v2.1.3

[bwp91]

• fix: int32 range check in DataStreamParser
• fix: readFloat64LE missing reader index advance
• fix: utf-8 tag using char count not byte length
• fix: validate encrypted data length before crypto split
• fix: validate required TLV fields in pairing handlers
• fix: unhandled Promise.all rejection in RTP proxy setup
• fix: missing SEQUENCE_NUM check in pair handlers
• fix: prevent M1 resetting in-progress pair setup
• fix: TLV decoder missing length bounds validation
• fix: unsafe non-null assertions in accessory lookups
• fix: validate aid.iid format before parsing
• fix: unguarded buffer reads in camera stream TLV parsing
• fix: category defaulting to string instead of enum
• fix: missing error argument in pairing debug logs
• fix: use constant-time comparison for pincode checks
• fix: "undefined" string in characteristic error warnings
• fix: O(n²) buffer concat in encrypt/decrypt hot path
• chore: dependency updates, inc. typescript

[coveralls]

Coverage Report for CI Build 24964733939

Coverage increased (+1.2%) to 64.646%

Details

• Coverage increased (+1.2%) from the base build.
• Patch coverage: 80 uncovered changes across 4 files (53 of 133 lines covered, 39.85%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
src/lib/HAPServer.ts	91	25	27.47%
src/lib/camera/RTPStreamManagement.ts	8	0	0.0%
src/lib/Accessory.ts	18	13	72.22%
src/lib/Characteristic.ts	2	1	50.0%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	9442
Covered Lines:	6413
Line Coverage:	67.92%
Relevant Branches:	3360
Covered Branches:	1863
Branch Coverage:	55.45%
Branches in Coverage %:	Yes
Coverage Strength:	308.75 hits per line

---

💛 - Coveralls

[Copilot]

Pull request overview

This PR prepares the v2.1.3 release by hardening TLV parsing, fixing several pairing/datastream edge cases, improving crypto hot-path performance, and updating test/build tooling and dependencies.

Changes:

• Fixes DataStream parsing/writing correctness (Float64 reader index advance, Int32 range check, UTF-8 byte-length tags) and adds coverage.
• Hardens TLV parsing and pairing/stream handlers with additional validation and error handling.
• Improves crypto framing performance (avoid O(n²) buffer concatenation) and updates dependencies/tooling for Jest/TypeScript.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tsconfig.spec.json	Adds a dedicated TS config for Jest/ts-jest compilation.
jest.config.ts	Configures ts-jest to use tsconfig.spec.json.
src/lib/util/tlv.ts	Adds TLV decode bounds validation for malformed/truncated buffers.
src/lib/util/tlv.spec.ts	Adds tests for TLV decode truncation/length validation and zero-length entries.
src/lib/util/hapCrypto.ts	Reworks encrypt/decrypt framing to accumulate chunks and Buffer.concat once.
src/lib/util/hapCrypto.spec.ts	Adds a multi-chunk encrypt/decrypt round-trip test for large messages.
src/lib/model/AccessoryInfo.ts	Defaults missing persisted category to Categories.OTHER (enum) rather than "".
src/lib/model/AccessoryInfo.spec.ts	Adds regression test for category defaulting behavior on load.
src/lib/datastream/DataStreamParser.ts	Fixes Float64 reader index advance, Int32 range bounds, and UTF-8 tag sizing.
src/lib/datastream/DataStreamParser.spec.ts	Adds tests covering the datastream fixes (Int32, Float64 advancement, UTF-8 byte length).
src/lib/camera/RTPStreamManagement.ts	Adds try/catch around stream start parsing and handles RTP proxy setup Promise rejections.
src/lib/HAPServer.ts	Adds missing TLV field validation, pairing encrypted-length checks, safer accessory ID parsing, constant-time pincode checks, and improved debug logging.
src/lib/Characteristic.ts	Prevents "undefined" error strings in characteristic warnings by using a fallback message.
src/lib/Accessory.ts	Removes unsafe non-null assertions in accessory/characteristic lookups and guards event parsing.
package.json	Updates dependencies/devDependencies (notably TypeScript, eslint, axios, ts-jest, etc.).
package-lock.json	Locks updated dependency graph consistent with package.json.
CHANGELOG.md	Adds pending v2.1.3 changelog entries matching the fixes in this PR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.