5.4.1

Caution

This release includes mitigations for the recent eMudhra CA compromise as well as general dependency upgrades. While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible.

What's Changed

• docs(readme): move corporate sponsors above friends by @gantoine in #5219
• chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 in /frontend by @dependabot[bot] in #5221
• fix(deps): bump certifi to 2026.10.19 to distrust compromised eMudhra intermediates by @gantoine in #5283
• chore(deps): bump uv to 0.13.4 by @gantoine in #5284
• chore(trunk): Upgrade trunk by @github-actions[bot] in #5225
• chore(deps): update github actions by @renovate[bot] in #5244
• chore(deps): bump aiohttp from 3.14.3 to 3.14.4 by @dependabot[bot] in #5276
• chore(deps-dev): bump vite from 8.3.1 to 8.3.4 in /frontend by @dependabot[bot] in #5285
• chore(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /frontend by @dependabot[bot] in #5286
• docs: list the ROM patcher env vars in env.template by @pcbeingused333 in #5265
• chore(deps): update dependency pillow to v13 [security] by @renovate[bot] in #5288
• chore(deps): update dependency storybook to v10.6.2 [security] by @renovate[bot] in #5291
• chore(deps): bump Node to 24.22.1 for the October 2026 security release by @gantoine in #5295
• fix(docker): upgrade the image's pip to 26.2.2 by @gantoine in #5298
• chore(deps): update github/codeql-action action to v4.39.0 by @renovate[bot] in #5299

New Contributors

• @pcbeingused333 made their first contribution in #5265

Full Changelog: 5.4.0...5.4.1