rommapp/romm 4.8.0 on GitHub

Highlights

Client API tokens

API tokens are a safer way for apps and devices to connect without sharing user credentials. A new QR-based pairing flow makes setup quick, with support for regeneration and revocation when needed. #3114

Chunked uploads

Goodbye failed uploads and incessant timeouts! ROMs will now upload in smaller chunks, allowing for more reliable transfers even on spotty connections. #3076

Local LaunchBox metadata import

Have a local LaunchBox installation packed with games? You can now import metadata directly from it, including cover art, screenshots and video previews. #2922

Minor changes

Add config option to use local video paths in gamelist.xml export by @JamieeBond in #3082
Add additional cover styles for boxart to prevent cropping by @Drarox in #3060
Fetch games on search view mount and reset search state on input clear by @zurdi15 in #3080
Add video_normalized media type option for ScreenScraper scans by @gantoine in #3088
Scrape and store age rating data from ScreenScraper.fr by @gantoine in #3089
Make invite token expiration configurable by @gantoine in #3094
Click to zoom game cover image by @gantoine in #3093
Add more platforms to cover styles by @Drarox in #3098
Show filtered ROM count in the gallery AppBar and filter drawer by @gantoine in #3097
Show firmware count in scan results to improve BIOS detection discoverability by @gantoine in #3111
Per-platform metadata coverage and region breakdown to server stats by @cciollaro in #3110
Use PICO-8 built-in cover art from .p8.png cartridge files by @gantoine in #3119
Auto-update game status from RetroAchievements award kind during progress sync by @gantoine in #3118
Add Bulgarian (bg_BG) translation by @DenislavDenev in #3159

Fixes

Fix platform aspect ratio not applying in gallery view by @gantoine in #3083
Fix metadata IDs not persisting when handler is disabled or game not found by @gantoine in #3085
Hack for natural sorting of ROMs by @gantoine in #3086
Always sub dash with colon for launchbox matching by @gantoine in #3090
Fix 500 error when loading platforms with ROMs whose filenames start with region tags by @gantoine in #3091
Fix M3U generation to exclude raw .bin tracks when .cue files are present by @gantoine in #3100
Filesystem watcher and scheduled scan skip when no metadata sources configured by @gantoine in #3106
Replace deep watch with computed to reduce reactivity overhead by @cciollaro in #3104
Add missing platforms to playable game filter by @Bergbok in #3121
Default to querying all roms by @camhorn in #3122
Remove cover image card bevel by @gantoine in #3131
Auto-select firmware when only one option is available by @gantoine in #3150
Fix IntegrityError when updating favourites after ROM rescan by @Copilot in #3166
Fix mod_zip UTF-8 filename handling for non-ASCII downloads by @tmgast in #3171

Other changes

Typed API form fields by @gantoine in #3036
Fix OAuth token expiry and implement refresh token rotation by @HydroSulphide in #3102
Add property for path_video and refactor places which use similar logic by @JamieeBond in #3116
Move "Clean up All" missing ROMs deletion to background task by @gantoine in #3109
Allow partial updates to ROM user props via typed payload schema by @gantoine in #3124
Switch ACCESS_TOKEN_EXPIRE_MINUTES to SECONDS by @gantoine in #3096
Update RAHasher to version 1.8.3 and add Wii platform support by @zurdi15 in #3145
Add OIDC_SERVER_METADATA_URL to support providers with non-standard discovery URLs (e.g. Google) by @gantoine in #3099
Fix OIDC login role downgrading for users without claims by @pacnpal in #3103
Implement OIDC RP-Initiated Logout (end-session endpoint) by @gantoine in #3107
Make OAuth token expiry configurable via env vars by @HydroSulphide in #3126
Remove Non-Argosy Android app references from README by @milktoastrat in #3130
Lockdown package installs by @gantoine in #3203
Bump authlib from 1.6.6 to 1.6.7 by @dependabot[bot] in #3070
Bump tar from 7.5.9 to 7.5.10 in /frontend by @dependabot[bot] in #3075
Bump joserfc from 1.3.5 to 1.6.3 by @dependabot[bot] in #3064
Bump tornado from 6.5.1 to 6.5.5 by @dependabot[bot] in #3123
chore(deps): bump authlib from 1.6.7 to 1.6.9 by @dependabot[bot] in #3138
chore(deps): bump memray from 1.17.2 to 1.19.2 by @dependabot[bot] in #3141
chore(deps): bump socket.io-parser from 4.2.5 to 4.2.6 in /frontend by @dependabot[bot] in #3144
chore(deps-dev): bump flatted from 3.3.4 to 3.4.2 in /frontend by @dependabot[bot] in #3146
chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 in /frontend by @dependabot[bot] in #3177
chore(deps): bump requests from 2.32.4 to 2.33.0 by @dependabot[bot] in #3186
chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 in /frontend by @dependabot[bot] in #3188
chore(deps): bump cryptography from 46.0.5 to 46.0.6 by @dependabot[bot] in #3196
chore(deps): bump pygments from 2.19.2 to 2.20.0 by @dependabot[bot] in #3199

Note

Environment Variables

UPLOAD_TIMEOUT has been removed in favour of chunked uploads
OAUTH_ACCESS_TOKEN_EXPIRE_SECONDS: Access token lifetime (in seconds, default 30 minutes)
OAUTH_REFRESH_TOKEN_EXPIRE_SECONDS: Refresh token lifetime (in seconds, default 7 days)
INVITE_TOKEN_EXPIRY_SECONDS: Invite token lifetime (in seconds, default 10 minutes)
OIDC_SERVER_METADATA_URL: URL to the OIDC provider metadata endpoint
OIDC_RP_INITIATED_LOGOUT: Enable RP-initiated logout flow (default false)
OIDC_END_SESSION_ENDPOINT: OIDC end-session endpoint override URL

New Contributors

@gravelfreeman made their first contribution in #2922
@Drarox made their first contribution in #3060
@alanfrigo made their first contribution in #3076
@pacnpal made their first contribution in #3103
@cciollaro made their first contribution in #3104
@HydroSulphide made their first contribution in #3102
@Bergbok made their first contribution in #3121

Full Changelog: 4.7.0...4.8.0