A modern Music Player Daemon based on Rockbox firmware

v2026.06.08 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo Media Servers

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

airplay audio flatpak graphql grpc libadwaita

+14 more

macosx mpd mpris music-player music-streaming navidrome rockbox rust self-hosted snapcast tokio typescript typesense zig

Summary

AI summary

Fixed GraphQL playback commands for CMAF sink and prevented MPD playlist resume panic.

Type	Severity	Summary	CVE
Bugfix	Medium	Fixes no‑op behavior for play* RPCs when active output is CMAF sink. Fixes no‑op behavior for play* RPCs when active output is CMAF sink. Source: llm_adapter@2026-06-08 Confidence: high	—
Bugfix	Medium	Prevents panic in MPD `restore_playlist` by bounds‑checking `resume_index`. Prevents panic in MPD `restore_playlist` by bounds‑checking `resume_index`. Source: llm_adapter@2026-06-08 Confidence: high	—

Full changelog

GraphQL playAlbum / playArtistTracks / playGenreTracks / playDirectory / playTrack / playLikedTracks / playAllTracks were no-ops when the active output was the CMAF (HLS / DASH) sink — the check_and_load_player! macro used a host != "" && port != 0 heuristic to detect external cast players, but CMAF advertises host="localhost", port=7882 for its own HTTP server, so the macro misrouted the request to /player/load (which 404s because state.player is only populated for Chromecast) and returned Ok(0) before building the playlist; now matches the RPC variant and gates on is_cast_device instead, so local PCM sinks (CMAF, FIFO, builtin, squeezelite, AirPlay, UPnP) fall through to the regular playlist-build path
MPD restore_playlist: bounds-check the persisted resume_index against the current playlist length before indexing — a stale resume index from a prior session with a longer queue was panicking the MPD thread with index out of bounds: the len is 15 but the index is 91 and aborting the daemon

Full Changelog: https://github.com/tsirysndr/rockbox-zig/compare/2026.06.07...2026.06.08

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track A modern Music Player Daemon based on Rockbox firmware

Get notified when new releases ship.

About A modern Music Player Daemon based on Rockbox firmware