VLC 3.0.24 upgrades its bundled FFmpeg from 4.4 to 8.1.2, adds Flatpak build support, improves Qt 6 compatibility, and fixes numerous playback issues.

That version jump is remarkable for a point release

FFmpeg 4.4 to 8.1.2 crosses four major versions. VLC 3.0 is a long-lived stable branch, and long-lived branches usually pin their dependencies precisely because moving them is risky.

Doing it anyway means inheriting several years of work at once:

Codec support. Newer AV1 decoders, better VP9 and HEVC handling, and formats that did not exist when 4.4 was current.

Hardware acceleration. VA-API and VDPAU paths have improved substantially, which on Linux is the difference between smooth 4K playback and a hot laptop.

Security fixes. The important one. FFmpeg parses untrusted input by definition, since a media file is arbitrary data from wherever you got it. Four major versions of accumulated fixes in a parser that adversarial input reaches is a meaningful hardening.

Media parsing has historically been a productive source of exploits precisely because the formats are complex and the parsers are old. Shipping a current FFmpeg on a stable branch is worth more than any playback feature in this release.

Flatpak support

VLC has been available as a Flatpak for a while, maintained outside the project. Upstream build support means the official project can produce it, which usually translates to faster updates and fewer packaging-layer bugs.

It matters for immutable distributions, where Flatpak is how applications are installed by design rather than by preference.

Worth checking what permissions it requests, as with anything Flatpak. A media player needs read access to where your media lives and nothing else:

flatpak info --show-permissions org.videolan.VLC
flatpak override --user --nofilesystem=home --filesystem=~/Videos:ro org.videolan.VLC

Our Flatpak permissions guide covers why filesystem=home undoes most of the sandbox, and a player is one of the easiest applications to confine tightly.

Qt 6

Continued migration work. Qt 5 reached end of life, so this is maintenance rather than a feature, and the same transition is visible across the ecosystem this week with Krita’s 6.0.4 doing the same thing.

VLC’s position

It remains the application people install first on any system, and its reputation was earned by playing files nothing else would. That reputation rests on FFmpeg, which does the actual decoding for VLC and for most other players on Linux.

A VLC release is frequently, underneath, an FFmpeg release with an interface attached. This one is unusually clearly that.

flatpak update org.videolan.VLC
vlc --version