[theamodhshetty]

Summary

A leading UTF-8 BOM currently hides the first data, event, or id field in an SSE response. It can also trigger a false event-size error. A non-UTF-8 response charset or client default encoding corrupts UTF-8 event data.

The SSE parsing rules require UTF-8 decoding and ignoring exactly one leading BOM. Decode response content bytes through the existing incremental TextDecoder before line buffering and size checks. Later U+FEFF characters remain intact, and Response.encoding is unchanged.

Added 42 parameterized sync/async regression cases covering fragmented BOMs and UTF-8 characters, event metadata, exact size limits, later/double BOMs, and charset/default-encoding overrides. Updated the SSE documentation.

Local validation on Python 3.15.0:

• Against untouched upstream b77e3e8, nine sync regressions fail and five controls pass.
• All 2,138 tests pass with the fix.
• scripts/coverage reports 100% coverage; scripts/check passes formatting, typing, lint, lockfile and unasync checks.

Hosted CI and maintainer review remain separate gates.

Checklist

• I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.

Implementation and tests were prepared with Codex assistance.

[codspeed]

Merging this PR will not alter performance

✅ 18 untouched benchmarks
⏩ 7 skipped benchmarks¹

---

_{Comparing theamodhshetty:fix/sse-leading-bom (2e05bcd) with main (b77e3e8)}

Footnotes

1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cubic-dev-ai]

No issues found across 3 files

_{View guided diff | Re-trigger cubic}