Releases: rommapp/romm
v4.1.0-beta.1
Caution
As of this version, a valid config.yml file is required to run the app, and must be mounted before upgrading to 4.1.0. Please refer to the instructions at the top of this example config.yml file. The file can be used as-is without making any changes.
Warning
Some platform slugs have been updated to fix common setup issues and remove duplicates. If you use any of the following platforms, the system will migrate to the new slugs will happen automatically, and update your config.yml file accordingly. No manual intervention is required.
cpc, apple-i, apple2, apple2gs, apple3, mattel-aquarius, atari-2600, atari-5200, atari-7800, atari-8-bit, bally-astrocade, bbc-micro, cd-i, cdtv, channel-f, commodore-16-plus4, dragon-3264, dreamcast, edsac--1, electron, elektor-tv-games-computer, fmtowns, game-com, gameboy, gameboy-color, gameboy-advance, game-gear, gamecube, genesis-slash-megadrive, macintosh, microcomputer--1, microvision--1, neo-geo, odyssey--1, nintendo-ds, palmos, pc88, pc98, pet, pdp-7--1, pdp-8--1, playstation, ps, ps4--1, playstation-4, playstation-5, ps-vita, sega-32x, sega-cd, sega-cd-32x, sega-master-system, sega-saturn, sharp-x1, sinclair-zx81, sg-1000, switch2, thomson-mo, trs-80-coco, turbografx-16-slash-pc-engine-cd, turbo-grafx, turbografx16--1, watara-slash-quickshot-supervision, windows, zx-spectrum
New Features
Missing games admin page
There's a new tag under the Library Management section of the admin panel that displays all ROMs present in the database but missing from the file system. You can choose to delete single games, groups of games using multi-select, or simply purge (cleanup) all missing games from the database with a single click.
Smart collections
Create smart, self-updating collections for a selection of search terms and filters! On the search page, change the search term and/or filters, and a new button will appear in the top bar. The dialog will display which filters will be set and allow you to give this smart collection a name and description.
Note: the list of games will only update when you view the contents of the collection
Minor Changes
- Unify platform slugs by @gantoine in #2143
- Display an icon on the card if game has notes by @gantoine in #2226
- [ROMM-2142] Custom SGDB title match by @gantoine in #2220
- Use best-match algo for more providers by @gantoine in #2231
- Add zh_TW translation. by @wctang in #2188 and #2194
- Adding Polish translation files. by @gutmanovaty in #2173
- Scroll to window bottom on scan by @gantoine in #2255
- Add OpenTelemetry integration for API service by @adamantike in #2251
- Add OpenTelemetry integration to file watcher by @adamantike in #2252
Note
The API responses for the following endpoints have changed. Please refer to the swagger docs under /api/docs for the updated response types.
/api/firmware/delete, /api/rom/delete, /api/tasks/{task_id}, /api/tasks/run and /api/tests/run/{task_name}
Bug Fixes
- [ROMM-2202] Fix rom ID selected refresh metadata by @gantoine in #2204
- Docker build and init fixes by @adamantike in #2238
- Make RetroAchievements hash matching case-insensitive by @adamantike in #2240
- Correctly set up dockerignore file by @adamantike in #2237
- Run scheduler when only LaunchBox update is enabled by @adamantike in #2222
- Correctly evaluate enabled metadata sources in scheduled library scan by @adamantike in #2213
- [ROMM-2186] Allow editing user without password field by @gantoine in #2193
- [ROMM-2184] Fix selecting dialog buttons on mobile by @gantoine in #2198
- [ROMM-1868] Fix grouping by metadata rows by @gantoine in #2203
- [ROMM-1949] Fix multi rom download by @gantoine in #2206
- [ROMM-2155] Fix char bar jumping to wrong game by @gantoine in #2208
- [ROMM-2075] Use platform version icon on card by @gantoine in #2207
- [ROMM-2211] Only show missing platforms on lib manage page by @gantoine in #2212
- Fire off search if URL state prepopulated by @gantoine in #2205
- Improve performance on asset screenshot retrieval by @adamantike in #2248
- Correctly upload manual to resources path by @adamantike in #2254
- Disable OpenTelemetry integration if not configured by @adamantike in #2262
- [ROMM-2163] Fix excluding single roms without extensions by @gantoine in #2256
- [ROMM-2247] Return early if cover write fails by @gantoine in #2249
- Always hash the largest file in compressed multi file roms by @gantoine in #2261
Other
- Add support for database query string using
DB_QUERY_JSONvariable by @adamantike in #2244 - Refactor task execution workers by @zurdi15 in #2178
- Add IPv6 support by @danielkoster in #2201
- Separate tests folder from backend code by @adamantike in #2234
- Move pytest.ini to backend directory by @adamantike in #2214
- Remove indirect dependency freezegun by @adamantike in #2233
- Move pytest-cov dependency to test extra by @adamantike in #2229
- Replace emoji dependency with constants by @adamantike in #2228
- Add type hints to task classes by @adamantike in #2221
- Remove uses of Props and Functions comments by @gantoine in #2187
- Replace MessageResponse with specific responses by @gantoine in #2185
- Migrate scheduler to native RQ process by @adamantike in #2224
- Migrate worker to native rq process by @gantoine in #2227
- Migrate watcher to use watchfiles library by @adamantike in #2230
- Use native 7z to extract files and calculate hashes by @gantoine in #2232
- Do not warn when REDIS_HOST is set by @adamantike in #2243
- Create startup script to run initial tasks before main application by @adamantike in #2258
- Move cache initialization to startup script by @adamantike in #2260
New Contributors
- @gutmanovaty made their first contribution in #2173
- @wctang made their first contribution in #2188
- @danielkoster made their first contribution in #2201
Full Changelog: 4.0.1...4.1.0-beta.1
Contributors
Assets 2
4.1.0-alpha.1
Caution
As of this version, a valid config.yml file is required to run the app, and must be mounted before upgrading to 4.1.0. Please refer to the instructions at the top of this example config.yml file. The file can be used as-is without making any changes.
Warning
Some platform slugs have been updated to fix common setup issues and remove duplicates. If you use any of the following platforms, the system will migrate to the new slugs will happen automatically, and update your config.yml file accordingly. No manual intervention is required.
cpc, apple-i, apple2, apple2gs, apple3, mattel-aquarius, atari-2600, atari-5200, atari-7800, atari-8-bit, bally-astrocade, bbc-micro, cd-i, cdtv, channel-f, commodore-16-plus4, dragon-3264, dreamcast, edsac--1, electron, elektor-tv-games-computer, fmtowns, game-com, gameboy, gameboy-color, gameboy-advance, game-gear, gamecube, genesis-slash-megadrive, macintosh, microcomputer--1, microvision--1, neo-geo, odyssey--1, nintendo-ds, palmos, pc88, pc98, pet, pdp-7--1, pdp-8--1, playstation, ps, ps4--1, playstation-4, playstation-5, ps-vita, sega-32x, sega-cd, sega-cd-32x, sega-master-system, sega-saturn, sharp-x1, sinclair-zx81, sg-1000, switch2, thomson-mo, trs-80-coco, turbografx-16-slash-pc-engine-cd, turbo-grafx, turbografx16--1, watara-slash-quickshot-supervision, windows, zx-spectrum
New Features
Missing games admin page
There's a new tag under the Library Management section of the admin panel that displays all ROMs present in the database but missing from the file system. You can choose to delete single games, groups of games using multi-select, or simply purge (cleanup) all missing games from the database with a single click.
Smart collections
Create smart, self-updating collections for a selection of search terms and filters! On the search page, change the search term and/or filters, and a new button will appear in the top bar. The dialog will display which filters will be set and allow you to give this smart collection a name and description.
Note: the list of games will only update when you view the contents of the collection
Minor Changes
- Unify platform slugs by @gantoine in #2143
- Display an icon on the card if game has notes by @gantoine in #2226
- [ROMM-2142] Custom SGDB title match by @gantoine in #2220
- Use best-match algo for more providers by @gantoine in #2231
- Add zh_TW translation. by @wctang in #2188 and #2194
- Adding Polish translation files. by @gutmanovaty in #2173
Note
The API responses for the following endpoints have changed. Please refer to the swagger docs under /api/docs for the updated response types.
/api/firmware/delete, /api/rom/delete, /api/tasks/{task_id}, /api/tasks/run and /api/tests/run/{task_name}
Bug Fixes
- [ROMM-2202] Fix rom ID selected refresh metadata by @gantoine in #2204
- Docker build and init fixes by @adamantike in #2238
- Make RetroAchievements hash matching case-insensitive by @adamantike in #2240
- Correctly set up dockerignore file by @adamantike in #2237
- Run scheduler when only LaunchBox update is enabled by @adamantike in #2222
- Correctly evaluate enabled metadata sources in scheduled library scan by @adamantike in #2213
- [ROMM-2186] Allow editing user without password field by @gantoine in #2193
- [ROMM-2184] Fix selecting dialog buttons on mobile by @gantoine in #2198
- [ROMM-1868] Fix grouping by metadata rows by @gantoine in #2203
- [ROMM-1949] Fix multi rom download by @gantoine in #2206
- [ROMM-2155] Fix char bar jumping to wrong game by @gantoine in #2208
- [ROMM-2075] Use platform version icon on card by @gantoine in #2207
- [ROMM-2211] Only show missing platforms on lib manage page by @gantoine in #2212
- Fire off search if URL state prepopulated by @gantoine in #2205
Other
- Refactor task execution workers by @zurdi15 in #2178
- Add IPv6 support by @danielkoster in #2201
- Separate tests folder from backend code by @adamantike in #2234
- Move pytest.ini to backend directory by @adamantike in #2214
- Remove indirect dependency freezegun by @adamantike in #2233
- Move pytest-cov dependency to test extra by @adamantike in #2229
- Replace emoji dependency with constants by @adamantike in #2228
- Add type hints to task classes by @adamantike in #2221
- Remove uses of Props and Functions comments by @gantoine in #2187
- Replace MessageResponse with specific responses by @gantoine in #2185
- Migrate scheduler to native RQ process by @adamantike in #2224
- Migrate worker to native rq process by @gantoine in #2227
- Migrate watcher to use watchfiles library by @adamantike in #2230
- Use native 7z to extract files and calculate hashes by @gantoine in #2232
New Contributors
- @gutmanovaty made their first contribution in #2173
- @wctang made their first contribution in #2188
- @danielkoster made their first contribution in #2201
Full Changelog: 4.0.1...4.1.0-alpha.1
Contributors
Assets 2
v4.0.1
Minor changes
- Added clean resources task + revamped the whole task system by @zurdi15 in #2135
- [ROMM-2118] Store last scan selected sources in storage by @gantoine in #2120
- [ROMM-1975] Add
YOUTUBE_BASE_URLfor custom youtube proxy by @gantoine in #2125 - [ROMM-1230] Add background color picker to ruffle by @gantoine in #2129
- Display version information in the banner by @zurdi15 in #2117
Fixes
- Fixed horizontal scrollable layout in details view by @zurdi15 in #2116
- Use validate_path for getting rom_files by @gantoine in #2106
- [ROMM-2109] Fix clicking on meta pills, use correct filters by @gantoine in #2121
- [ROMM-2107] Fix launchbox URL by @gantoine in #2122
- [ROMM-2114] Fix using symlinks on volumes by @gantoine in #2123
- [ROMM-2127] Add missing ssfr platform and fix IDs by @gantoine in #2152
Other changes
- Update logos by @milktoastrat in #2138
- Add new icon for platform ports by @zurdi15 in #2115
- Fix spelling error ('arwork' to 'artwork') in README by @dyingpotato890 in #2112
- Enhance grammar and consistency in README by @Gayathri-K-Binoy in #2113
- Group generated platforms by slug and filter by name by @gantoine in #2124
- Bump form-data from 4.0.1 to 4.0.4 in /frontend by @dependabot[bot] in #2133
- Service adapter tests by @gantoine in #2058, #2139
New Contributors
- @dyingpotato890 made their first contribution in #2112
- @Gayathri-K-Binoy made their first contribution in #2113
Full Changelog: 4.0.0...4.0.1
Contributors
Assets 2
v4.0.0: Hashed Edition
It's here, it's real and it's awesome: 4.0.0 is our most feature-packed release yet! 💫
We're thrilled to finally announce the long-awaited hash-based metadata matching feature, which allows you to validate your ROMs against popular DATfile databases like No-Intro, Redump and TOSEC.
Caution
This release fixes a critical authenticated arbitrary file write vulnerability (CVE-2025-54071) in all API endpoints that accept uploaded files, which can lead to remote code execution on the system. All previous versions are affected. All users should update immediately to this version, or see the mitigations in the advisory below. #2085
GHSA-fgxf-hggc-qqmq
Highlights
Hash-based metadata matching
We've partnered with two friends and members of the community, @michael-j-green and @DevYukine, to bring you a powerful new feature that allows you to match your ROMs against hash databases like No-Intro, Redump and TOSEC. They've built new public and free APIs, Hasheous and Playmatch respectively, that validate the contents of your ROM files against these databases. In the case of Hasheous, it also proxies metadata from IGDB, so you no longer need to set up IGDB credentials to fetch metadata from IGDB.
To start using Hasheous, simply set HASHEOUS_API_ENABLED=true in your environment variables, and future scans will use the Hasheous API. And for Playmatch, set PLAYMATCH_API_ENABLED=true in your environment variables. Note that you'll need to set up IGDB credentials to use Playmatch, as it does not proxy IGDB metadata like Hasheous does.
You can find popular metadata provider combinations for scans in the documentation.
LaunchBox metadata
The LaunchBox Games Database is a community-driven database that provides metadata, cover art, and screenshots. Like the LaunchBox desktop application, RomM downloads the entire database locally and matches games based on their exact filenames. This is a privacy-friendly option for users who want to import metadata without relying on online APIs, and/or already use LaunchBox to manage their game collections.
To enable LaunchBox, set LAUNCHBOX_API_ENABLED=true in your environment variables. You can enable regular updates of the database by setting ENABLE_SCHEDULED_UPDATE_LAUNCHBOX_METADATA, and set the frequency of the cron job with SCHEDULED_UPDATE_LAUNCHBOX_METADATA_CRON (defaults to 5:00 AM every day).
SteamGridDB during scans
SteamGridDB, the community-driven platform for cover art, is now available to use during scans. When selected as a source on the scan page, RomM will prioritize high-quality cover art from SteamGridDB for both matched and unmatched (no metadata found) games. Instructions for setting up SteamGridDB are available in the documentation.
Mark games with missing files as "missing"
In previous versions, RomM would delete games from the database if the file(s) were missing from the filesystem. This would lead to the loss of notes, save files and manual metadata matches. Now, these games will be marked as "missing" instead of being deleted, allowing you to restore them later if the files are added back. Use the filter bar on the search, platform and collection pages to easily find these games.
Android app
Community member and developer extraordinaire @mattsays has just released an unofficial companion app for RomM. The app allows you to browse, manage, and organize your retro gaming collection directly from your Android device, as well as download games to it. While the app is not yet available on the Google Play Store, you can download the latest APK from the GitHub repository.
DOS with EmulatorJS
Playing MS-DOS games in the browser is now possible with EmulatorJS, with a bit of setup required. As with PSP emulation, we recommend using the unofficial desktop app, which enables the required browser features without compromising your security.
Minor changes
- Add custom session max age with
SESSION_MAX_AGE_SECONDSby @zurdi15 in #1982 - Add stats summary back to the homepage as a display option by @zurdi15 in #1983
- Calculate hashes before fetching metadata by @gantoine in #1981
- Add TheGamesDB handler for platforms by @gantoine in #1994
- Use URL to store and load search params by @gantoine in #2045
- Add provider icons to scan page on match by @gantoine in #2084
- Random game button by @gantoine in #2091
- Add and update platform icons by @milktoastrat in #2000, #1980, #2007, #2021 and #2092
Fixes
- Added form rules that only allow ASCII chars on create user form by @zurdi15 in #1991
- Fix Retroachievements URL in README by @Azelphur in #1998
- Random fixes and improvements by @zurdi15 in #1999
- Use request body for user creation and update endpoints by @adamantike in #2012
- Specify English language for all Markdown blocks by @adamantike in #2029
- Add debounce to RomUser changes by @adamantike in #2028
- Set the correct forward proto when behind ssl proxy by @starkmapper in #2043
- Require threads for
dosbox_purecore by @adamantike in #2054 - Only use first file in compressed game when calculating hashes by @gantoine in #2073
- Stop overwriting IDs on partial metadata scans by @gantoine in #2077
- Improve fuzzy matching in SGDBBaseHandler for game search by @zurdi15 in #2079
- Update roms_metadata virtual table by @gantoine in #2083
- SGDB cover fallback by @zurdi15 in #2087
- Load platform icon image source to prefer SVG over ICO format by @zurdi15 in #2089
Other changes
Warning
API endpoint changes
- Remove deprecated boolean parameters from
get_romsendpoint by @adamantike in #2004 - Remove support for deprecated
GUNICORN_WORKERSvariable by @adamantike in #2003
- Provide Dockerfile for devs by @gantoine in #1960
- Remove
_requestmethod fromRAHandlerby @adamantike in #2005 - Update DEVELOPER_SETUP.md by @Konscription in #2016
- Remove unused methods from
roms_handlerby @adamantike in #2017 - Create ScreenScraper service adapter by @adamantike in #2002
- Create SteamGridDB service adapter by @adamantike in #2018
- Create MobyGames service adapter by @adamantike in #2023
- Improve API docs and annotations for rom endpoints by @adamantike in #2033
- Apply pyupgrade changes for Python 3.12 compatibility by @adamantike in #2034
- Improve API docs and annotations for platform endpoints by @adamantike in #2036
- Switch from poetry to uv by @gantoine in #2049
- Remove Python dependencies not being directly used by @adamantike in #2051
- Replace deprecated uvicorn.workers with uvicorn-worker by @adamantike in #2053
- Add code coverage for backend tests by @gantoine in #2056
- Correctly use Python 3.13 in Docker image by @adamantike in #2059
- Only subscribe to relevant filesystem events with watchdog by @adamantike in #2060
- Upgrade to Python 3.13 by @adamantike in #2048
- Upgrade nginx to v1.29.0 by @adamantike in #2035
- Upgrade py7zr to v1.0.0 by @adamantike in #2068
- Upgrade RALibretro to v1.8.1 by @adamantike in #2027
- Upgrade FastAPI to v0.116 by @adamantike in #2069
- Bump @intlify/core-base and vue-i18n in /frontend by @dependabot[bot] in #2088
New Contributors
- @milktoastrat made their first contribution in #1980
- @DevYukine made their first contribution in https://github.com/rom...
Contributors
Assets 2
v4.0.0-rc.1
24c0b18What's Changed
- Update Platform Icons by @milktoastrat in #2092
- Fix uploading cover art manually by @gantoine in #2094
- Fix uploading user profile picture by @gantoine
- Refactor platform drawer when grouping by manufacturer, generation or type by @gantoine
Full Changelog: 4.0.0-beta.4...4.0.0-rc.1
Contributors
Assets 2
v4.0.0-beta.4
9e722f5What's Changed
- fix: SGDB cover fallback by @zurdi15
- fix: Load platform icon image source to prefer SVG over ICO format by @zurdi15
- Centralize filesystem operations in base handler by @gantoine
- [ROMM-1780] Random game button by @gantoine
- build(deps): bump @intlify/core-base and vue-i18n in /frontend by @dependabot[bot]
Full Changelog: 4.0.0-beta.3...4.0.0-beta.4
Contributors
Assets 2
v4.0.0-beta.3
CVE-2025-53908
Caution
This release fixes a critical authenticated path traversal vulnerability in an API endpoint that could allow unauthorized access to system files. All previous versions are affected. All users should update immediately to this patch version.
GHSA-fx9g-xw4j-jwc3
What's Changed
- Added proper input validation and sanitization to prevent directory traversal attacks by @gantoine in #2085
- Scan page icons by @gantoine in #2084
Full Changelog: 4.0.0-beta.2...4.0.0-beta.3
Contributors
Assets 2
v3.10.3
CVE-2025-53908
Caution
This release fixes a critical authenticated path traversal vulnerability in an API endpoint that could allow unauthorized access to system files. All previous versions are affected. All users should update immediately to this patch version.
GHSA-fx9g-xw4j-jwc3
What's Changed
- Added proper input validation and sanitization to prevent directory traversal attacks by @gantoine in #2086
Full Changelog: 3.10.2...3.10.3
Contributors
Assets 2
v4.0.0-beta.2
d351ad1Warning
Using beta builds can cause instability and loss of data. We strongly recommend making backups of the database, resources, assets and games library before upgrading to any beta release. Always closely follow the upgrade instructions when switching to an beta release.
Biggest changes in this release:
- Use Launchbox GamesDB as a local-only metadata source
- Use Hasheous to find metadata matches using game hashes (MD5, SHA1)
- Will populate game info using IGDB metadata without setting up IGDB keys (IGDB proxy)
- Use Playmatch to find IGDB IDs only using game hashes
- Still requires setting up IGDB to fetch metadata
- A missing file will now mark a game as "missing" instead of deleting the entry and notes
- Re-added stats summary as a display option in the home page
- Dockerfile for developers now provided for 1-step development setup using
devcontainers
Six new environment variables were added in this release (default):
LAUNCHBOX_API_ENABLED(false): Download and use the Launchbox database when scanningPLAYMATCH_API_ENABLED(false): Compare hashes against Playmatch to populate IGDB dataHASHEOUS_API_ENABLED(false): Compare hashes against Hasheous to populate IGDB IDsSESSION_MAX_AGE_SECONDS(1209600): Length of time until browser session expires, in secondsENABLE_SCHEDULED_UPDATE_LAUNCHBOX_METADATA(false): Update local Launchbox database nightlySCHEDULED_UPDATE_LAUNCHBOX_METADATA_CRON(0 5 * * *): How often to run the Launhbox database update
What's Changed
- Only use first file in compressed game when calculating hashes by @gantoine in #2073
- Fixes for platform metadata scanning by @gantoine in #2074
- Stop overwriting IDs on scan by @gantoine in #2077
- refactor: improve fuzzy matching in SGDBBaseHandler for game search by @zurdi15 in #2079
- Update roms_metadata virtual table by @gantoine in #2083
Full Changelog: 4.0.0-beta.1...4.0.0-beta.2
Contributors
Assets 2
v4.0.0-beta.1
c9b09e9Warning
Using beta builds can cause instability and loss of data. We strongly recommend making backups of the database, resources, assets and games library before upgrading to any beta release. Always closely follow the upgrade instructions when switching to an beta release.
Biggest changes in this release:
- Use Launchbox GamesDB as a local-only metadata source
- Use Hasheous to find metadata matches using game hashes (MD5, SHA1)
- Will populate game info using IGDB metadata without setting up IGDB keys (IGDB proxy)
- Use Playmatch to find IGDB IDs only using game hashes
- Still requires setting up IGDB to fetch metadata
- A missing file will now mark a game as "missing" instead of deleting the entry and notes
- Re-added stats summary as a display option in the home page
- Dockerfile for developers now provided for 1-step development setup using
devcontainers
Six new environment variables were added in this release (default):
LAUNCHBOX_API_ENABLED(false): Download and use the Launchbox database when scanningPLAYMATCH_API_ENABLED(false): Compare hashes against Hasheous to populate IGDB dataHASHEOUS_API_ENABLED(false): Compare hashes against Playmatch to populate IGDB IDsSESSION_MAX_AGE_SECONDS(1209600): Length of time until browser session expires, in secondsENABLE_SCHEDULED_UPDATE_LAUNCHBOX_METADATA(false): Update local Launchbox database nightlySCHEDULED_UPDATE_LAUNCHBOX_METADATA_CRON(0 5 * * *): How often to run the Launhbox database update
Full Changelog: 4.0.0-alpha.4...4.0.0-beta.1