homebridge-xbox-tv 4.2.0 → 4.2.2

package/CHANGELOG.md

@@ -18,6 +18,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - For plugin < v4.1.0 use Homebridge UI <= v5.5.0
 - For plugin >= v4.1.0 use Homebridge UI >= v5.13.0
 
+## [4.2.2] - (24.09.2026)
+
+### Changes
+
+- fix: with 85 inputs (the HomeKit limit) the input list from the console no longer updated existing inputs, the limit skipped every input instead of only new ones, so names of existing inputs were never refreshed. The limit now applies to new inputs only
+
+## [4.2.1] - (24.09.2026)
+
+### Changes
+
+- added: RESTFul request rate limit, 600 requests per minute per client and at most 1000 clients per minute, answered with `429` and `Retry-After`, one log warning per client and minute.
+
 ## [4.2.0] - (23.09.2026)
 
 ### Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "Xbox TV",
   "name": "homebridge-xbox-tv",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Homebridge plugin to control Xbox game consoles.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/hadiscovery.js

@@ -20,12 +20,14 @@ class HaDiscovery {
         this.configTopic = `${mqtt.haPrefix}/media_player/${this.objectId}/config`;
         this.stateTopic = `${mqtt.config.prefix}/HA State`;
         this.commandTopic = `${mqtt.config.prefix}/Set`;
+        this.imageTopic = config.image ? `${mqtt.config.prefix}/HA Image` : null;
 
         this.sources = [];
         this.soundModes = [];
         this.state = {};
         this.lastConfig = '';
         this.lastState = '';
+        this.lastImageKey = undefined;
     }
 
     // Publish (or republish when changed) the retained discovery message
@@ -45,6 +47,7 @@ class HaDiscovery {
             state_topic: this.stateTopic,
             command_topic: this.commandTopic,
             availability_topic: this.mqtt.availabilityTopic,
+            ...(this.imageTopic ? { image_topic: this.imageTopic } : {}),
             device,
             commands: this.commands,
             sources: this.sources,
@@ -58,6 +61,28 @@ class HaDiscovery {
         return true;
     }
 
+    // Publish the image of the current source (app icon, channel picon) once per source.
+    // key identifies the image, fetchImage returns a Buffer or null, null clears the image
+    async updateImage(key, fetchImage) {
+        if (!this.imageTopic || key === this.lastImageKey) return false;
+        this.lastImageKey = key;
+
+        let image = null;
+        try {
+            image = key ? await fetchImage() : null;
+        } catch {
+            // Network or device error, allow a retry on the next state update
+            image = null;
+            if (key === this.lastImageKey) this.lastImageKey = undefined;
+            return false;
+        }
+
+        // The source changed again while fetching, a newer call publishes its own image
+        if (key !== this.lastImageKey) return false;
+        await this.mqtt.publishRetained(this.imageTopic, image ?? '');
+        return true;
+    }
+
     // Merge a partial state and publish it retained when something changed
     async updateState(partial) {
         for (const [key, value] of Object.entries(partial)) {

package/src/mqtt.js

@@ -116,7 +116,7 @@ class Mqtt extends EventEmitter {
                     if (this.config.logWarn) this.emit('warn', `MQTT Publish error: ${error.message}`);
                     return reject(error);
                 }
-                if (this.config.logDebug) this.emit('debug', `MQTT Publish retained Topic: ${fullTopic}, Payload: ${payload}`);
+                if (this.config.logDebug) this.emit('debug', `MQTT Publish retained Topic: ${fullTopic}, Payload: ${typeof payload === 'string' ? payload : `${payload.length} bytes`}`);
                 resolve();
             });
         });

package/src/restful.js

@@ -28,6 +28,49 @@ class RestFul extends EventEmitter {
         try {
             const app = express();
             app.set('json spaces', 2);
+
+            // Request rate limit per client, protects Homebridge from request floods (CWE-770)
+            const rateLimitWindow = 60 * 1000;
+            const rateLimitMax = 600;
+            const rateLimitClients = 1000;
+            const clients = new Map();
+            let clientsLimitWarned = 0;
+            app.use((req, res, next) => {
+                const now = Date.now();
+
+                // Drop expired windows so the map cannot grow without limit
+                if (clients.size > 100) {
+                    for (const [ip, client] of clients) {
+                        if (now - client.start >= rateLimitWindow) clients.delete(ip);
+                    }
+                }
+
+                let client = clients.get(req.ip);
+                if (!client || now - client.start >= rateLimitWindow) {
+                    // Hard limit of tracked addresses, new addresses wait until older windows expire
+                    if (!client && clients.size >= rateLimitClients) {
+                        if (now - clientsLimitWarned >= rateLimitWindow) {
+                            clientsLimitWarned = now;
+                            if (this.logWarn) this.emit('warn', `RESTFul too many clients (${rateLimitClients}) in one minute, new clients are rejected until the window ends`);
+                        }
+                        res.set('Retry-After', String(Math.ceil(rateLimitWindow / 1000)));
+                        return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                    }
+                    client = { count: 0, start: now, warned: false };
+                    clients.set(req.ip, client);
+                }
+
+                if (++client.count > rateLimitMax) {
+                    // Warn once per client and window, a flood must not flood the log too
+                    if (!client.warned && this.logWarn) this.emit('warn', `RESTFul rate limit ${rateLimitMax} requests per minute exceeded by: ${req.ip}, further requests are rejected until the window ends`);
+                    client.warned = true;
+                    res.set('Retry-After', String(Math.ceil((client.start + rateLimitWindow - now) / 1000)));
+                    return res.status(429).json({ error: 'RESTFul Too Many Requests' });
+                }
+
+                next();
+            });
+
             app.use(json());
 
             // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"

package/src/xboxdevice.js

@@ -227,8 +227,6 @@ class XboxDevice extends EventEmitter {
             let updated = false;
 
             for (const input of inputs) {
-                if (this.inputsServices.length >= 85 && !remove) continue;
-
                 // Filter
                 const contentType = input.contentType;
                 const filterGames = this.filterGames && contentType === 'Game';
@@ -268,6 +266,9 @@ class XboxDevice extends EventEmitter {
                         updated = true;
                     }
                 } else {
+                    // HomeKit allows at most 85 inputs, the limit applies to new inputs only, existing ones are still updated
+                    if (this.inputsServices.length >= 85) continue;
+
                     const identifier = this.inputsServices.length + 1;
                     inputService = this.accessory.addService(Service.InputSource, sanitizedName, `Input ${inputReference}`);
                     inputService.identifier = identifier;