media-sound/qmpdclient depends on dev-qt/qtwebkit:4 which is ancient and will never see any security updates. If it's not possible to disable it and there's no upstream port available it might be time to remove this package.
Turns out this was a bogus dependency. Fixed in git commit 06dfc67c005ed305d7f572ad940da3a75167c3eb