stemdeckapp/stemdeck

v0.7.0-alpha.8 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Dashboards & Home Pages

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Affected surfaces

deps

ReleasePort's take

Light signal

editorial:auto 1mo

macOS now verifies FFmpeg download integrity before execution.

Why it matters: Enhances security by ensuring downloaded FFmpeg files are untampered prior to running, reducing risk of malicious code injection on macOS systems.

Summary

AI summary

macOS now verifies FFmpeg integrity, and the Installing, Artifact build, and Artifact scan modules received updates.

Changes in this release

Type	Severity	Summary	CVE
Security	High	macOS now verifies FFmpeg download integrity before execution. macOS now verifies FFmpeg download integrity before execution. Source: llm_adapter@2026-06-05 Confidence: high	—

Full changelog

> [!IMPORTANT]

macOS first launch (no code signing yet). After dragging StemDeck to Applications, clear the Gatekeeper quarantine flag or macOS will say the app is damaged:
xattr -dr com.apple.quarantine /Applications/StemDeck.app
Optional: fresh-install cleanup. To reproduce a true first-run with no leftover state from earlier builds, open each path in Finder via the Go menu, then Go to Folder (Shift+Cmd+G), and move the folders to Trash:

~/Library/Application Support/StemDeck

~/Library/WebKit/app.stemdeck.desktop

~/Library/Caches/stemdeck

~/Library/Caches/app.stemdeck.desktop

You can also delete ~/Library/Preferences/app.stemdeck.desktop.plist the same way. This is optional; the app will work without it.

What's new in 0.7.0 Alpha 8

Security

macOS now verifies the FFmpeg download before running it. Setup downloads FFmpeg and ffprobe on macOS; previously they were extracted and executed with no integrity check, so a corrupt or tampered download could have been run during setup. The macOS path now checks a pinned SHA256 before the binaries are extracted or executed, and aborts with a clear error on a mismatch, matching the verification the Windows path already did. (#172)

Installing

macOS: drop the .app into Applications and launch (run the xattr command above first).
Windows: unzip the downloaded .zip, then run StemDeck.exe from the extracted folder.

Artifact build

macOS arm64 and x64 DMGs and runtime packs were built and inspected on a macOS Woodpecker agent before upload.

Artifact scan

Windows portable packages were scanned with ClamAV in CI before upload.

Security Fixes

macOS now verifies FFmpeg download integrity using a pinned SHA256, aborting on mismatch (#172)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track stemdeckapp/stemdeck

Get notified when new releases ship.

About stemdeckapp/stemdeck

All releases →

Related context

Related tools

Earlier breaking changes

v0.6.0-alpha.1 Moves library and stems storage from `~/Library/Application Support/` to `~/Documents/StemDeck/`.