This release adds 6 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Light signalVersion 5.0.0 introduces a comprehensive UI redesign with a new design system and universal input model.
Why it matters: The ground‑up UI redesign (fact 69333) overhauls the visual layer, affecting all user interactions; developers must review component mappings to align with the updated design system before deployment.
Summary
AI summaryBroad release touches Minor changes, Other changes, Highlights, and fix.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Fixes permission issues for exported game lists and Pegasus platform slug mapping. Fixes permission issues for exported game lists and Pegasus platform slug mapping. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Medium |
Adds a ground-up UI redesign with new design system and universal input model. Adds a ground-up UI redesign with new design system and universal input model. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds shared savestates for cross‑user game progress sharing. Adds shared savestates for cross‑user game progress sharing. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds interactive 3D boxart rendering. Adds interactive 3D boxart rendering. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds CRT shader mode for retro display emulation. Adds CRT shader mode for retro display emulation. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds server‑side ROM patching with stored or uploaded patches. Adds server‑side ROM patching with stored or uploaded patches. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds QR code pairing for quick device‑server linking. Adds QR code pairing for quick device‑server linking. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds real‑time backend log viewing in the web UI. Adds real‑time backend log viewing in the web UI. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds controller debug view for live input mapping testing. Adds controller debug view for live input mapping testing. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds granular per‑user and per‑group permission system. Adds granular per‑user and per‑group permission system. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds in‑app music player for soundtrack files stored in ROMs. Adds in‑app music player for soundtrack files stored in ROMs. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds ES-DE `<sortname>` import and edit support for ROM ordering. Adds ES-DE `<sortname>` import and edit support for ROM ordering. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Filters games by matched metadata provider. Filters games by matched metadata provider. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Filters games by custom tags. Filters games by custom tags. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Adds ROM revision field to game details overview. Adds ROM revision field to game details overview. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Adds Artwork subtab with scraped art gallery to Media tab. Adds Artwork subtab with scraped art gallery to Media tab. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Adds filters for presence of save/state files. Adds filters for presence of save/state files. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Supports markdown manuals and enforces allowed file types. Supports markdown manuals and enforces allowed file types. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Remembers emulator core per‑game. Remembers emulator core per‑game. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Adds debug overlay. Adds debug overlay. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Performance | Medium |
Backfills cover conversion on startup when enabled. Backfills cover conversion on startup when enabled. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | High |
Fixes state/save injection timing and corruption in EmulatorJS. Fixes state/save injection timing and corruption in EmulatorJS. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Native hashing of PSP compressed‑ISO containers. Native hashing of PSP compressed‑ISO containers. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Refreshes platforms on scan. Refreshes platforms on scan. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Handles missing ROM files during delete‑from‑filesystem requests. Handles missing ROM files during delete‑from‑filesystem requests. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Prevents duplicate ROM entries from racing scans. Prevents duplicate ROM entries from racing scans. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Guards SiblingBadge against missing sibling_roms to prevent scan crashes. Guards SiblingBadge against missing sibling_roms to prevent scan crashes. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Accepts embedded custom_name body on platform update. Accepts embedded custom_name body on platform update. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Makes scan tracker totals reflect actually scanned platforms. Makes scan tracker totals reflect actually scanned platforms. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Normalizes Sony serial codes to uppercase before cache lookup. Normalizes Sony serial codes to uppercase before cache lookup. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
Highlights
UI overhaul
A ground-up redesign of the UI, with a new design system, fresh visual language, and a universal input model that feels at home with mouse, touch, keyboard and gamepad alike. With a stronger emphasis on performance, responsiveness, ease-of-use and accessibility, the new UI should be a joy on any device. #3436
Shared savestates
Share your game saves and savestates with other users; useful for speedrunning, special unlocks, new game +, or just showing off your progress. #3569
Interactive 3D boxart
Boxart go weeeeeeeeeeeeeeeeeeeeeeeeeeeee! #3580
CRT mode
Take me back to the 90s with a CRT shader that simulates the look of those old displays we love dearly. #3552
Server-side ROM patching
We've unlocked the full power of ROM patching by moving it to the server. Simply apply patches to your ROMs, now with the option to use stored or uploaded patch files. #3225
QR code pairing
Quickly pair your PC, TV or handheld device with your server by scanning a QR code (currently available on Argosy Launcher and Playnite). #3308
Real-time logs
Tired of SSHing into your server to tail the logs when something breaks? Now you can view the backend logs in real-time directly from the web UI. #3557
Controller debug view
Test your controller inputs and mappings in real-time with a new debug view. #3581
Changelog preview
A quick peak at the changes in the current version, with links to the full changelog. #3560
Granular permission system
Tweak access to your library with per-user and per-group permissions, with one configurable default group for new users. Tri-state grant/revoke on top of the group, and per-entity overrides, allow for fine-grained control over who can see what. #3605
Music player
Music files stored within a ROMs' soundtrack folder can now be played directly from details page (#3610), and queried directly from the API (#3640). This opens the door to future features like background music playback and soundtrack playlists.
Minor changes
- Add ES-DE
<sortname>import and edit support for ROM ordering by @gantoine in https://github.com/rommapp/romm/pull/3460 - fix(ra): hash PSP compressed-ISO containers natively (#3600) by @gantoine in https://github.com/rommapp/romm/pull/3609
- feat(roms): filter games by matched metadata provider by @Spinnich in https://github.com/rommapp/romm/pull/3615
- feat(roms): filter games by custom tags by @Spinnich in https://github.com/rommapp/romm/pull/3629
- Add ROM revision field to game details overview by @gantoine in https://github.com/rommapp/romm/pull/3631
- Add Artwork subtab to Media tab with scraped art gallery by @gantoine in https://github.com/rommapp/romm/pull/3634 and https://github.com/rommapp/romm/pull/3700
- Add filters for has save/state by @gantoine in https://github.com/rommapp/romm/pull/3642
- Support markdown manuals and enforce allowed file types by @gantoine in https://github.com/rommapp/romm/pull/3683
- feat(player): remember emulator core per-game by @gantoine in https://github.com/rommapp/romm/pull/3701
- feat: Add debug overlay by @zurdi15 in https://github.com/rommapp/romm/pull/3554
Fixes
- fix: Refresh platforms on scan by @zurdi15 in https://github.com/rommapp/romm/pull/3555
- Handle missing ROM files during delete-from-filesystem requests by @zurdi15 in https://github.com/rommapp/romm/pull/3562
- fix: guard SiblingBadge against missing sibling_roms (scan crash with Group ROMs) by @androosio in https://github.com/rommapp/romm/pull/3568
- Permission fix for exported game lists and Pegasus platform slugs mapping by @ametis70 in https://github.com/rommapp/romm/pull/3587
- fix(platform): accept embedded custom_name body on platform update by @gantoine in https://github.com/rommapp/romm/pull/3597
- fix(webp): backfill cover conversion on startup when enabled by @gantoine in https://github.com/rommapp/romm/pull/3602
- fix(scan): prevent duplicate ROM entries from racing scans by @gantoine in https://github.com/rommapp/romm/pull/3606
- fix(scan): make scan tracker totals reflect platforms actually scanned by @gantoine in https://github.com/rommapp/romm/pull/3607
- Fix state/save injection timing and corruption in EmulatorJS by @gantoine in https://github.com/rommapp/romm/pull/3624
- fix(scan): Normalize Sony serial codes to uppercase before cache lookup by @gantoine in https://github.com/rommapp/romm/pull/3622
- Fix ROM name handling in UNMATCHED scans to replace placeholders by @gantoine in https://github.com/rommapp/romm/pull/3623
- fix(backend): load platform_id on siblings to avoid DetachedInstanceError by @gantoine in https://github.com/rommapp/romm/pull/3635
- Fix ROM upload temp directory to use RESOURCES_BASE_PATH by @gantoine in https://github.com/rommapp/romm/pull/3632
- fix(roms): namespace filter-values cache by schema version by @Spinnich in https://github.com/rommapp/romm/pull/3638
- fix(retroachievements): match MSX2 against RetroAchievements (#3644) by @Spinnich in https://github.com/rommapp/romm/pull/3645
- fix(retroachievements): match Famicom Disk System (FDS) against RetroAchievements by @Spinnich in https://github.com/rommapp/romm/pull/3647
- fix(retroachievements): match SuperGrafx against RetroAchievements by @Spinnich in https://github.com/rommapp/romm/pull/3652
- Fix typo in core mapping from 'zsx' to 'zxs' by @sildur in https://github.com/rommapp/romm/pull/3656
- Refine filename version-tag parsing to avoid swallowing generic
v*tags by @gantoine in https://github.com/rommapp/romm/pull/3658 - fix: make 1.8 migration re-entrant so fresh installs stop crash-looping on MariaDB by @mvanhorn in https://github.com/rommapp/romm/pull/3669
- fix(retroachievements): hash GameCube and Wii RVZ/WIA images natively by @Spinnich in https://github.com/rommapp/romm/pull/3657
- fix(collections): download whole collections as a single zip by @Spinnich in https://github.com/rommapp/romm/pull/3661
- fix: display selected firmware in player by @chiyi-creator in https://github.com/rommapp/romm/pull/3673
- fix: stop mapping Public Domain ROMs to Poland by @chiyi-creator in https://github.com/rommapp/romm/pull/3671
- fix: allow NAT64-wrapped public IPs through SSRF filter by @gantoine in https://github.com/rommapp/romm/pull/3675
- Use parsed filename for unmatched ROM titles instead of raw filename by @gantoine in https://github.com/rommapp/romm/pull/3681
- fix(scan): fall back to other providers when ScreenScraper quota is exhausted by @gantoine in https://github.com/rommapp/romm/pull/3686
- fix(launchbox): import local media when matching via update_rom by @gantoine in https://github.com/rommapp/romm/pull/3687
- feat: default UI language to browser language when available by @gantoine in https://github.com/rommapp/romm/pull/3690
- fix(platforms): stop platform variants from renaming the parent platform by @gantoine in https://github.com/rommapp/romm/pull/3693
- fix: generate virtual collections from all metadata sources by @gantoine in https://github.com/rommapp/romm/pull/3694
- fix(sockets): require TASKS_RUN scope for scan and scan:stop by @gantoine in https://github.com/rommapp/romm/pull/3698
- fix(roms): enforce parent ROM visibility on direct file endpoints by @gantoine in https://github.com/rommapp/romm/pull/3703
- fix(backend): correct M4A embedded cover extraction and validation by @VoidHandler in https://github.com/rommapp/romm/pull/3705
- fix(launchbox): match remote cover art region to ROM region by @gantoine in https://github.com/rommapp/romm/pull/3709
- fix(backend): serve PDF/Markdown manuals inline so the viewer can render them by @gantoine in https://github.com/rommapp/romm/pull/3714
- fix: surface config.yml parse errors instead of silently using defaults by @gantoine in https://github.com/rommapp/romm/pull/3713
- fix(frontend): restore manual display and extract ManualSubtab by @gantoine in https://github.com/rommapp/romm/pull/3717
- Fixed the translation of "player-count" by @wolfg1969 in https://github.com/rommapp/romm/pull/3719
- fix(scan): make Hasheous and SteamGridDB scan lookups fault-tolerant in the metadata handlers by @TowyTowy in https://github.com/rommapp/romm/pull/3716
- fix(backend): discard ScreenScraper chroma-key green placeholder art by @gantoine in https://github.com/rommapp/romm/pull/3724
- fix(frontend): restore manual display and extract ManualSubtab by @gantoine in https://github.com/rommapp/romm/pull/3717
- Fixed the translation of "player-count" by @wolfg1969 in https://github.com/rommapp/romm/pull/3719
- fix(scan): make Hasheous and SteamGridDB scan lookups fault-tolerant in the metadata handlers by @TowyTowy in https://github.com/rommapp/romm/pull/3716
- fix(backend): discard ScreenScraper chroma-key green placeholder art by @gantoine in https://github.com/rommapp/romm/pull/3724
- fix(ui): remove cover-art attribution link on details pages by @gantoine in https://github.com/rommapp/romm/pull/3737
fix(scan): strip leading dot from dot-separated version tags by @TowyTowy in https://github.com/rommapp/romm/pull/3751
Other changes
- fix(search): full-text indexes+caching by @bonofiglio in https://github.com/rommapp/romm/pull/3540
- Integrate Hypothesis property-based testing for the backend by @gantoine in https://github.com/rommapp/romm/pull/3403
- feat: backend connection status notice + offline-aware boot by @zurdi15 in https://github.com/rommapp/romm/pull/3550
- Run backend tests in parallel with pytest-xdist by @gantoine in https://github.com/rommapp/romm/pull/3559
- feat(auth): add OIDC_ALLOW_REGISTRATION toggle to gate OIDC auto-registration by @Spinnich in https://github.com/rommapp/romm/pull/3577
- docs: split frontend constitution into focused agent skills, make CLAUDE.md holistic by @gantoine in https://github.com/rommapp/romm/pull/3581
- Exclude served resources from Vite dev watcher by @gantoine in https://github.com/rommapp/romm/pull/3586
- Add test data generator script by @gantoine in https://github.com/rommapp/romm/pull/3585
- Test Build GitHub Action improvements by @ametis70 in https://github.com/rommapp/romm/pull/3588
- fix(deps): bump dependencies to patch reported vulnerabilities by @gantoine in https://github.com/rommapp/romm/pull/3592
- Turkish language support tr_TR by @y1lm-z in https://github.com/rommapp/romm/pull/3593
- perf(roms): speed up the gallery/search list endpoint on large libraries by @gantoine in https://github.com/rommapp/romm/pull/3595
- Stop spamming PRs with coverage reports by @gantoine in https://github.com/rommapp/romm/pull/3625
- Squash legacy migrations by @gantoine in https://github.com/rommapp/romm/pull/3670
- docs(claude): add PR linking and template conventions by @gantoine in https://github.com/rommapp/romm/pull/3682
- i18n: rename "Duplicates" filter to "Versions" in the UI by @gantoine in https://github.com/rommapp/romm/pull/3688
- test: add axe accessibility gate + keyboard nav tests to Storybook by @gantoine in https://github.com/rommapp/romm/pull/3691
- docs(sync): clarify slot pairing behavior in negotiate OpenAPI spec by @gantoine in https://github.com/rommapp/romm/pull/3699
- feat(playmatch): move integration to API v2 by @DevYukine in https://github.com/rommapp/romm/pull/3689
- ci: fail PRs that modify the frozen frontend v1 UI by @gantoine in https://github.com/rommapp/romm/pull/3723
- Hotfix upload buttons in media tabs by @gantoine in https://github.com/rommapp/romm/pull/3732
- ci: fail PRs that modify the frozen frontend v1 UI by @gantoine in https://github.com/rommapp/romm/pull/3723
- Add Freegosy to community tab in README by @abduznik in https://github.com/rommapp/romm/pull/3729
- Update README featured projects by @QuaiGoner in https://github.com/rommapp/romm/pull/3738
- feat: inject ScreenScraper dev credentials at build time by @gantoine in https://github.com/rommapp/romm/pull/3740
- build(deps): bump python-engineio from 4.12.2 to 4.13.2 by @dependabot[bot] in https://github.com/rommapp/romm/pull/3626
- build(deps): bump joserfc from 1.6.3 to 1.6.7 by @dependabot[bot] in https://github.com/rommapp/romm/pull/3627
- build(deps): bump python-socketio from 5.14.0 to 5.16.2 by @dependabot[bot] in https://github.com/rommapp/romm/pull/3628
- chore(deps): bump joserfc from 1.6.7 to 1.6.8 by @dependabot[bot] in https://github.com/rommapp/romm/pull/3672
New Contributors
- @bonofiglio made their first contribution in https://github.com/rommapp/romm/pull/3540
- @androosio made their first contribution in https://github.com/rommapp/romm/pull/3568
- @ametis70 made their first contribution in https://github.com/rommapp/romm/pull/3587
- @y1lm-z made their first contribution in https://github.com/rommapp/romm/pull/3593
- @sildur made their first contribution in https://github.com/rommapp/romm/pull/3656
- @mvanhorn made their first contribution in https://github.com/rommapp/romm/pull/3669
- @chiyi-creator made their first contribution in https://github.com/rommapp/romm/pull/3673
- @VoidHandler made their first contribution in https://github.com/rommapp/romm/pull/3705
- @wolfg1969 made their first contribution in https://github.com/rommapp/romm/pull/3719
- @TowyTowy made their first contribution in https://github.com/rommapp/romm/pull/3716
Full Changelog: https://github.com/rommapp/romm/compare/4.9.2...5.0.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]