A modern Music Player Daemon based on Rockbox firmware

v2026.05.25 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 9d Media Servers

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

airplay audio flatpak graphql grpc libadwaita

+14 more

macosx mpd mpris music-player music-streaming navidrome rockbox rust self-hosted snapcast tokio typescript typesense zig

Affected surfaces

auth

Summary

AI summary

Added Subsonic / Navidrome API compatibility server on port 4533 with extensive endpoints.

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds Subsonic / Navidrome API compatibility server on port 4533 Adds Subsonic / Navidrome API compatibility server on port 4533 Source: llm_adapter@2026-05-25 Confidence: high	—
Feature	Medium	Adds MD5 token authentication mode (t + s) and plaintext/enc:<hex> mode (p) Adds MD5 token authentication mode (t + s) and plaintext/enc:<hex> mode (p) Source: granite4.1:30b@2026-05-25-audit Confidence: low	—
Feature	Low	Implements numerous Subsonic/Navidrome API endpoints for browsing and streaming music Implements numerous Subsonic/Navidrome API endpoints for browsing and streaming music Source: granite4.1:30b@2026-05-25-audit Confidence: low	—
Feature	Low	`getCoverArt` resolves bare filenames to ~/.config/rockbox.org/covers/ and proxies Rocksky HTTP URLs for artist images `getCoverArt` resolves bare filenames to ~/.config/rockbox.org/covers/ and proxies Rocksky HTTP URLs for artist images Source: granite4.1:30b@2026-05-25-audit Confidence: low	—

Full changelog

Subsonic / Navidrome API compatibility server on port 4533 — any client that works with Navidrome (Cassette, Symfonium, DSub, Ultrasonic, Substreamer, Clementine, Sublime Music, …) can browse and stream music from rockboxd without additional setup; enabled by adding subsonic_username and subsonic_password to settings.toml
Implemented endpoints: ping, getUser, getMusicFolders, getScanStatus, startScan, getArtists, getArtist, getAlbum, getSong, getIndexes, getMusicDirectory, getGenres, getSongsByGenre, getAlbumList / getAlbumList2, getRandomSongs, getStarred / getStarred2, stream (with HTTP Range / seek support), download, getCoverArt, scrobble, getNowPlaying, updateNowPlaying, search2 / search3, getPlaylists, getPlaylist, createPlaylist, updatePlaylist, deletePlaylist, star / unstar (mirrored to Rocksky), getArtistInfo / getArtistInfo2, getAlbumInfo / getAlbumInfo2, getSimilarSongs / getSimilarSongs2, getTopSongs, getLyrics
Auth: MD5 token mode (t + s) and plaintext / enc:<hex> mode (p)
getCoverArt resolves bare filenames to ~/.config/rockbox.org/covers/ and proxies Rocksky HTTP URLs for artist images
Mintlify docs page mintlify/clients/subsonic.mdx covering setup, auth modes, all endpoints, recommended clients, cover art IDs, and range-request support

Full Changelog: https://github.com/tsirysndr/rockbox-zig/compare/2026.05.17...2026.05.25

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track A modern Music Player Daemon based on Rockbox firmware

Get notified when new releases ship.

About A modern Music Player Daemon based on Rockbox firmware