Fix WebSocket disconnects with Home Assistant 2026.10 (bump Starscream and HAKit)

[bgoncal]

AI Policy

• I have read the Open Home Foundation AI Policy.

Select exactly one option that describes AI usage in this contribution:

• I have not used AI for this contribution.
• AI assistance was used for this contribution.
• AI fully generated the code for this contribution, but I've reviewed and understood it before submitting and will respond without AI during review.

Summary

Fixes #6011 (also reported as #5999 and home-assistant/core#184799).

Since Core 2026.10.0 the app's WebSocket is dropped roughly every 56 seconds with Received frame with non-zero reserved bits (close code 1002).

Root cause: Starscream ran every outgoing frame through the permessage-deflate compressor, so control frames (close/ping/pong) went out with RSV1 set — including the empty pong it sends back for the server's 55 s heartbeat ping. RFC 7692 §6.1 forbids that; aiohttp 3.14.4 (bumped in home-assistant/core#184382) now enforces it, while 3.14.3 tolerated it.

• Bumps the Starscream fork pin to bgoncal/Starscream@9f793f7 (4.0.10), which only compresses text and binary frames.
• Bumps HAKit to 0.4.19 (Bump Starscream to 4.0.10 and release 0.4.19 HAKit#127), which requires that Starscream release.

Not affected before this change: watchOS (compression already disabled in HAKit) and mTLS connections (URLSessionWebSocketTask).

Screenshots

N/A

Link to pull request in Documentation repository

Documentation: home-assistant/companion.home-assistant#

Any other notes

Reproduced against aiohttp directly with a raw client sending Starscream's frame bytes: pong 0xCA (FIN|RSV1) is rejected by 3.14.4 with the exact error above and accepted by 3.14.3; a compliant 0x8A pong is accepted by both.

The app requires iOS 16.4, so iOS 15 devices on older app builds will keep hitting this against Core 2026.10+ — a server-side tolerance would need to come from aiohttp/Core.

[Copilot]

🟡 Changes recommended

Two local package manifests still require HAKit 0.4.18 exactly, creating an unsatisfiable SwiftPM graph.

1 open finding

• Update local package HAKit requirements to 0.4.19 · New

What changed in this PR

Updates WebSocket dependencies to fix protocol-error disconnects with Home Assistant 2026.10.

Changes:

• Bumps HAKit to 0.4.19.
• Pins Starscream 4.0.10’s control-frame compression fix.

File	Description
Package.resolved	Updates resolved dependency revisions.
HomeAssistant.xcodeproj/​project.xcworkspace/​xcshareddata/​swiftpm/​Package.resolved	Updates workspace dependency resolutions.
HomeAssistant.xcodeproj/​project.pbxproj	Updates project-level package requirements.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.17%. Comparing base (9ecc20c) to head (a9bc471).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6038   +/-   ##
=======================================
  Coverage   54.16%   54.17%           
=======================================
  Files        1244     1244           
  Lines       82644    82644           
=======================================
+ Hits        44766    44772    +6     
+ Misses      37878    37872    -6     

see 7 files with indirect coverage changes

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.