homebridge-denon-tv 6.2.1 → 6.2.3

package/CHANGELOG.md

@@ -21,6 +21,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - For plugin < v6.1.0 use Homebridge UI <= v5.5.0
 - For plugin >= v6.1.0 use Homebridge UI >= v5.13.0
 
+## [6.2.3] - (24.09.2026)
+
+### Changes
+
+- changed: HA Discovery, sound modes are shown with readable names (e.g. `Pure Direct`, `DTS Surround` instead of `PURE DIRECT`, `DTS SURROUND`). Commands are unchanged
+
+## [6.2.2] - (24.09.2026)
+
+### Changes
+
+- added: RESTFul request rate limit, 600 requests per minute per client and at most 1000 clients per minute, answered with `429` and `Retry-After`, one log warning per client and minute.
+
 ## [6.2.1] - (23.09.2026)
 
 ### Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "Denon TV",
   "name": "homebridge-denon-tv",
-  "version": "6.2.1",
+  "version": "6.2.3",
   "description": "Homebridge plugin to control Denon/Marantz AV Receivers.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/constants.js

@@ -661,3 +661,32 @@ export const ZonePrefixMap = {
     3: 'MS',
     4: 'SI'
 };
+
+// Display names for the normalized sound modes (Home Assistant)
+export const SoundModeDisplayName = {
+    "AUTO": "Auto",
+    "MOVIE": "Movie",
+    "MUSIC": "Music",
+    "GAME": "Game",
+    "DIRECT": "Direct",
+    "PURE DIRECT": "Pure Direct",
+    "STEREO": "Stereo",
+    "MCH STEREO": "Multi Ch Stereo",
+    "DOLBY DIGITAL": "Dolby Digital",
+    "DTS SURROUND": "DTS Surround",
+    "AURO3D": "Auro-3D",
+    "AURO2DSURR": "Auro-2D Surround",
+    "WIDE SCREEN": "Wide Screen",
+    "SUPER STADIUM": "Super Stadium",
+    "ROCK ARENA": "Rock Arena",
+    "JAZZ CLUB": "Jazz Club",
+    "CLASSIC CONCERT": "Classic Concert",
+    "MONO MOVIE": "Mono Movie",
+    "MATRIX": "Matrix",
+    "VIDEO GAME": "Video Game",
+    "VIRTUAL": "Virtual",
+    "NEURAL": "Neural",
+    "STANDARD": "Standard",
+    "LEFT": "Left",
+    "RIGHT": "Right"
+};

package/src/mainzone.js

@@ -2,7 +2,7 @@ import EventEmitter from 'events';
 import Zone from './zone.js';
 import Functions from './functions.js';
 import HaDiscovery from './hadiscovery.js';
-import { PictureModesConversionToHomeKit, PictureModesDenonNumber, PictureModesDenonString, DirectSoundMode, SoundModeConversion } from './constants.js';
+import { PictureModesConversionToHomeKit, PictureModesDenonNumber, PictureModesDenonString, DirectSoundMode, SoundModeConversion, SoundModeDisplayName } from './constants.js';
 let Accessory, Characteristic, Service, Categories, Encode, AccessoryUUID;
 
 class MainZone extends EventEmitter {
@@ -1004,7 +1004,7 @@ class MainZone extends EventEmitter {
 
         try {
             const sources = (this.inputsServices ?? []).map(input => ({ id: `${input.zonePrefix}${input.reference}`, name: input.name }));
-            const soundModes = this.ha.commands.sound_mode ? [...new Set(Object.values(SoundModeConversion))].map(mode => ({ id: mode, name: mode })) : [];
+            const soundModes = this.ha.commands.sound_mode ? [...new Set(Object.values(SoundModeConversion))].map(mode => ({ id: mode, name: SoundModeDisplayName[mode] ?? mode })) : [];
             await this.ha.publishConfig({ sources, soundModes });
             await this.haUpdateState();
         } catch (error) {

package/src/restful.js

@@ -26,6 +26,49 @@ class RestFul extends EventEmitter {
         try {
             const app = express();
             app.set('json spaces', 2);
+
+            // Request rate limit per client, protects Homebridge from request floods (CWE-770)
+            const rateLimitWindow = 60 * 1000;
+            const rateLimitMax = 600;
+            const rateLimitClients = 1000;
+            const clients = new Map();
+            let clientsLimitWarned = 0;
+            app.use((req, res, next) => {
+                const now = Date.now();
+
+                // Drop expired windows so the map cannot grow without limit
+                if (clients.size > 100) {
+                    for (const [ip, client] of clients) {
+                        if (now - client.start >= rateLimitWindow) clients.delete(ip);
+                    }
+                }
+
+                let client = clients.get(req.ip);
+                if (!client || now - client.start >= rateLimitWindow) {
+                    // Hard limit of tracked addresses, new addresses wait until older windows expire
+                    if (!client && clients.size >= rateLimitClients) {
+                        if (now - clientsLimitWarned >= rateLimitWindow) {
+                            clientsLimitWarned = now;
+                            if (this.logWarn) this.emit('warn', `RESTFul too many clients (${rateLimitClients}) in one minute, new clients are rejected until the window ends`);
+                        }
+                        res.set('Retry-After', String(Math.ceil(rateLimitWindow / 1000)));
+                        return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                    }
+                    client = { count: 0, start: now, warned: false };
+                    clients.set(req.ip, client);
+                }
+
+                if (++client.count > rateLimitMax) {
+                    // Warn once per client and window, a flood must not flood the log too
+                    if (!client.warned && this.logWarn) this.emit('warn', `RESTFul rate limit ${rateLimitMax} requests per minute exceeded by: ${req.ip}, further requests are rejected until the window ends`);
+                    client.warned = true;
+                    res.set('Retry-After', String(Math.ceil((client.start + rateLimitWindow - now) / 1000)));
+                    return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                }
+
+                next();
+            });
+
             app.use(json());
 
             // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"

package/src/zone2.js

@@ -2,7 +2,7 @@ import EventEmitter from 'events';
 import Zone from './zone.js';
 import Functions from './functions.js';
 import HaDiscovery from './hadiscovery.js';
-import { PictureModesConversionToHomeKit, PictureModesDenonNumber, SoundModeConversion } from './constants.js';
+import { PictureModesConversionToHomeKit, PictureModesDenonNumber, SoundModeConversion, SoundModeDisplayName } from './constants.js';
 let Accessory, Characteristic, Service, Categories, Encode, AccessoryUUID;
 
 class Zone2 extends EventEmitter {
@@ -918,7 +918,7 @@ class Zone2 extends EventEmitter {
 
         try {
             const sources = (this.inputsServices ?? []).map(input => ({ id: `${input.zonePrefix}${input.reference}`, name: input.name }));
-            const soundModes = this.ha.commands.sound_mode ? [...new Set(Object.values(SoundModeConversion))].map(mode => ({ id: mode, name: mode })) : [];
+            const soundModes = this.ha.commands.sound_mode ? [...new Set(Object.values(SoundModeConversion))].map(mode => ({ id: mode, name: SoundModeDisplayName[mode] ?? mode })) : [];
             await this.ha.publishConfig({ sources, soundModes });
             await this.haUpdateState();
         } catch (error) {

package/src/zone3.js

@@ -2,7 +2,7 @@ import EventEmitter from 'events';
 import Zone from './zone.js';
 import Functions from './functions.js';
 import HaDiscovery from './hadiscovery.js';
-import { PictureModesConversionToHomeKit, PictureModesDenonNumber, SoundModeConversion } from './constants.js';
+import { PictureModesConversionToHomeKit, PictureModesDenonNumber, SoundModeConversion, SoundModeDisplayName } from './constants.js';
 let Accessory, Characteristic, Service, Categories, Encode, AccessoryUUID;
 
 class Zone3 extends EventEmitter {
@@ -918,7 +918,7 @@ class Zone3 extends EventEmitter {
 
         try {
             const sources = (this.inputsServices ?? []).map(input => ({ id: `${input.zonePrefix}${input.reference}`, name: input.name }));
-            const soundModes = this.ha.commands.sound_mode ? [...new Set(Object.values(SoundModeConversion))].map(mode => ({ id: mode, name: mode })) : [];
+            const soundModes = this.ha.commands.sound_mode ? [...new Set(Object.values(SoundModeConversion))].map(mode => ({ id: mode, name: SoundModeDisplayName[mode] ?? mode })) : [];
             await this.ha.publishConfig({ sources, soundModes });
             await this.haUpdateState();
         } catch (error) {