v2.1.7#1120
Merged
Merged
Conversation
Coverage Report for CI Build 26403229315Coverage increased (+1.5%) to 66.09%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
There was a problem hiding this comment.
Pull request overview
This PR prepares the v2.1.7 release by updating dependencies, removing local type shims in favor of upstream typings (notably bonjour-hap), and adding a broad set of regression tests around pairing, request validation, and camera streaming error handling.
Changes:
- Update Homebridge-related dependencies and various dev dependencies, plus refresh
package-lock.json. - Drop local
@types/bonjour-hapshims and adjustAdvertisertyping to match upstreambonjour-hapexports. - Add multiple new/expanded Jest test suites covering previously fixed guards/edge cases in HAP server pairing handlers, accessory characteristic handling, and RTP stream management.
Reviewed changes
Copilot reviewed 8 out of 11 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/lib/HAPServer.spec.ts | Adds extensive integration tests for pairing guards, TLV validation, debug logging args, and constant-time auth comparisons. |
| src/lib/Characteristic.spec.ts | Adds tests ensuring “Unknown error” warning text for non-Error throws. |
| src/lib/camera/RTPStreamManagement.spec.ts | New tests for malformed TLV handling in _handleStartStream and proxy setup rejection handling. |
| src/lib/Advertiser.ts | Switches from local bonjour-hap shim types to upstream bonjour-hap types (Bonjour, Advertisement). |
| src/lib/Accessory.spec.ts | Adds tests for malformed aid.iid event strings and safe lookups in slow/timeout warnings. |
| package.json | Dependency and devDependency version bumps (incl. Homebridge beta packages). |
| package-lock.json | Lockfile updated to reflect dependency bumps. |
| CHANGELOG.md | Adds “v2.1.7 (Pending Release)” entry describing included changes and dependency versions. |
| @types/simple-plist.d.ts | Removes unused/obsolete local type shim file. |
| @types/bonjour-hap.d.ts | Removes local bonjour-hap type shim file. |
| .github/workflows/release.yml | Bumps jannemattila/get-version-from-tag action from v3 to v4. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Adds four HAPServer integration tests verifying the guard from 0719059: /pair-setup M5 and /pair-verify M3 must respond with M4 + TLVErrorCode.AUTHENTICATION when ENCRYPTED_DATA is missing or shorter than the 16-byte auth tag, rather than passing through to a Buffer.alloc with a negative length. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds seven HAPServer integration tests verifying the guards from 58c24b9: - /pair-setup M5 rejects when the decrypted sub-TLV is missing IDENTIFIER - /pair-verify M3 rejects when the decrypted sub-TLV is missing PROOF - /pairings rejects requests missing METHOD or STATE - /pairings ADD_PAIRING rejects when IDENTIFIER or PUBLIC_KEY is missing - /pairings REMOVE_PAIRING rejects when IDENTIFIER is missing Without these guards the handlers would crash on a `Buffer.toString()` / indexed access of an undefined TLV entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds two RTPStreamManagement tests verifying the .catch handler from 0ce74c4: when RTPProxy.setup() rejects (e.g. socket bind failure), handleSetupEndpoints must surface the error via the callback and write SetupEndpointsStatus.ERROR into setupEndpointsResponse. Without the catch this surfaced as an unhandled promise rejection. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds two HAPServer integration tests verifying the guard from ebe2ec6: /pair-setup and /pair-verify must reject with 400 BAD_REQUEST + STATE=M2 + UNKNOWN error when the request TLV is missing TLVValues.SEQUENCE_NUM, rather than crashing on an indexed read of an undefined entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds two HAPServer integration tests verifying the guard from d4c81be: - a second M1 on a connection with in-progress pair-setup state is rejected with 400 BAD_REQUEST + STATE=M2 + UNKNOWN, rather than restarting setup and overwriting the in-progress SRP server. - a fresh connection can still start M1 normally — the guard does not leak across connections. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds two Accessory tests verifying the fix from 03b49f9: when a GET /characteristics or PUT /characteristics request includes an aid.iid that does not resolve to a known accessory or characteristic, the slow-read/slow-write and timeout warning timers must skip the entry rather than crash on `getAccessoryByAID(aid)!.getCharacteristicByIID(iid)!`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds tests verifying the guards from ec93c50: - HAPServer GET /characteristics rejects malformed `?id=` entries (non-numeric, missing dot, too many dots, empty parts) with 400 + HAPStatus.INVALID_VALUE_IN_REQUEST, both for a single bad entry and inside a comma-separated list. - Accessory.handleHAPConnectionClosed skips registered events that do not contain a dot separator, instead of feeding an undefined index to parseInt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds two RTPStreamManagement tests verifying the try/catch from 3405658: when a /selected-stream-configuration write contains malformed video/audio configuration TLVs (missing fields, undefined buffer reads), `_handleStartStream` must call back with HAPStatus.INVALID_VALUE_IN_REQUEST rather than throwing out of the characteristic write handler. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds two HAPServer integration tests verifying the fix from f12ed23: when M5 / pair-verify M3 decryption fails, the debug() call must receive the caught error as its second %s argument. Tests intercept the global debug.log function and assert the captured args include the username AND the error object — without the fix only the username was passed and %s rendered as a literal trailing \"undefined\" / blank. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds five HAPServer tests verifying the fix from 12aea01: the insecure PUT /characteristics and POST /resource paths must compare the authorization header against the configured pincode using crypto.timingSafeEqual with a length check first. Coverage: - missing authorization → CONNECTION_AUTHORIZATION_REQUIRED - wrong-length authorization → rejected (without the length guard timingSafeEqual would throw RangeError) - same-length wrong pincode → rejected - correct pincode → authorized - /resource endpoint also rejects wrong-length auth Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds three Characteristic tests verifying the fix from fe8c1b3: when validateUserInput throws an object without a `message` property (e.g. a non-Error), setValue and updateValue must emit the characteristic warning with the message "Unknown error" instead of the literal string "undefined" produced by `error?.message + ""`. A real Error message is still preserved untouched. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
NorthernMan54
approved these changes
May 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Homebridge Dependencies
@homebridge/ciao@v1.3.9-beta@homebridge/dbus-native@v0.7.6-betabonjour-hap@v3.10.3-beta