# Changelog ## [0.14.10] - 2026-10-13 ### User-facing changes #### Security - **Validation:** ROMarrNG's packaged acquisition proof now rejects TLS 1.0 and 1.1 on its local HTTPS fixture, requiring TLS 1.2 or newer. This improves security validation without changing the application's runtime network behavior. ## [0.14.9] - 2026-10-13 ### User-facing changes #### Added - **Seerrng:** Files delivered to SeerrNG now say whether they matched your loaded DATs, so SeerrNG can show a verified badge on ROM requests. The SeerrNG handshake reports this as assetDatVerification. ## [0.14.8] - 2026-10-13 ### User-facing changes #### Added - **Settings:** Settings > General lets each browser choose regional date, time, and number formatting, defaulting to browser settings. Counts, ratings, sizes, dates, and timestamps use that region; date-only values keep their day and anniversaries stay yearless. The choice stays in that browser. Regional formatting does not change the selected interface language or ROM translation filters. - **Interface Language:** ROMarr lets each browser choose from eleven interface languages, with English fallback. Navigation, page titles, Library filters, request workflows, and Interactive Search use translated labels, actions, and grab statuses. Arabic interface support remains deferred until right-to-left layout and core workflows are reviewed; Arabic is available as a regional-format preference. #### Changed - **Localization:** The regional-format control now explains browser-default formatting in the selected interface language. When browser storage is unavailable, the selected format continues to apply for the current tab. #### Security - **Credentials:** Validation snapshots exclude dotted and extensionless credentials, private/API keys, access/refresh-token and client-secret material, suffixed dotenv credentials, and non-source files under credential folders. Source modules and safe templates such as tokens.env.example remain available to tests. - **Validation:** ROMarrNG validation now uses GitHub-hosted runners for every event. Public workflow jobs no longer execute on a persistent local machine. ## [0.14.7] - 2026-10-12 ### User-facing changes #### Added - **Acquisition:** Collections adds strict regions, selected translation languages, and Switch TitleDB sets. Hub sources can search and stage downloads for normal import. Dashboard scripts work again, renamed downloads retain request identity, and Discord sends its required client identifier. - **Action required:** Add a ROM Hub download client to enable plugin acquisition. #### Changed - **Integrations:** The new upstream comparison distinguishes ROMarr's shared request API from ROMarrNG's SeerrNG contract, standalone additions, and replacement conditions. - **Documentation:** The upstream backlog guide now links each audited issue and pull request to the implementation, its tests, and the remaining checks that need a reporter's environment. #### Fixed - **Integration:** DAT-backed SeerrNG requests now match common region aliases, retries keep their active status, and Hub fetch failures close the request. Switch catalog loading works without DATs, translation rules also apply when 1G1R is off, and Hub platform data improves release scoring. Platform-specific Hub searches skip results without a verified platform. - **Integration:** SeerrNG DAT browsing and requests now honor saved region and translation policies. Requests sharing a download each receive completion status and deliverable assets. Both image editions test sandboxed Hub acquisition and SeerrNG delivery before publication. #### Security - **Plugins:** ROM Hub plugins now have bounded temporary storage and cannot change file permissions, spawn child processes, or use io_uring to bypass socket restrictions. The trusted SDK runner loads before plugin paths become importable. Plugin file access stays within installed code, approved assets, and required runtime files, reducing the impact of a misbehaving source. - **Validation:** Local test runs now require a trusted Linux sandbox that hides operator files, ambient secrets, service sockets, and network access from candidate test code. Dependency roots that resolve outside the candidate tree are rejected before they can be mounted into the sandbox. - **Action required:** run local tests through trusted launcher - **Validation:** Validation task and runtime-probe processes now use restricted environment variables and private temporary settings, reducing exposure of unrelated credentials and configuration during validation. - **Validation:** Dependency installation is limited to hosted CI and receives only explicitly approved proxy, private-index, and custom CA settings; local offline tests use a preconfigured Python environment. Hosted checkouts no longer persist their token into `.git/config`, and Linux task children cannot read the validation runner's environment through procfs. ## [0.14.6] - 2026-10-12 ### User-facing changes #### Fixed - **Plugins:** ROM Hub workers now apply filesystem confinement before plugin code loads, block permission changes and child processes, and keep scratch on bounded tmpfs storage. Plugins can no longer read ROMarr configuration, Hub state or stored Hub secrets through the host filesystem. - **SeerrNG:** DAT-backed requests match common region aliases such as `(USA)` and `(U)`, active retries keep their current status, and ROM Hub fetch failures close the linked request. - **Collections:** Translation language and exclusion rules now apply when 1G1R is disabled, and Hub platform metadata contributes verified console evidence to release scoring. - **Switch:** TitleDB initializes on first Switch use even when no DAT directory is configured. #### Removed - **Packaging:** This repository no longer contains YunoHost packaging or updates the YunoHost app repository. Existing YunoHost installations will no longer receive package updates through ROMarrNG. ## [0.14.5] - 2026-10-12 ### User-facing changes #### Fixed - **Imports:** Completed downloads now match their queue entries by client job ID or torrent hash before title, so renamed jobs are still imported and older saved queue rows remain compatible. - **Library:** ROMarr refreshes password-grant RomM tokens before expiry and safely retries RomM 5.3.1's expired-token error, keeping library reads available without treating a real server outage as an authentication failure. ## [0.14.4] - 2026-10-12 ### User-facing changes #### Changed - **Images:** Published container images now use the updated SBOM toolchain for their SPDX inventories, keeping component records current for downstream review. ## [0.14.3] - 2026-10-12 ### User-facing changes #### Added - **Library:** Request status now reports whether a finished file has been placed in a RomM library folder, so SeerrNG can show an In RomM Library badge once the file is in place. #### Changed - **Distribution:** Manually dispatched ROMarrNG browser image builds now receive commit-specific tags on non-default branches, so candidate browser images can be tested without changing the default browser tag. - **Documentation:** ROMarrNG’s install and SeerrNG guides now explain the current DAT catalog, sandbox requirements, TLS options, YunoHost package, and image tags. - **Ci Validation:** Adds source-bound pytest receipts and verifies the current test result before building a ROMarrNG container image. ## [0.14.2] - 2026-10-07 ### User-facing changes #### Fixed - **Release Pipeline:** Encrypted backups now build across ROMarrNG's published container architectures, keeping the supported ARMv7 image available alongside AMD64 and ARM64. #### Security - **Backup:** ROMarr can now export and restore credential-inclusive backups as passphrase-encrypted AES-GCM envelopes, keeping API keys and download-client passwords unreadable in the saved file. ## [0.14.1] - 2026-10-06 ### User-facing changes #### Changed - **Release Pipeline:** Both published container variants now generate their SBOMs with the updated, SHA-pinned Anchore action, keeping software inventory generation current across the release workflow. ## [0.14.0] - 2026-10-04 ### User-facing changes #### Added - **Seerrng Integration:** SeerrNG can now browse ROMarrNG's loaded DAT catalogs without IGDB credentials. Titles are grouped by supported system, requests keep a stable DAT identity, and unmatched DAT systems are reported for review. - **Action required:** Load DAT files in ROMarrNG to make their matched systems available in SeerrNG. ## [0.13.1] - 2026-10-03 ### User-facing changes #### Added - **System:** The System status page now includes a Ko-fi link for users who want to support ROMarrNG maintenance. ## [0.13.0] - 2026-10-03 ### User-facing changes #### Added - **Browser Downloads:** ROMarrNG now publishes a Debian browser image with the Playwright client for sites that require a real browser. The browser server runs separately at the matching Playwright version; the default image and direct downloads are unchanged. - **Action required:** Use the ROMarrNG Browser template and configure a matching Playwright server for browser downloads. #### Changed - **Release Pipeline:** ROMarrNG release notes now include curated summaries and required upgrade actions, so people can see what changed without reading commit history. - **Notifications:** The connection editor can test the values currently entered before saving and reports endpoint or network failure details. Masked secrets from saved connections are restored for the test when left unchanged. #### Fixed - **Collections:** The 1G1R collection planner now follows the configured library layout, including nested RomM libraries, so it recognizes games inside each platform's `roms` directory. #### Security - **Containers:** **Breaking:** The Docker Compose example now uses a read-only root filesystem, drops unnecessary capabilities, and enables no-new-privileges. Sunshine connections require a trusted CA or certificate pin; published images also carry signed provenance and SPDX SBOM attestations. - **Action required:** Configure MOONLIGHT_TLS_CA_FILE or MOONLIGHT_TLS_FINGERPRINT, or explicitly opt in to insecure TLS on a trusted LAN. - **Integration:** SeerrNG can now use its own integration-only key. Concurrent submissions are deduplicated, request bodies and workers are bounded, and plugin operations stop when seccomp is unavailable unless an operator explicitly opts out. ## [0.12.3] - 2026-10-01 ### User-facing changes #### Fixed - **Setup:** The setup guide now recognizes every configured download client. Users installing ROMarrNG alone or alongside SeerrNG will see an accurate status instead of a permanent “not set up” message. - **Action required:** Update ROMarrNG to the new release. ## [0.12.2] - 2026-10-01 ROMarrNG can now bind to a configured network address with `ROMARR_HOST`. The container continues to listen on all interfaces; the YunoHost package binds only to localhost so requests pass through YunoHost's access controls. ## [0.12.1] - 2026-10-01 The optional LaunchBox plugin and its proof harness now target `net10.0-windows`, matching LaunchBox 14 and newer. Building the plugin requires the .NET 10 SDK and the nonredistributable LaunchBox API assembly from the operator's installation. The XML import path remains available for older LaunchBox versions. ## [0.12.0] - 2026-10-01 ### Added - Remote download path mappings can target one configured download client. This lets SABnzbd and torrent clients use different local paths for the same reported remote path; existing mappings still apply to every client. ### Changed - The Unraid Community Applications icon now displays the NG badge, with a refreshed cache version. - Container images now use Python 3.14. ### Security - Hardened Steam profile URL validation against untrusted destinations and made request-target credential redaction linear while preventing log-line injection. Removed attacker-controlled values from sensitive log messages. - Enabled Dependabot updates and dependency review automation. ## [0.11.1] - 2026-09-29 The Unraid Community Applications template now uses the ROMarrNG 0.11.1 icon cache version, allowing an older blank icon response to refresh. ## [0.11.0] - 2026-09-29 ROMarrNG's SeerrNG catalog endpoint can return the exact day-precision release date for a requested IGDB platform. When IGDB has no complete date for that platform, the endpoint returns `null` instead of using the game's global first release date. Malformed and out-of-range platform IDs are rejected. ## [0.10.1] - 2026-09-28 This maintenance release republishes the verified ROMarrNG 0.10.0 codebase with a new versioned image. It includes no application behavior changes. ## [0.10.0] - 2026-09-28 First GitHub Release for the existing ROMarrNG tag history through `v0.9.0`. This version packages the fork's SeerrNG integration and the accumulated improvements listed below. ROMarrNG's update check now follows the Snapetech release feed, and this release's versioned image is `ghcr.io/snapetech/romarrng:0.10.0`. ### Added - SeerrNG can search ROMarrNG's game catalog, track acquisition requests, and retrieve request-scoped game files. Complete game archive downloads can resume after an interrupted transfer. - The IGDB catalog can be filtered by platform, genre, and release year, and SeerrNG requests retain their catalog game and selected platform identity. - Operators can check Prowlarr's management API and enabled indexer feeds separately when diagnosing search failures; diagnostics omit credentials and feed URLs. - PS4, PS5, Vita, Xbox One, and Xbox Series requests can use the existing acquisition workflow for supported packages or folder dumps. In SeerrNG, assign these systems to **Modern** before requesting them. - The Unraid Community Applications listing now has a ROMarrNG icon and setup guidance for storage paths and support. The icon URL is versioned so Community Applications can refresh a previously cached blank result. ### Fixed - Incomplete multi-file imports and failed latest imports no longer make a game appear available or owned; successful retries restore ownership. - New main-branch image builds supersede older runs, while versioned builds do not replace the `latest` image.