Firmware release notes 5.0.x

This article is a stub. Main article: Firmware release notes 5.x.

Release 5.0.0

Release name: "Zinalrothorn" 5.0.0. Release date: October 22^nd, 2026.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party DSOS players.
Firmware version number: 5.0.0-1.0.0-ae51358f

The SNMP MIB sysDescr value now includes the DSOS version in addition to the device brand and model, for instance "SpinetiX HMP400, DSOS 5.0.0-1.0.0-ae51358f". Existing SNMP monitoring systems can extract the software version from sysDescr.
Added a SpinetiX SNMP MIB that exposes DSOS-specific information in a structured format, including the DSOS version, device serial number, operating mode (Normal or Safe), boot counter value, and other device information.
Added minicoredumper support to collect mini crash dumps containing stack traces when software crashes occur. These crash dumps are included in extended reports. As crash dumps may contain sensitive information, Control Center now provides an option to clear stored crash dumps and displays a notice that extended reports may contain sensitive information.

Improved network connectivity on devices with multiple network interfaces by automatically disabling routes that use disconnected network links.
Improved the maintainability of the player firmware update mechanism by replacing the neon library with the curl library, which is more actively maintained.
Reduced the DSOS image size by removing unused packages.
The Recovery Console is updated to version 2.32.0.

Enabled audio by default for the player-level overlay, as well as ARYA alerts, using the same audio settings as regular content.
Fixed a regression introduced in DSOS 4.10.0 that prevented players running version 4.10.0 from being added to Cockpit.
Fixed an issue in Control Center, under Saved Passwords, where re-applying credentials could incorrectly display a "Password not valid" error, preventing credential updates.
Fixed an issue where publishing multiscreen projects with a canvas wider than 16384 pixels could cause the iBX440 to crash and enter Safe mode. Since the hardware does not support canvas widths greater than 16384 pixels, the player now crops the canvas to the maximum supported width and logs an error message in player.log.

Applies to all DSOS players, except for HMP350, HMP300, and DiVA.

Fixed an issue that could cause players to crash when Web Page layers accessed password-protected web pages requiring HTTP Basic or Digest authentication.

Updated the following base libraries and components, fixing several security vulnerabilities:

curl: fixed CVE-2026-82209, CVE-2026-80230, CVE-2026-18924, CVE-2026-11856, CVE-2026-8932, CVE-2026-8924, CVE-2026-8458, CVE-2026-7168, CVE-2026-6276, CVE-2026-4873, which may have affected DSOS and CVE-2026-8925, CVE-2026-9547, CVE-2026-5773, CVE-2026-5545, CVE-2026-8286, CVE-2026-8927, CVE-2026-6429, CVE-2026-6253, which did not affect DSOS.
php: fixed CVE-2026-109618 and CVE-2026-109619, which affected DSOS.

Improved compatibility with web services by allowing customization of HTTP request headers, including the User-Agent header. This enables access to services that require specific client identification.