Skip to content

feat(container): update image rommapp/romm to v4.4.1 #1894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(container): update image rommapp/romm to v4.4.1 #1894

wants to merge 1 commit into from
+1 −1

Conversation

@spicerabot
Copy link
Contributor

@spicerabot spicerabot bot commented Nov 10, 2025 •
edited
Loading

This PR contains the following updates:

Package Update Change
rommapp/romm minor 4.3.2 -> 4.4.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

rommapp/romm (rommapp/romm)

v4.4.1

Compare Source

[!CAUTION]
This release patches two high (CVE-2025-65027 and CVE-2025-65097) and one moderate (CVE-2025-65096) severity vulnerabilities. An attacker who already has an account (with any role) on the instance can, with a special crafted link, gain full administrative control, create a new admin account, or escalate their own privileges. All previous versions are affected, and all server owners should update to this version as soon as possible.

As a precaution, users may be kicked out of their logged-in session when first accessing the app, editing a game or running a scan, which will regenerate session and CSRF cookies. This should only happen once.

Private or single-user instances are not at risk. Server owners should treat any links to RomM from users as suspicious. Further details will be published in 14 days to give server owners time to upgrade.

Minor changes
Fixes
Other changes
New Contributors

Full Changelog: rommapp/romm@4.4.0...4.4.1

v4.4.0

Compare Source

Highlights

[!WARNING]

  • The Tinfoil feed endpoint has been updated from /tinfoil/feed to /feeds/tinfoil, update your Tinfoil config accordingly.
  • A manual Scheduled LaunchBox metadata update must be run once before Launchbox can be used as a metadata source.
Alternative boxart

Spice up your collection with 3D, physical, and mixed media boxart, courtesy of Screenscraper! Start by configuring which media assets to download in your config.yml file:

scan:
  media:
    - box2d
    - box3d
    - physical
    - miximage
    - screenshot
    - manual
    - bezel

Available media types:

  • box2d - Normal cover art (always enabled)
  • box3d - 3D box art
  • miximage - Mixed image of multiple media
  • physical - Disc, cartridge, etc.
  • screenshot - Screenshot (enabled by default)
  • title_screen - Title screen
  • marquee - Custom marquee
  • logo - Transparent logo
  • fanart - User uploaded artwork
  • bezel - Bezel displayed around the EmulatorJS window
  • manual - Manual in PDF format (enabled by default)
  • video - Gameplay video (warning: large file size)

Restart the container.
Now on the scan page, select Screenscraper as the metadata source, Update metadata as the scan type, and click the Scan button. The media assets will be downloaded and stored alongside existing resources for covers and screenshots. Then under User Interface (/user-interface), change the Boxart style to 3D, Physical, or Mix Image as desired.

2D Box
Screenshot_2025-10-23_at_3 54 58_PM
3D Box
Screenshot_2025-10-23_at_3 55 07_PM
Physical
Screenshot_2025-10-23_at_3 55 16_PM
Mix Image
Screenshot_2025-10-23_at_3 55 25_PM

#​2598

ES-DE gamelist.xml

EmulationStation, and it's modern successor ES-DE, use a custom XML format to store game metadata. RomM can parse this format and import the assets as cover art and screenshots. You'll need to store the gamelist.xml file and any related assets under the platform folder, and select ES-DE in the "Metadata sources" dropdown on the scan page:

library/
  └─ roms/
    └─ gba/
      ├─ game_1.gba
      ├─ game_2.gba
      ├─ gamelist.xml
      ├─ 3dboxes/
      │  ├─ game_1.png
      │  └─ game_2.png
      ├─ covers/
      ├─ screenshots/
      └─ etc...

Here's an example of the content in a typical gamelist.xml file, though the parser supports more fields not listed:

<?xml version="1.0"?>
<gameList>
	<game>
		<path>./Advance Wars (J) (Rev 1).zip</path>
		<name>Advance Wars</name>
		<desc>The battle lines have been drawn, and an elite group of sly strategists is massing troops at your borders. You'll have to command ground, air and naval forces if you hope to survive the coming wars, and it won't be easy. With 114 maps to battle on and both the Single-Pak and Multi-Pak link modes, Advance Wars brings turn-based strategy to a depth never before seen on a handheld!</desc>
		<rating>0.8</rating>
		<releasedate>20020111T000000</releasedate>
		<developer>Intelligent Games</developer>
		<publisher>Nintendo</publisher>
		<genre>Strategy</genre>
		<players>1-4</players>
		<video>./videos/Advance Wars (J) (Rev 1).mp4</video>
		<box3d>./3dboxes/Advance Wars (J) (Rev 1).png</box3d>
		<backcover>./backcovers/Advance Wars (J) (Rev 1).png</backcover>
		<cover>./covers/Advance Wars (J) (Rev 1).png</cover>
		<fanart>./fanart/Advance Wars (J) (Rev 1).jpg</fanart>
		<manual>./manuals/Advance Wars (J) (Rev 1).pdf</manual>
		<marquee>./marquees/Advance Wars (J) (Rev 1).png</marquee>
		<miximage>./miximages/Advance Wars (J) (Rev 1).png</miximage>
		<physicalmedia>./physicalmedia/Advance Wars (J) (Rev 1).png</physicalmedia>
		<screenshot>./screenshots/Advance Wars (J) (Rev 1).png</screenshot>
		<title_screen>./titlescreens/Advance Wars (J) (Rev 1).png</title_screen>
		<thumbnail>./covers/Advance Wars (J) (Rev 1).png</thumbnail>
	</game>
</gameList>

#​2563

Task status page

We've added a new section on the /administration page for monitoring background tasks. This section displays real-time task status, execution statistics for successful tasks, and error messages for failed tasks. #​2502

Screenshot 2025-10-27 at 4 05 56 PM
Multi-threaded library scanning

Multiple games under the same platform can now be scanned in parallel, significantly reducing the time required to scan large libraries. Simply increase the SCAN_WORKERS environment variable to the number of games to scan in parallel. Note that parallel scanning is limited by the power of your CPU and the maximum permitted connections to selected metadata providers. #​2566

Screenshot 2025-10-27 at 4 22 23 PM
Manually edit metadata

The game's edit window now allows you to directly edit metadata IDs and JSON values. Changing a metadata ID will prompt the server to refresh metadata from that specific source, using the new ID. The JSON values can also be edited directly, and will be saved as raw metadata; for example, you can update youtube_video_id to use gameplay videos instead of trailers. Note: an UPDATE or COMPLETE scan of a game will override any manual changes made to metadata IDs or JSON values. #​2578

Screenshot 2025-10-27 at 4 29 06 PM
PS3/PSVita/PSP PKGi and Kekatsu DS feeds

Added support for PKGi and Kekatsu feed formats, enabling direct integration with popular game download tools:

  • PKGi PS3 (/feeds/pkgi/ps3/{content_type}): Supports games, DLC, demos, updates, patches, mods, translations, and prototypes
    • PKGi PSP (/feeds/pkgi/psp/{content_type}): Supporting the same content types
    • PKGi PS Vita (/feeds/pkgi/psvita/{content_type}): Supporting the same content types
  • Kekatsu DS (/feeds/kekatsu/{platform_slug}): Supporting Nintendo DS, GBA, and other compatible platforms with box art metadata

#​2572

ScummVM metadata

Metadata for ScummVM games stored under a scummvm folder can now be fetched exclusively from IGDB, using a special keyword search. #​2576

Screenshot 2025-10-27 at 4 27 46 PM
Screenscraper hash matching

The scanner will attempt to match games against Screenscraper's hash database, using the pre-calculated hashes for the largest, top-level ROM file. If no match is found, it will fall back to the existing file name matching logic. #​2616

#​2616

Minor changes

[!NOTE]
New environment variables

  • SCAN_WORKERS: Number of parallel worker processes for scanning games
  • TASK_RESULT_TTL: How long to keep task results in Valkey (in seconds)
  • SEVEN_ZIP_TIMEOUT: imeout for 7-Zip operations (in seconds)
Fixes
Behind-the-scenes

[!NOTE]
API changes:

  • The /config endpoint now distinguishes between CONFIG_FILE_MOUNTED and CONFIG_FILE_WRITABLE
  • The favourite filter for roms has been renamed to favorite
  • MetadataSource.LB was renamed to MetadataSource.LAUNCHBOX
  • New fields: CollectionSchema.is_favorite, RomSchema.gamelist_id, RomSchema.gamelist_id, TaskInfo.type
  • Removed fields: SearchRomSchema.hltb_id, SearchRomSchema.hltb_url_cover
New Contributors

Full Changelog: rommapp/romm@4.3.2...4.4.0

Bonus

Here's a little treat for reading all of the release notes 🍬

Nov-09-2025.22-13-441.mp4

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@spicerabot spicerabot bot requested a review from spiceratops as a code owner November 10, 2025 01:38
@spicerabot spicerabot bot force-pushed the renovate/rommapp-romm-4.x branch 25 times, most recently from bab482d to 76cff6e Compare November 16, 2025 10:11
@spicerabot spicerabot bot force-pushed the renovate/rommapp-romm-4.x branch 12 times, most recently from 6da9293 to 290da28 Compare November 19, 2025 19:09
@spicerabot spicerabot bot changed the title feat(container): update image rommapp/romm to v4.4.0 feat(container): update image rommapp/romm to v4.4.1 Nov 19, 2025
@spicerabot spicerabot bot force-pushed the renovate/rommapp-romm-4.x branch 15 times, most recently from e3d8cc1 to 449d9b5 Compare November 24, 2025 02:48
@spicerabot spicerabot bot force-pushed the renovate/rommapp-romm-4.x branch from 449d9b5 to 2143ee5 Compare November 24, 2025 12:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@spiceratops spiceratops Awaiting requested review from spiceratops spiceratops is a code owner

Assignees

@spiceratops spiceratops

Labels

area/kubernetes renovate/container type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@spiceratops