@homebridge-plugins/homebridge-wemo 7.6.0 → 7.7.1-beta.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to `@homebridge-plugins/homebridge-wemo` will be documented in this file.
 
+## v7.7.1 (Pending Release)
+
+### Changed
+
+- chore: exclude test files and the test config from the published package
+- fix: restore debug logging when the plugin runs in a child bridge
+- fix: only turn adaptive lighting off when a colour is genuinely chosen elsewhere
+- fix: send a colour change when only the saturation moves, and mend the al cleanup
+- fix: explain a port clash on the notification listener instead of crashing the bridge
+- fix: stop gating a few log lines on a debug setting that was never readable
+
+## v7.7.0 (2026-08-02)
+
+### Changed
+
+- chore: add a test setup with tests for the shared helper functions
+- chore(github): run the build and tests in ci, on node 22, 24 and 26
+- chore: use the same lint setup across every plugin
+- chore: add a changelog:sync script to populate the pending section from the commits
+- chore: count a repeated commit subject once when syncing the changelog
+- chore(github): check the changelog against the commits in ci
+- chore(deps): dependency updates
+- docs: add node 26 to the supported node versions
+- feat: only accept a device status notification from the address the device was discovered on, with a disableNotifySourceCheck option for networks that rewrite addresses (#277)
+- fix: replace the ip dependency with a local subnet check, clearing its unfixable npm advisory
+
 ## v7.6.0 (2026-07-27)
 
 ### Changed

package/README.md

@@ -31,7 +31,7 @@ Homebridge plugin to integrate Wemo devices into HomeKit
 ### Prerequisites
 
 - To use this plugin, you will need to already have:
-  - [Node](https://nodejs.org): latest version of `v22` or `v24` - any other major version is not supported.
+  - [Node](https://nodejs.org): latest version of `v22`, `v24` or `v26` - any other major version is not supported.
   - [Homebridge](https://homebridge.io): `v1.6` or above - refer to link for more information and installation instructions.
   - For the UPnP connection, make sure your Homebridge instance has an allocated IP from the same IP network or VLAN as your Wemo devices. Otherwise, you should disable the UPnP connection to avoid connection errors.
 

package/config.schema.json

@@ -106,6 +106,11 @@
         "title": "Disable Device Logging",
         "description": "Global logging setting for accessory status changes. If true then accessory status changes will not be logged. This can also be set per accessory later in the config."
       },
+      "disableNotifySourceCheck": {
+        "type": "boolean",
+        "title": "Disable Notify Source Check",
+        "description": "By default, a device status notification is only accepted when it comes from the address the device was discovered on. Enable this if your network rewrites addresses (for example Docker bridge networking or NAT) and the log shows notifications being ignored."
+      },
       "removeByName": {
         "title": "Remove By Name",
         "type": "string"
@@ -646,6 +651,7 @@
       "expandable": true,
       "items": [
         "disableDeviceLogging",
+        "disableNotifySourceCheck",
         "hideConnectionErrors",
         "discoveryInterval",
         "wemoClient.discover_opts.interfaces",

package/lib/device/link-bulb.js

@@ -57,10 +57,22 @@ export default class {
     this.service = this.accessory.getService(this.hapServ.Lightbulb)
       || this.accessory.addService(this.hapServ.Lightbulb)
 
-    // If adaptive lighting has just been disabled then remove and re-add service to hide AL icon
+    // Adaptive lighting has just been switched off, so take away the three
+    // characteristics that make Home offer it. Only these need to go: the whole
+    // Lightbulb service used to be thrown away and rebuilt here, which does hide
+    // the icon but presents Home with what looks like a different light, and an
+    // owner can lose that light's room and its automations as a result.
     if (this.alShift === -1 && this.accessory.context.adaptiveLighting) {
-      this.accessory.removeService(this.service)
-      this.service = this.accessory.addService(this.hapServ.Lightbulb)
+      [
+        'SupportedCharacteristicValueTransitionConfiguration',
+        'CharacteristicValueTransitionControl',
+        'CharacteristicValueActiveTransitionCount',
+      ].forEach((charName) => {
+        const char = this.hapChar[charName]
+        if (char && this.service.testCharacteristic(char)) {
+          this.service.removeCharacteristic(this.service.getCharacteristic(char))
+        }
+      })
       this.accessory.context.adaptiveLighting = false
     }
 
@@ -85,6 +97,14 @@ export default class {
       this.service.getCharacteristic(this.hapChar.Hue).onSet(async (value) => {
         await this.internalColourUpdate(value)
       })
+      // Saturation needs a handler of its own. HomeKit writes hue and saturation
+      // separately, so with only hue listened for, dragging saturation alone -
+      // the same colour made paler or richer - reached nothing and the bulb
+      // never changed. Both handlers share one update, and the debounce inside
+      // it collapses a hue-and-saturation pair into a single command.
+      this.service.getCharacteristic(this.hapChar.Saturation).onSet(async () => {
+        await this.internalColourUpdate(this.service.getCharacteristic(this.hapChar.Hue).value)
+      })
       this.cacheHue = this.service.getCharacteristic(this.hapChar.Hue).value
       this.cacheSat = this.service.getCharacteristic(this.hapChar.Saturation).value
     } else {
@@ -109,6 +129,10 @@ export default class {
           customTemperatureAdjustment: this.alShift,
         })
         this.accessory.configureController(this.alController)
+        // Without this the cleanup that removes the adaptive lighting
+        // characteristics can never run, because it is guarded on this flag -
+        // so switching adaptive lighting off left Home still offering it.
+        this.accessory.context.adaptiveLighting = true
       }
     }
 
@@ -289,13 +313,15 @@ export default class {
         return
       }
 
-      // Don't continue if this value is same as before
-      if (this.cacheHue === value) {
+      // Don't continue if this colour is the same as before. Saturation is part
+      // of that question: comparing hue alone meant a change of saturation at
+      // the same hue looked like no change at all, and nothing was sent.
+      const currentSat = this.service.getCharacteristic(this.hapChar.Saturation).value
+      if (this.cacheHue === value && this.cacheSat === currentSat) {
         return
       }
 
       // First convert to RGB
-      const currentSat = this.service.getCharacteristic(this.hapChar.Saturation).value
       const [r, g, b] = hs2rgb(value, currentSat)
 
       // Then convert the RGB to the values needed for Wemo
@@ -424,7 +450,10 @@ export default class {
         // Log the change if appropriate
         this.accessory.log(`${platformLang.curColour} [X:${valueX} Y:${valueY}]`)
 
-        // Colour chosen externally so disable adaptive lighting
+        // Somebody chose this colour outside HomeKit - in the Wemo app, on a
+        // remote, or at the wall. Homebridge catches changes made in the Home
+        // app itself, but nothing else sees these, so adaptive lighting would
+        // carry on and move the bulb off that colour within minutes.
         if (this.alController?.isAdaptiveLightingActive()) {
           this.alController.disableAdaptiveLighting()
           this.accessory.log(platformLang.alDisabled)
@@ -449,7 +478,12 @@ export default class {
       const mToK = Math.round(1000000 / value)
       this.accessory.log(`${platformLang.curCCT} [${mToK}K / ${value}M]`)
 
-      // If the difference is significant (>20) then disable adaptive lighting
+      // A bulb repeating back the temperature adaptive lighting just set can
+      // land a few mireds off through the conversion, and treating that as the
+      // owner's doing would switch adaptive lighting off moments after it was
+      // switched on. Further apart than that and somebody set this temperature
+      // themselves, outside HomeKit - which nothing else would notice, so
+      // adaptive lighting has to be stopped here.
       if (!Number.isNaN(this.cacheMired)) {
         const diff = Math.abs(value - this.cacheMired) > 20
         if (this.alController?.isAdaptiveLightingActive() && diff) {

package/lib/homebridge-ui/public/index.html

@@ -192,7 +192,7 @@
 <ul>
   <li>To use this plugin, you will need to already have:</li>
   <ul>
-    <li><a href="https://nodejs.org" target="_blank">Node</a>: latest version of <code>v22</code> or <code>v24</code> - any other major version is not supported.</li>
+    <li><a href="https://nodejs.org" target="_blank">Node</a>: latest version of <code>v22</code>, <code>v24</code> or <code>v26</code> - any other major version is not supported.</li>
     <li><a href="https://homebridge.io" target="_blank">Homebridge</a>: <code>v1.6</code> or above - refer to link for more information and installation instructions.</li>
     <li>For the UPnP connection, make sure your Homebridge instance has an allocated IP from the same IP network or VLAN as your Wemo devices. Otherwise, you should disable the UPnP connection to avoid connection errors.</li>
   </ul>

package/lib/platform.js

@@ -5,7 +5,6 @@ import process from 'node:process'
 import { URL as url } from 'node:url'
 
 import axios from 'axios'
-import ip from 'ip'
 import nodeSSDP from 'node-ssdp'
 import { parseStringPromise } from 'xml2js'
 import { create as xmlCreate } from 'xmlbuilder'
@@ -16,7 +15,7 @@ import deviceTypes from './device/index.js'
 import eveService from './fakegato/fakegato-history.js'
 import platformConsts from './utils/constants.js'
 import eveChars from './utils/eve-chars.js'
-import { parseError, parseSerialNumber } from './utils/functions.js'
+import { parseError, parseSerialNumber, sameIpv4Subnet } from './utils/functions.js'
 import platformLang from './utils/lang-en.js'
 
 const { Client: ssdp } = nodeSSDP
@@ -24,6 +23,7 @@ const require = createRequire(import.meta.url)
 const plugin = require('../package.json')
 
 const devicesInHB = new Map()
+const notifySourceWarned = new Set()
 const trailingSlashRegex = /\/\s*$/
 
 let listenerServer
@@ -41,7 +41,6 @@ export default class {
     try {
       this.api = api
       this.log = log
-      this.isBeta = process.argv.includes('-D')
 
       // Configuration objects for accessories
       this.ignoredDevices = []
@@ -113,6 +112,7 @@ export default class {
       const [key, val] = entry
       switch (key) {
         case 'disableDeviceLogging':
+        case 'disableNotifySourceCheck':
         case 'disableUPNP':
         case 'hideConnectionErrors':
           if (typeof val === 'string') {
@@ -343,13 +343,16 @@ export default class {
       this.log('%s.', platformLang.initialised)
 
       // Sort out some logging functions
-      if (this.isBeta) {
-        this.log.debug = this.log
-        this.log.debugWarn = this.log.warn
-      } else {
-        this.log.debug = () => {}
-        this.log.debugWarn = () => {}
-      }
+      // Homebridge already decides whether debug lines are shown, and it gets it
+      // right in a child bridge too. This used to work it out for itself by
+      // looking for `-D` in the plugin's own process arguments, which a child
+      // bridge does not receive unless that bridge has its own debug setting
+      // turned on - so debug logging silently disappeared for anyone running the
+      // plugin in a child bridge with debug enabled globally.
+      //
+      // `debugWarn` has no equivalent on Homebridge's logger, so it goes out as
+      // a debug line too rather than being invented here.
+      this.log.debugWarn = (...args) => this.log.debug(...args)
 
       // Set up the discovery run counter
       this.discoveryRun = -1
@@ -423,44 +426,68 @@ export default class {
         let body = ''
         const accessory = devicesInHB.get(req.url.substring(1))
         if (req.method === 'NOTIFY' && accessory) {
-          // A notification from a known device
-          req.on('data', (chunk) => {
-            body += chunk.toString()
-          })
-          req.on('end', () => this.httpClient.receiveDeviceUpdate(accessory, body))
+          // Only accept a notification from the address the device was discovered on.
+          // Anything on the network can reach this listener, so without this check a
+          // notification for a known device could be forged from elsewhere. Networks
+          // which rewrite source addresses (docker bridge, some NAT) can turn this
+          // off with the disableNotifySourceCheck setting.
+          const remoteIp = (req.socket.remoteAddress || '').replace('::ffff:', '')
+          if (this.config.disableNotifySourceCheck || remoteIp === accessory.context.ipAddress) {
+            // A notification from a known device
+            req.on('data', (chunk) => {
+              body += chunk.toString()
+            })
+            req.on('end', () => this.httpClient.receiveDeviceUpdate(accessory, body))
+          } else if (!notifySourceWarned.has(accessory.UUID)) {
+            // Warn once per accessory, so a misconfigured network does not flood the log
+            notifySourceWarned.add(accessory.UUID)
+            this.log.warn(
+              '[%s] %s [%s] %s [%s] - %s.',
+              accessory.displayName,
+              platformLang.notifyIgnored,
+              remoteIp,
+              platformLang.notifyIgnoredAs,
+              accessory.context.ipAddress,
+              platformLang.notifyIgnoredOpt,
+            )
+          }
         }
         res.writeHead(200)
         res.end()
       })
 
+      // A failure to listen - the configured port already taken, or a privileged
+      // port without the rights to use it - arrives as an 'error' event, not
+      // through the listen callback. Node throws an 'error' event that nobody is
+      // listening for, so without this the bridge dies on a port clash and
+      // restarts into the same clash. The callback below only ever runs on
+      // success, and node calls it with no arguments.
+      listenerServer.on('error', (err) => {
+        this.log.warn('%s: %s.', platformLang.listenerError, parseError(err))
+      })
+
+      const logListenerPort = () => {
+        this.log.debug('%s [%s].', platformLang.listenerPort, listenerServer.address().port)
+      }
+
       // Start listening on the above created server
       if (this.config.wemoClient.listen_interface) {
         // User has defined a specific network interface to listen on
-        listenerServer.listen(this.config.wemoClient.port, this.getLocalInterfaceAddress(), (err) => {
-          if (err) {
-            this.log.warn('%s: %s.', platformLang.listenerError, err)
-          } else if (this.config.debug) {
-            // Log the port of the listener server in debug mode
-            this.log('%s [%s].', platformLang.listenerPort, listenerServer.address().port)
-          }
-        })
+        listenerServer.listen(this.config.wemoClient.port, this.getLocalInterfaceAddress(), logListenerPort)
       } else {
         // User has not defined a specific network interface to listen on
-        listenerServer.listen(this.config.wemoClient.port, (err) => {
-          if (err) {
-            this.log.warn('%s: %s', platformLang.listenerError, err)
-          } else if (this.config.debug) {
-            // Log the port of the listener server in debug mode
-            this.log('%s [%s].', platformLang.listenerPort, listenerServer.address().port)
-          }
-        })
+        listenerServer.listen(this.config.wemoClient.port, logListenerPort)
       }
 
       // Set up the SSDP client if the user has not specified manual devices only
       if (this.config.mode !== 'manual') {
-        if (this.isBeta) {
-          this.config.wemoClient.discover_opts.customLogger = this.log
-        }
+        // The discovery client's own chatter goes to the debug log, where
+        // Homebridge decides whether it is shown. It used to be handed the
+        // normal logger only when the plugin thought debug was on, which it
+        // could not tell in a child bridge. The wrapper matters: Homebridge's
+        // `debug` is not bound to its logger, so passing it bare would throw
+        // the first time the discovery client tried to log anything.
+        this.config.wemoClient.discover_opts.customLogger = (...args) => this.log.debug(...args)
         ssdpClient = new ssdp(this.config.wemoClient.discover_opts)
       }
 
@@ -490,19 +517,13 @@ export default class {
 
       // Shutdown the listener server if it's running
       if (listenerServer) {
-        listenerServer.close(() => {
-          if (this.config.debug) {
-            this.log('%s.', platformLang.listenerClosed)
-          }
-        })
+        listenerServer.close(() => this.log.debug('%s.', platformLang.listenerClosed))
       }
 
       // Stop the SSDP client if it's running
       if (ssdpClient) {
         ssdpClient.stop()
-        if (this.config.debug) {
-          this.log('%s.', platformLang.ssdpStopped)
-        }
+        this.log.debug('%s.', platformLang.ssdpStopped)
       }
 
       // Close accessory subscriptions
@@ -757,22 +778,21 @@ export default class {
   }
 
   applyAccessoryLogging(accessory) {
-    if (this.isBeta) {
-      accessory.log = msg => this.log('[%s] %s.', accessory.displayName, msg)
-      accessory.logWarn = msg => this.log.warn('[%s] %s.', accessory.displayName, msg)
-      accessory.logDebug = msg => this.log('[%s] %s.', accessory.displayName, msg)
-      accessory.logDebugWarn = msg => this.log.warn('[%s] %s.', accessory.displayName, msg)
-    } else {
-      if (this.config.disableDeviceLogging) {
-        accessory.log = () => {}
-        accessory.logWarn = () => {}
-      } else {
-        accessory.log = msg => this.log('[%s] %s.', accessory.displayName, msg)
-        accessory.logWarn = msg => this.log.warn('[%s] %s.', accessory.displayName, msg)
-      }
-      accessory.logDebug = () => {}
-      accessory.logDebugWarn = () => {}
+    // Debug lines always go to Homebridge's debug logger, which prints them only
+    // when debug is on - so there is nothing to decide here. Working it out from
+    // the process arguments instead is what lost debug logging entirely for
+    // anyone running the plugin in a child bridge.
+    accessory.logDebug = msg => this.log.debug('[%s] %s.', accessory.displayName, msg)
+    accessory.logDebugWarn = accessory.logDebug
+
+    if (this.config.disableDeviceLogging) {
+      accessory.log = () => {}
+      accessory.logWarn = () => {}
+      return
     }
+
+    accessory.log = msg => this.log('[%s] %s.', accessory.displayName, msg)
+    accessory.logWarn = msg => this.log.warn('[%s] %s.', accessory.displayName, msg)
   }
 
   async initialiseDevice(device) {
@@ -1419,7 +1439,7 @@ export default class {
         const [k2] = subEntry
         const address = interfaces[k][k2]
         if ((address.family === 'IPv4' || address.family === 4) && !address.internal) {
-          if (targetNetwork && ip.subnet(address.address, address.netmask).contains(targetNetwork)) {
+          if (targetNetwork && sameIpv4Subnet(address.address, targetNetwork, address.netmask)) {
             // Try to find IP address on the same IP network as the device's location
             addresses.unshift(address.address)
           } else {

package/lib/utils/functions.js

@@ -29,6 +29,15 @@ function parseError(err, hideStack = []) {
   return toReturn
 }
 
+// Whether two IPv4 addresses sit in the same subnet for the given netmask.
+// Replaces the single ip.subnet().contains() call this plugin used from the
+// `ip` package, which carries an unfixed npm advisory (GHSA in its isPublic).
+function sameIpv4Subnet(addressA, addressB, netmask) {
+  const toInt = addr => addr.split('.').reduce((acc, octet) => (acc * 256) + Number.parseInt(octet, 10), 0)
+  const mask = toInt(netmask)
+  return ((toInt(addressA) & mask) >>> 0) === ((toInt(addressB) & mask) >>> 0)
+}
+
 function parseSerialNumber(input) {
   return input
     .toString()
@@ -48,5 +57,6 @@ export {
   hasProperty,
   parseError,
   parseSerialNumber,
+  sameIpv4Subnet,
   sleep,
 }

package/lib/utils/lang-en.js

@@ -1,7 +1,7 @@
 export default {
   accNotFound: 'accessory not found',
   accNotReady: 'has not been discovered yet so commands will fail',
-  alDisabled: 'adaptive lighting disabled due to significant colour change',
+  alDisabled: 'adaptive lighting turned off, as the colour was changed outside HomeKit',
   awaiting: 'The following devices have still not been initially found',
   brand: 'Belkin Wemo',
   brightnessFail: 'could not obtain updated brightness as',
@@ -90,6 +90,9 @@ export default {
   noInterface: 'Unable to find interface',
   noPort: 'could not find correct port for device',
   noService: 'device does not have this service',
+  notifyIgnored: 'ignoring a status notification from',
+  notifyIgnoredAs: 'as it does not match the device address',
+  notifyIgnoredOpt: 'if your network rewrites addresses (docker/nat), enable the Disable Notify Source Check setting',
   noServices: 'device does not have any upnp services',
   noSockets: 'NodeSSDP error [no sockets], if this continues to happen try restarting Homebridge',
   notConfigured: 'Plugin has not been configured',

package/package.json

@@ -2,7 +2,7 @@
   "name": "@homebridge-plugins/homebridge-wemo",
   "alias": "Wemo",
   "type": "module",
-  "version": "7.6.0",
+  "version": "7.7.1-beta.0",
   "description": "Homebridge plugin to integrate Wemo devices into HomeKit.",
   "author": {
     "name": "bwp91",
@@ -49,22 +49,27 @@
   "main": "lib/index.js",
   "engines": {
     "homebridge": "^1.6.0 || ^2.0.0",
-    "node": "^22.12.0 || ^24.0.0"
+    "node": "^22.12.0 || ^24.0.0 || ^26.0.0"
   },
   "scripts": {
     "lint": "eslint . --max-warnings=0",
-    "lint:fix": "npm run lint -- --fix"
+    "lint:fix": "npm run lint -- --fix",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "test-coverage": "npm run test -- --coverage",
+    "changelog:sync": "node .github/scripts/sync-changelog.mjs"
   },
   "dependencies": {
     "@homebridge/plugin-ui-utils": "^2.2.5",
     "axios": "^1.18.1",
-    "ip": "^2.0.1",
     "node-ssdp": "^4.0.1",
     "p-queue": "^9.3.3",
     "xml2js": "^0.6.2",
     "xmlbuilder": "^15.1.1"
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^9.2.0"
+    "@antfu/eslint-config": "^9.2.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "vitest": "^4.1.10"
   }
 }