This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Affected surfaces
ReleasePort's take
Moderate signalReleasePort Layer 1 v1.3.2 fixes corrupted Windows paths in the bridge JSON decoder and adds explicit overwrite handling for render_project.
Why it matters: The update resolves path corruption on Windows (affects all string arguments) and introduces a mandatory `overwrite` flag for `render_project`, requiring code changes to avoid silent failures.
Summary
AI summaryFixed JSON decoder corrupting Windows paths affecting all bridge string arguments.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
`render_project` now requires an explicit `overwrite` parameter to allow file overwriting. `render_project` now requires an explicit `overwrite` parameter to allow file overwriting. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
`get_fx_presets` returns preset count and current preset identifier. `get_fx_presets` returns preset count and current preset identifier. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Medium |
`save_fx_preset` and `render_region` now return clear documented errors instead of failing silently. `save_fx_preset` and `render_region` now return clear documented errors instead of failing silently. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | High |
Fixes corrupted Windows paths in bridge JSON decoder. Fixes corrupted Windows paths in bridge JSON decoder. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes silent failures for several API calls that invoked nonexistent or pointer‑requiring APIs. Fixes silent failures for several API calls that invoked nonexistent or pointer‑requiring APIs. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Updates bridge script to new `reaper_mcp_bridge.lua` version. Updates bridge script to new `reaper_mcp_bridge.lua` version. Source: llm_adapter@2026-06-12 Confidence: high |
— |
Full changelog
Important fix release — recommended for all Windows users. A systematic audit of every tool's bridge call path. 158 tools, all live-verified against REAPER 7.74.
Headline fix: bridge JSON decoder corrupted Windows paths
Escape sequences were unescaped with sequential replacements and no \\ handling, so any path segment starting with r, n, t, b, or f after a backslash was silently mangled (e.g. ...\Temp\reaper.wav rendered to ...\Temp\_eaper.wav). This affected every string argument crossing the bridge on Windows — including import_audio, open_project, and render_project paths — since the project's first release. Now a proper single-pass decoder.
Fixed (were silently broken — calling nonexistent APIs or pointer-requiring APIs through the generic fallback)
- MIDI:
delete_midi_note,clear_midi_item,get_midi_item - Item editing:
split_item(returns the new item index),duplicate_item - Envelopes:
add_envelope_point,get_envelope_point_count,get_envelope_points,delete_envelope_point,clear_envelope,arm_track_envelope - Project:
get_undo_state,set_time_signature,render_project(dialog-free rendering with explicit bounds/format)
Changed
render_projectgains an explicitoverwriteparameter: an existing target file returns a clean error unlessoverwrite=True. REAPER's behavior on existing files (prompt vs auto-increment) is a user preference, and its overwrite prompt blocks unattended rendering.get_fx_presetsreturns the preset count + current preset (REAPER's API cannot enumerate preset names — noted in the response).save_fx_presetandrender_regionnow return clear documented errors instead of failing silently: REAPER has no API to save named FX presets (workaround suggested), and region rendering is deferred to the v1.9 render suite (workaround:render_projectwith explicit bounds).
Note: update your installed bridge — copy the new reaper_mcp_bridge.lua over the old one and restart the script in REAPER.
Full changelog: https://github.com/TwelveTake-Studios/reaper-mcp/blob/main/CHANGELOG.md
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About TwelveTake-Studios/reaper-mcp
MCP server enabling AI assistants to control REAPER DAW for mixing, mastering, MIDI composition, and full music production with 129 tools
Related context
Beta — feedback welcome: [email protected]