homebridge-denon-tv 6.2.0 → 6.2.2

package/CHANGELOG.md

@@ -21,6 +21,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - For plugin < v6.1.0 use Homebridge UI <= v5.5.0
 - For plugin >= v6.1.0 use Homebridge UI >= v5.13.0
 
+## [6.2.2] - (24.09.2026)
+
+### Changes
+
+- added: RESTFul request rate limit, 600 requests per minute per client and at most 1000 clients per minute, answered with `429` and `Retry-After`, one log warning per client and minute.
+
+## [6.2.1] - (23.09.2026)
+
+### Changes
+
+- fix: MQTT `Enable` was shown in the config UI for the Surrounds and Pass Through Inputs zones, which do not support MQTT
+- fix: RESTFul server and MQTT client are no longer started for the Surrounds and Pass Through Inputs zones when enabled in an old config
+
 ## [6.2.0] - (23.09.2026)
 
 ### Changes

package/README.md

@@ -42,7 +42,7 @@
   * Surrounds/Pass Trough Inputs control as a [extra accessory tile](https://github.com/grzegorz914/homebridge-denon-tv?tab=readme-ov-file#extra-accessory-tile).
 * Siri, some times need to create buttons/switches/sensors.
 * Automations, some times need to create buttons/switches/sensors.
-* External integrations, [RESTFul](https://github.com/grzegorz914/homebridge-denon-tv?tab=readme-ov-file#restful-integration), [MQTT](https://github.com/grzegorz914/homebridge-denon-tv?tab=readme-ov-file#mqtt-integration).
+* External integrations, [RESTFul](https://github.com/grzegorz914/homebridge-denon-tv?tab=readme-ov-file#restful-integration), [MQTT](https://github.com/grzegorz914/homebridge-denon-tv?tab=readme-ov-file#mqtt-integration), [HA Discovery](https://github.com/grzegorz914/homeassistant-mqtt-media-player).
 
 <p align="center">
   <a href="https://github.com/grzegorz914/homebridge-denon-tv"><img src="https://raw.githubusercontent.com/grzegorz914/homebridge-denon-tv/main/graphics/homekit.png" width="382"></a>
@@ -168,6 +168,10 @@
 
 * Only for Main Zone, Zone 2, Zone 3
 * Subscribe data as a JSON Object `{Power: true}`
+* HA Discovery - if enabled, the device is published to Home Assistant as one media player (class `receiver`) with power, volume, mute, source selection and more. Main Zone, Zone 2 and Zone 3 are published as separate media players. Requires the [MQTT Universal Media Player](https://github.com/grzegorz914/homeassistant-mqtt-media-player) integration. Additional retained topics:
+  * `homeassistant/media_player/<id>/config` - discovery message.
+  * `HA State` - `{"power": true, "volume": 49, "muted": false, "source": "SITV", "sound_mode": "MOVIE"}`.
+  * `Availability` - `online`, `offline` (last will).
 
 | Method | Topic | Message | Type |
 | --- | --- | --- | --- |

package/config.schema.json

@@ -7007,7 +7007,10 @@
                   "title": "Enable",
                   "type": "boolean",
                   "default": false,
-                  "description": "This enable MQTT client."
+                  "description": "This enable MQTT client.",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].zoneControl <= 2;"
+                  }
                 },
                 "host": {
                   "title": "IP/Hostname",

package/index.js

@@ -182,7 +182,10 @@ class DenonPlatform {
 		const state = zoneStates.get(zone);
 		const manufacturer = denonInfo?.info?.manufacturer || 'denon';
 
-		if (!state.restFul1 && zone.restFul?.enable) {
+		// RESTFul and MQTT are used only by Main Zone, Zone 2 and Zone 3
+		const externalIntegrations = zone.zoneControl <= 2;
+
+		if (!state.restFul1 && externalIntegrations && zone.restFul?.enable) {
 			try {
 				await new Promise((resolve) => {
 					const timer = setTimeout(resolve, 5000);
@@ -214,7 +217,7 @@ class DenonPlatform {
 			}
 		}
 
-		if (!state.mqtt1 && zone.mqtt?.enable) {
+		if (!state.mqtt1 && externalIntegrations && zone.mqtt?.enable) {
 			try {
 				await new Promise((resolve) => {
 					const timer = setTimeout(resolve, 10000);

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "Denon TV",
   "name": "homebridge-denon-tv",
-  "version": "6.2.0",
+  "version": "6.2.2",
   "description": "Homebridge plugin to control Denon/Marantz AV Receivers.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/restful.js

@@ -26,6 +26,49 @@ class RestFul extends EventEmitter {
         try {
             const app = express();
             app.set('json spaces', 2);
+
+            // Request rate limit per client, protects Homebridge from request floods (CWE-770)
+            const rateLimitWindow = 60 * 1000;
+            const rateLimitMax = 600;
+            const rateLimitClients = 1000;
+            const clients = new Map();
+            let clientsLimitWarned = 0;
+            app.use((req, res, next) => {
+                const now = Date.now();
+
+                // Drop expired windows so the map cannot grow without limit
+                if (clients.size > 100) {
+                    for (const [ip, client] of clients) {
+                        if (now - client.start >= rateLimitWindow) clients.delete(ip);
+                    }
+                }
+
+                let client = clients.get(req.ip);
+                if (!client || now - client.start >= rateLimitWindow) {
+                    // Hard limit of tracked addresses, new addresses wait until older windows expire
+                    if (!client && clients.size >= rateLimitClients) {
+                        if (now - clientsLimitWarned >= rateLimitWindow) {
+                            clientsLimitWarned = now;
+                            if (this.logWarn) this.emit('warn', `RESTFul too many clients (${rateLimitClients}) in one minute, new clients are rejected until the window ends`);
+                        }
+                        res.set('Retry-After', String(Math.ceil(rateLimitWindow / 1000)));
+                        return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                    }
+                    client = { count: 0, start: now, warned: false };
+                    clients.set(req.ip, client);
+                }
+
+                if (++client.count > rateLimitMax) {
+                    // Warn once per client and window, a flood must not flood the log too
+                    if (!client.warned && this.logWarn) this.emit('warn', `RESTFul rate limit ${rateLimitMax} requests per minute exceeded by: ${req.ip}, further requests are rejected until the window ends`);
+                    client.warned = true;
+                    res.set('Retry-After', String(Math.ceil((client.start + rateLimitWindow - now) / 1000)));
+                    return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                }
+
+                next();
+            });
+
             app.use(json());
 
             // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"