytes::try_from(event)?.
• KeepAlive::event now returns a result. SseBody returns BodyError; input errors must be convertible to a boxed Send + Sync error.
• Use SseBody constructors and configuration methods instead of struct literals or direct keep-alive access.
• Decoder/body errors are terminal. Obsolete parser error variants and deprecated from_byte_stream were removed; error enums are non-exhaustive.
• Decoder Send/Sync auto traits now also depend on the input buffer type.

Full details: 0.3.0 migration notes.

sse-stream = "0.3"
# To reject unknown fields:
# sse-stream = { version = "0.3", features = ["strict-fields"] }

Performance

• Direct byte-stream decoding avoids HTTP frame adaptation.
• Default memchr scanning and simdutf8 long-field validation, with standard-library fallbacks.
• Specialized data/comment/boundary paths, direct fragmented-data accumulation, and incremental event delivery.
• Retained parser scratch buffers capped at 64 KiB each after completion; released on EOF/error. This is not an event-size limit.
• Criterion coverage for 28 decoding and 5 encoding workloads. No unverified speedup claim over 0.2.6.

See benchmark methodology.

Validation: feature-matrix tests, Clippy, formatting, package verification, and the release workflow passed.

Full changelog: 4t145/sse-stream@release-0.2.6...release-0.3.0

Changelog

Sourced from sse-stream's changelog.

0.3.0 (2026-09-18)

Breaking API changes

• Encoding: TryFrom<Sse> for Bytes replaces From<Sse> for Bytes. Replace Bytes::from(event) or event.into() with event.encode()? or Bytes::try_from(event)?.
• Keep-alive events: KeepAlive::event returns Result<KeepAlive, EncodeError>. Use KeepAlive::new().event(event)?.
• Body errors: SseBody::Error is now BodyError, not the input error E. Match BodyError::Stream for boxed upstream errors and BodyError::Encode for encoding errors; upstream error sources are preserved.
• Input error bounds: SseBody requires E: Into<Box<dyn std::error::Error + Send + Sync>>.
• Error matching: Removed InvalidLine, DuplicatedEventLine, DuplicatedIdLine, DuplicatedRetry, and IntParse. Error, EncodeError, and BodyError are non-exhaustive; add wildcard arms.
• Decoder constructor: Removed from_byte_stream, deprecated since 0.2.4. Use SseByteStream::new or the retained SseStream::from_bytes_stream.
• Decoder auto traits: SseStream<B> now also requires B::Data: Send or Sync to implement the corresponding trait, since it retains input buffers. Standard Bytes buffers are unaffected.
• Body construction: Struct literals are no longer supported. Use SseBody::new(stream) or SseBody::new_keep_alive(stream, config).
• Keep-alive access: SseBody::keep_alive is private. Use has_keep_alive() to inspect it and with_keep_alive() to configure it. Directly clearing the configuration is no longer supported.

Behavior changes

• Terminal errors: Decoders and SseBody emit an error once, then end. Keep-alives stop too. To resume decoding, create a decoder for a new input stream.
• Unknown fields: Ignored by default instead of rejected; colonless fields have empty values. The opt-in strict-fields feature rejects unknown names with the always-public Error::UnknownField unit variant, emitted once before termination. Cargo feature unification applies this policy to all users of the same resolved crate.
• Repeated metadata: event, id, and retry use the last valid value.
• Retry parsing: Only ASCII digits fitting in u64 are accepted. Empty, signed, padded, or overflowing values are ignored without replacing a valid value.
• Ignored text: Comments are ignored regardless of encoding or tracing settings. Unknown fields are also ignored regardless of encoding unless strict-fields is enabled; strict mode rejects unknown names without validating their UTF-8.
• Metadata validation: Encoding rejects CR/LF in event types and CR/LF/NULL in ids, including direct field assignments. No bytes are returned on failure.
• Multiline data: Every line receives a data: prefix. Empty and trailing lines are preserved; CRLF and bare CR are normalized to LF.
• Keep-alive comments: Every line receives a comment prefix, preventing field injection.
• Retry duration: retry_duration saturates at u64::MAX milliseconds instead of wrapping.

Clarified existing behavior

... (truncated)

Commits

• 121c2ec docs: finalize 0.3.0 release notes and AI disclosure (#19)
• bfc0706 feat: prepare 0.3.0 with shared SSE parsing and validated encoding (#18)
• 7f212c8 release 0.1.2
• 21dd51b make error sync, parse the space after comma
• 67c8b7d remove type parameter in Error, add helper types
• 2790f8b fix publish
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[patchwave]

This PR is safe to merge

✅ Safe to merge (1)

Dependency	Update
sse-stream	0.2.6 → 0.3.0

View the full report · Analyzed by PatchWave