@homebridge-plugins/homebridge-wemo 7.6.0-beta.3 → 7.7.0

package/CHANGELOG.md

@@ -2,14 +2,37 @@
 
 All notable changes to `@homebridge-plugins/homebridge-wemo` will be documented in this file.
 
-## v7.6.0 (Pending Release)
+## v7.7.0 (2026-08-02)
 
 ### Changed
 
+- chore: add a test setup with tests for the shared helper functions
+- chore(github): run the build and tests in ci, on node 22, 24 and 26
+- chore: use the same lint setup across every plugin
+- chore: add a changelog:sync script to populate the pending section from the commits
+- chore: count a repeated commit subject once when syncing the changelog
+- chore(github): check the changelog against the commits in ci
+- chore(deps): dependency updates
+- docs: add node 26 to the supported node versions
+- feat: only accept a device status notification from the address the device was discovered on, with a disableNotifySourceCheck option for networks that rewrite addresses (#277)
+- fix: replace the ip dependency with a local subnet check, clearing its unfixable npm advisory
+
+## v7.6.0 (2026-07-27)
+
+### Changed
+
+- docs: point the beta version link at this plugin's wiki
+- chore(branding): store the plugin header in the standard branding folder
+- chore(github): allow the codeql scan to be started manually
+- Bump p-queue from 9.3.1 to 9.3.2 (#273)
+- chore(github): stop concurrent release runs racing for the same version
+- chore(github): use the shared homebridge action to deprecate past pre-releases
 - feat(ui): add, remove and hide devices from the config via the my devices tab
 - style(ui): standardise the custom ui layout and sync the support tab with the readme
 - feat(ui): add a remove all devices action to the my devices tab
 - chore: declare the supports-hap transport keyword for the homebridge ui
+- chore(deps): dependency updates
+- docs(changelog): list every unreleased commit in the pending section
 
 ## v7.5.3 (2026-07-18)
 

package/README.md

@@ -31,7 +31,7 @@ Homebridge plugin to integrate Wemo devices into HomeKit
 ### Prerequisites
 
 - To use this plugin, you will need to already have:
-  - [Node](https://nodejs.org): latest version of `v22` or `v24` - any other major version is not supported.
+  - [Node](https://nodejs.org): latest version of `v22`, `v24` or `v26` - any other major version is not supported.
   - [Homebridge](https://homebridge.io): `v1.6` or above - refer to link for more information and installation instructions.
   - For the UPnP connection, make sure your Homebridge instance has an allocated IP from the same IP network or VLAN as your Wemo devices. Otherwise, you should disable the UPnP connection to avoid connection errors.
 

package/config.schema.json

@@ -106,6 +106,11 @@
         "title": "Disable Device Logging",
         "description": "Global logging setting for accessory status changes. If true then accessory status changes will not be logged. This can also be set per accessory later in the config."
       },
+      "disableNotifySourceCheck": {
+        "type": "boolean",
+        "title": "Disable Notify Source Check",
+        "description": "By default, a device status notification is only accepted when it comes from the address the device was discovered on. Enable this if your network rewrites addresses (for example Docker bridge networking or NAT) and the log shows notifications being ignored."
+      },
       "removeByName": {
         "title": "Remove By Name",
         "type": "string"
@@ -646,6 +651,7 @@
       "expandable": true,
       "items": [
         "disableDeviceLogging",
+        "disableNotifySourceCheck",
         "hideConnectionErrors",
         "discoveryInterval",
         "wemoClient.discover_opts.interfaces",

package/lib/homebridge-ui/public/index.html

@@ -192,7 +192,7 @@
 <ul>
   <li>To use this plugin, you will need to already have:</li>
   <ul>
-    <li><a href="https://nodejs.org" target="_blank">Node</a>: latest version of <code>v22</code> or <code>v24</code> - any other major version is not supported.</li>
+    <li><a href="https://nodejs.org" target="_blank">Node</a>: latest version of <code>v22</code>, <code>v24</code> or <code>v26</code> - any other major version is not supported.</li>
     <li><a href="https://homebridge.io" target="_blank">Homebridge</a>: <code>v1.6</code> or above - refer to link for more information and installation instructions.</li>
     <li>For the UPnP connection, make sure your Homebridge instance has an allocated IP from the same IP network or VLAN as your Wemo devices. Otherwise, you should disable the UPnP connection to avoid connection errors.</li>
   </ul>

package/lib/platform.js

@@ -5,7 +5,6 @@ import process from 'node:process'
 import { URL as url } from 'node:url'
 
 import axios from 'axios'
-import ip from 'ip'
 import nodeSSDP from 'node-ssdp'
 import { parseStringPromise } from 'xml2js'
 import { create as xmlCreate } from 'xmlbuilder'
@@ -16,7 +15,7 @@ import deviceTypes from './device/index.js'
 import eveService from './fakegato/fakegato-history.js'
 import platformConsts from './utils/constants.js'
 import eveChars from './utils/eve-chars.js'
-import { parseError, parseSerialNumber } from './utils/functions.js'
+import { parseError, parseSerialNumber, sameIpv4Subnet } from './utils/functions.js'
 import platformLang from './utils/lang-en.js'
 
 const { Client: ssdp } = nodeSSDP
@@ -24,6 +23,7 @@ const require = createRequire(import.meta.url)
 const plugin = require('../package.json')
 
 const devicesInHB = new Map()
+const notifySourceWarned = new Set()
 const trailingSlashRegex = /\/\s*$/
 
 let listenerServer
@@ -113,6 +113,7 @@ export default class {
       const [key, val] = entry
       switch (key) {
         case 'disableDeviceLogging':
+        case 'disableNotifySourceCheck':
         case 'disableUPNP':
         case 'hideConnectionErrors':
           if (typeof val === 'string') {
@@ -423,11 +424,31 @@ export default class {
         let body = ''
         const accessory = devicesInHB.get(req.url.substring(1))
         if (req.method === 'NOTIFY' && accessory) {
-          // A notification from a known device
-          req.on('data', (chunk) => {
-            body += chunk.toString()
-          })
-          req.on('end', () => this.httpClient.receiveDeviceUpdate(accessory, body))
+          // Only accept a notification from the address the device was discovered on.
+          // Anything on the network can reach this listener, so without this check a
+          // notification for a known device could be forged from elsewhere. Networks
+          // which rewrite source addresses (docker bridge, some NAT) can turn this
+          // off with the disableNotifySourceCheck setting.
+          const remoteIp = (req.socket.remoteAddress || '').replace('::ffff:', '')
+          if (this.config.disableNotifySourceCheck || remoteIp === accessory.context.ipAddress) {
+            // A notification from a known device
+            req.on('data', (chunk) => {
+              body += chunk.toString()
+            })
+            req.on('end', () => this.httpClient.receiveDeviceUpdate(accessory, body))
+          } else if (!notifySourceWarned.has(accessory.UUID)) {
+            // Warn once per accessory, so a misconfigured network does not flood the log
+            notifySourceWarned.add(accessory.UUID)
+            this.log.warn(
+              '[%s] %s [%s] %s [%s] - %s.',
+              accessory.displayName,
+              platformLang.notifyIgnored,
+              remoteIp,
+              platformLang.notifyIgnoredAs,
+              accessory.context.ipAddress,
+              platformLang.notifyIgnoredOpt,
+            )
+          }
         }
         res.writeHead(200)
         res.end()
@@ -1419,7 +1440,7 @@ export default class {
         const [k2] = subEntry
         const address = interfaces[k][k2]
         if ((address.family === 'IPv4' || address.family === 4) && !address.internal) {
-          if (targetNetwork && ip.subnet(address.address, address.netmask).contains(targetNetwork)) {
+          if (targetNetwork && sameIpv4Subnet(address.address, targetNetwork, address.netmask)) {
             // Try to find IP address on the same IP network as the device's location
             addresses.unshift(address.address)
           } else {

package/lib/utils/functions.js

@@ -29,6 +29,15 @@ function parseError(err, hideStack = []) {
   return toReturn
 }
 
+// Whether two IPv4 addresses sit in the same subnet for the given netmask.
+// Replaces the single ip.subnet().contains() call this plugin used from the
+// `ip` package, which carries an unfixed npm advisory (GHSA in its isPublic).
+function sameIpv4Subnet(addressA, addressB, netmask) {
+  const toInt = addr => addr.split('.').reduce((acc, octet) => (acc * 256) + Number.parseInt(octet, 10), 0)
+  const mask = toInt(netmask)
+  return ((toInt(addressA) & mask) >>> 0) === ((toInt(addressB) & mask) >>> 0)
+}
+
 function parseSerialNumber(input) {
   return input
     .toString()
@@ -48,5 +57,6 @@ export {
   hasProperty,
   parseError,
   parseSerialNumber,
+  sameIpv4Subnet,
   sleep,
 }

package/lib/utils/functions.test.js

@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest'
+
+import { decodeXML, generateRandomString, hasProperty, parseError, parseSerialNumber } from './functions.js'
+
+describe('decodeXML', () => {
+  it('decodes the entities wemo devices put in their soap responses', () => {
+    expect(decodeXML('&lt;tag&gt;')).toBe('<tag>')
+    expect(decodeXML('Tom &amp; Jerry')).toBe('Tom & Jerry')
+    expect(decodeXML('&quot;quoted&quot;')).toBe('"quoted"')
+    expect(decodeXML('it&#039;s')).toBe('it\'s')
+  })
+
+  it('decodes a realistic nested payload', () => {
+    // Wemo wraps its state XML inside another XML document, so the inner
+    // document arrives entity-encoded and has to be decoded before parsing.
+    expect(decodeXML('&lt;BinaryState&gt;1&lt;/BinaryState&gt;'))
+      .toBe('<BinaryState>1</BinaryState>')
+  })
+
+  it('leaves text with no entities untouched', () => {
+    expect(decodeXML('plain text')).toBe('plain text')
+    expect(decodeXML('')).toBe('')
+  })
+
+  it('decodes an escaped ampersand entity twice, because &amp; is replaced first', () => {
+    // ⚠️ Documenting real behaviour, not endorsing it. The replacements run in
+    // order with &amp; first, so "&amp;lt;" becomes "&lt;" and is then decoded
+    // again to "<". Anything relying on a literal "&lt;" surviving would be
+    // disappointed - worth knowing if this is ever reused elsewhere.
+    expect(decodeXML('&amp;lt;')).toBe('<')
+  })
+})
+
+describe('parseSerialNumber', () => {
+  it('uppercases and strips the spacing users paste in', () => {
+    expect(parseSerialNumber('abc 123')).toBe('ABC123')
+    expect(parseSerialNumber('  abc123  ')).toBe('ABC123')
+  })
+
+  it('strips quotes, which get added when copying from a log', () => {
+    expect(parseSerialNumber('"ABC123"')).toBe('ABC123')
+    expect(parseSerialNumber('\'ABC123\'')).toBe('ABC123')
+  })
+
+  it('accepts a non-string value without throwing', () => {
+    expect(parseSerialNumber(123456)).toBe('123456')
+  })
+
+  it('leaves an already-clean serial alone', () => {
+    expect(parseSerialNumber('ABC123')).toBe('ABC123')
+  })
+})
+
+describe('generateRandomString', () => {
+  it('returns the requested length', () => {
+    expect(generateRandomString(16)).toHaveLength(16)
+  })
+
+  it('uses only lowercase letters and digits', () => {
+    expect(generateRandomString(200)).toMatch(/^[a-z0-9]+$/)
+  })
+
+  it('does not return the same value twice in a row', () => {
+    expect(generateRandomString(32)).not.toBe(generateRandomString(32))
+  })
+})
+
+describe('hasProperty', () => {
+  it('detects own properties only', () => {
+    expect(hasProperty({ a: 1 }, 'a')).toBe(true)
+    expect(hasProperty({ a: undefined }, 'a')).toBe(true)
+    expect(hasProperty({}, 'a')).toBe(false)
+  })
+
+  it('ignores inherited properties', () => {
+    expect(hasProperty({}, 'toString')).toBe(false)
+  })
+})
+
+describe('parseError', () => {
+  it('appends the first stack frame to the message', () => {
+    const err = new Error('boom')
+    err.stack = 'Error: boom\n    at thing (/a.js:1:1)'
+    expect(parseError(err)).toBe('boom at thing (/a.js:1:1)')
+  })
+
+  it('hides the stack for errors the caller expects', () => {
+    const err = new Error('EHOSTUNREACH')
+    err.stack = 'Error: EHOSTUNREACH\n    at thing (/a.js:1:1)'
+    expect(parseError(err, ['EHOSTUNREACH'])).toBe('EHOSTUNREACH')
+  })
+
+  it('returns the message when there is no stack', () => {
+    const err = new Error('nostack')
+    err.stack = ''
+    expect(parseError(err)).toBe('nostack')
+  })
+})

package/lib/utils/lang-en.js

@@ -90,6 +90,9 @@ export default {
   noInterface: 'Unable to find interface',
   noPort: 'could not find correct port for device',
   noService: 'device does not have this service',
+  notifyIgnored: 'ignoring a status notification from',
+  notifyIgnoredAs: 'as it does not match the device address',
+  notifyIgnoredOpt: 'if your network rewrites addresses (docker/nat), enable the Disable Notify Source Check setting',
   noServices: 'device does not have any upnp services',
   noSockets: 'NodeSSDP error [no sockets], if this continues to happen try restarting Homebridge',
   notConfigured: 'Plugin has not been configured',

package/package.json

@@ -2,7 +2,7 @@
   "name": "@homebridge-plugins/homebridge-wemo",
   "alias": "Wemo",
   "type": "module",
-  "version": "7.6.0-beta.3",
+  "version": "7.7.0",
   "description": "Homebridge plugin to integrate Wemo devices into HomeKit.",
   "author": {
     "name": "bwp91",
@@ -49,22 +49,27 @@
   "main": "lib/index.js",
   "engines": {
     "homebridge": "^1.6.0 || ^2.0.0",
-    "node": "^22.12.0 || ^24.0.0"
+    "node": "^22.12.0 || ^24.0.0 || ^26.0.0"
   },
   "scripts": {
     "lint": "eslint . --max-warnings=0",
-    "lint:fix": "npm run lint -- --fix"
+    "lint:fix": "npm run lint -- --fix",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "test-coverage": "npm run test -- --coverage",
+    "changelog:sync": "node .github/scripts/sync-changelog.mjs"
   },
   "dependencies": {
     "@homebridge/plugin-ui-utils": "^2.2.5",
     "axios": "^1.18.1",
-    "ip": "^2.0.1",
     "node-ssdp": "^4.0.1",
-    "p-queue": "^9.3.1",
+    "p-queue": "^9.3.3",
     "xml2js": "^0.6.2",
     "xmlbuilder": "^15.1.1"
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^9.1.0"
+    "@antfu/eslint-config": "^9.2.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "vitest": "^4.1.10"
   }
 }