romm-api: v1.4.0

1.4.0 (2026-09-28)

Features

• api,cli: add config D registry, saves and collections commands (d51af73)
• api: add config key registry with dotted-path set (097d999)
• api: add source-aware config load and env field coverage (8529063)

Bug Fixes

• api,cli: atomic save downloads, overwrite guard, and platform env mapping (b955207)
• api: block authenticated cross-origin redirects (2384e99)
• api: clean up download conflict markers and restore filename logging (6591375)
• api: disable unvalidated download resume (0fa1551)
• api: discard stale partial download targets (#74) (e83f3c2)
• api: enforce HTTPS in client constructor (b1d3971)
• api: fetch ROM detail before falling back to ZIP download endpoint (868603e)
• api: guard OpenAPI auth fallback origin (#71) (cce55f6)
• api: parse API_USE_HTTPS boolean values (#98) (d3fe6d5)
• api: preserve downloads on failed streams (#100) (f56bbdd)
• api: prevent OpenAPI HTTPS auth downgrade (#64) (5bd4edf)
• api: prevent sanitized path traversal (8ace0a1)
• api: prevent zip extraction overwrites (077e646)
• api: redact OpenAPI fallback errors (#70) (2393761)
• api: reject short ROM file downloads (#99) (a4b7067)
• api: require exact self-update archive (#72) (da4dca5)
• api: strip auth from download redirects (7a6fae3)
• auth: prevent keyring secrets from surviving logout (8950934)
• cli: preserve sync upload filenames (#81) (9447d9e)
• download: avoid duplicate extras target paths (#83) (b471c44)
• metadata: reject providerless search matches (#84) (b3f0402)
• tui: avoid caching truncated ROM lists (#67) (17b1f7c)
• tui: invalidate ROM lists after metadata apply (#66) (6485600)