Back to Catalog
RomM logo

RomM

Beautiful, powerful, self-hosted rom manager and player

app

Alternative to: antstream arcade

Website Repository Docs
About Versions (100)
Back to Versions

4.0.0

2025-07-20

It’s here, it’s real and it’s awesome: 4.0.0 is our most feature-packed release yet! 💫

We’re thrilled to finally announce the long-awaited hash-based metadata matching feature, which allows you to validate your ROMs against popular DATfile databases like No-Intro, Redump and TOSEC.

[!CAUTION] This release fixes a critical authenticated arbitrary file write vulnerability (CVE-2025-54071) in all API endpoints that accept uploaded files, which can lead to remote code execution on the system. All previous versions are affected. All users should update immediately to this version, or see the mitigations in the advisory below. #2085 https://github.com/rommapp/romm/security/advisories/GHSA-fgxf-hggc-qqmq

Highlights

Hash-based metadata matching

We’ve partnered with two friends and members of the community, @michael-j-green and @DevYukine, to bring you a powerful new feature that allows you to match your ROMs against hash databases like No-Intro, Redump and TOSEC. They’ve built new public and free APIs, Hasheous and Playmatch respectively, that validate the contents of your ROM files against these databases. In the case of Hasheous, it also proxies metadata from IGDB, so you no longer need to set up IGDB credentials to fetch metadata from IGDB.

To start using Hasheous, simply set HASHEOUS_API_ENABLED=true in your environment variables, and future scans will use the Hasheous API. And for Playmatch, set PLAYMATCH_API_ENABLED=true in your environment variables. Note that you’ll need to set up IGDB credentials to use Playmatch, as it does not proxy IGDB metadata like Hasheous does.

You can find popular metadata provider combinations for scans in the documentation.

Screenshot 2025-07-20 at 6 16 21 PM

#1931 #1990 #1997

LaunchBox metadata

The LaunchBox Games Database is a community-driven database that provides metadata, cover art, and screenshots. Like the LaunchBox desktop application, RomM downloads the entire database locally and matches games based on their exact filenames. This is a privacy-friendly option for users who want to import metadata without relying on online APIs, and/or already use LaunchBox to manage their game collections.

To enable LaunchBox, set LAUNCHBOX_API_ENABLED=true in your environment variables. You can enable regular updates of the database by setting ENABLE_SCHEDULED_UPDATE_LAUNCHBOX_METADATA, and set the frequency of the cron job with SCHEDULED_UPDATE_LAUNCHBOX_METADATA_CRON (defaults to 5:00 AM every day).

#1515

SteamGridDB during scans

SteamGridDB, the community-driven platform for cover art, is now available to use during scans. When selected as a source on the scan page, RomM will prioritize high-quality cover art from SteamGridDB for both matched and unmatched (no metadata found) games. Instructions for setting up SteamGridDB are available in the documentation.

Screenshot 2025-07-20 at 6 14 08 PM

Mark games with missing files as “missing”

In previous versions, RomM would delete games from the database if the file(s) were missing from the filesystem. This would lead to the loss of notes, save files and manual metadata matches. Now, these games will be marked as “missing” instead of being deleted, allowing you to restore them later if the files are added back. Use the filter bar on the search, platform and collection pages to easily find these games.

#1977

Android app

Community member and developer extraordinaire @mattsays has just released an unofficial companion app for RomM. The app allows you to browse, manage, and organize your retro gaming collection directly from your Android device, as well as download games to it. While the app is not yet available on the Google Play Store, you can download the latest APK from the GitHub repository.

DOS with EmulatorJS

Playing MS-DOS games in the browser is now possible with EmulatorJS, with a bit of setup required. As with PSP emulation, we recommend using the unofficial desktop app, which enables the required browser features without compromising your security.

Minor changes

Fixes

Other changes

[!WARNING] API endpoint changes

New Contributors

Full Changelog: https://github.com/rommapp/romm/compare/3.10.3…4.0.0

Changelog on GitHub →