v2.11.0

Zaparoo Core v2.11.0 is out with optional Launch Guard for accidental scan protection, PixelCade LED marquee support, RePlayOS support, faster media library reindexing, and MiSTer updates for custom cores and DualRAM launchers.

This release also adds **launch.last for re-launching recently played games, improves filename parsing and title matching, and tightens a few security defaults. If you use allow_execute or remote API/run endpoints, check the compatibility note before updating.

v2.11.0-beta4

What's Changed

• fix(readers): improve external drive and service lifecycle by @wizzomafizzo in #739
• fix: publish signed update manifests and restore native CI coverage by @wizzomafizzo in #741
• fix: stabilize native service CI tests by @wizzomafizzo in #742

Full Changelog: v2.11.0-beta3...v2.11.0-beta4

v2.11.0-beta3

What's Changed

• feat(database): filename parser, tag counts, title strategies, and scanner improvements by @wizzomafizzo in #718
• fix(helpers): preserve custom URI escapes for fuzz regressions by @wizzomafizzo in #721
• fix(publishers): use media filenames for PixelCade requests by @wizzomafizzo in #722
• feat: MediaDB Media and Title Persistence by @BossRighteous in #666
• build(deps): bump golang.org/x/text from 0.35.0 to 0.36.0 by @dependabot[bot] in #734
• build(deps): bump golangci/golangci-lint-action from 7.0.1 to 9.2.0 by @dependabot[bot] in #733
• build(deps): bump github.com/rivo/tview from 0.0.0-20250625164341-a4a78f1e05cb to 0.42.0 by @dependabot[bot] in #732
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #731
• build(deps): bump fyne.io/systray from 1.11.0 to 1.12.0 by @dependabot[bot] in #730
• build(deps): bump codecov/codecov-action from 4.6.0 to 6.0.0 by @dependabot[bot] in #726
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1 by @dependabot[bot] in #728
• build(deps): bump github.com/gdamore/tcell/v2 from 2.8.1 to 2.13.9 by @dependabot[bot] in #729
• fix(helpers): relax URI decode fuzz invariant by @wizzomafizzo in #736
• fix(mister): add CA bundle fallback by @wizzomafizzo in #738
• build(deps): bump github.com/getsentry/sentry-go from 0.45.1 to 0.46.0 by @dependabot[bot] in #727

Full Changelog: v2.11.0-beta2...v2.11.0-beta3

v2.11.0-beta2

What's Changed

• fix(ci): update GitHub Actions to Node.js 24 by @wizzomafizzo in #689
• fix(launchers): log argv after SplitCommand at both call sites by @wizzomafizzo in #694
• build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #695
• build(deps): bump go.etcd.io/bbolt from 1.4.0 to 1.4.3 by @dependabot[bot] in #704
• build(deps): bump github.com/mattn/go-sqlite3 from 1.14.28 to 1.14.42 by @dependabot[bot] in #703
• build(deps): bump github.com/go-chi/cors from 1.2.1 to 1.2.2 by @dependabot[bot] in #702
• build(deps): bump github.com/getsentry/sentry-go from 0.45.0 to 0.45.1 by @dependabot[bot] in #701
• build(deps): bump github.com/mackerelio/go-osstat from 0.2.6 to 0.2.7 by @dependabot[bot] in #700
• build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #699
• build(deps): bump signpath/github-action-submit-signing-request from 2.1 to 2.2 by @dependabot[bot] in #698
• build(deps): bump docker/build-push-action from 6.19.2 to 7.1.0 by @dependabot[bot] in #697
• build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @dependabot[bot] in #696
• feat(replayos): add RePlayOS platform integration by @wizzomafizzo in #692
• fix(mediascanner): fix media index hang on resume from interrupted run by @wizzomafizzo in #705
• fix(mediascanner): fix media index hang on resume from interrupted run by @wizzomafizzo in #707
• fix(helpers): fix DecodeURIIfNeeded idempotence for '?' and '#' in URIs by @wizzomafizzo in #708
• feat(mister): add RBF disambiguation cache and load_path config override by @wizzomafizzo in #709
• feat(mister): add DualRAM alt launchers for 3DO, Jaguar, PSX, Saturn by @wizzomafizzo in #711
• feat(database): tag taxonomy update, storage padding, and alias canonicalization by @wizzomafizzo in #713
• fix(helpers): fix DecodeURIIfNeeded idempotence for literal '%' in URIs by @wizzomafizzo in #714

Full Changelog: v2.11.0-beta1...v2.11.0-beta2

v2.11.0-beta1

What's Changed

• docs(api): add missing method docs for new endpoints by @wizzomafizzo in #591
• fix(build): redirect update asset downloads to GitHub releases by @wizzomafizzo in #592
• feat(readers): add launch guard for game change protection by @wizzomafizzo in #597
• fix(api): various API correctness and screenshot reliability fixes by @wizzomafizzo in #599
• feat(readers): add PN532 I2C auto-detection by @wizzomafizzo in #603
• fix: Sentry error cleanup and error classification by @wizzomafizzo in #605
• feat(publishers): add PixelCade publisher and Publisher interface by @wizzomafizzo in #594
• fix: remove GOMEMLIMIT to prevent GC CPU thrashing on high-core systems by @wizzomafizzo in #606
• fix(readers): remove legacy pn532uart driver by @wizzomafizzo in #607
• fix(ui): use cmd /c start instead of explorer for systray open actions on Windows by @wizzomafizzo in #608
• feat(daemon): copy service binary to DataDir instead of tmpfs by @wizzomafizzo in #610
• feat(mediascanner): pause media indexing while a game is running by @wizzomafizzo in #612
• feat(zapscript): add launch.last command by @wizzomafizzo in #613
• chore: add Dependabot config by @wizzomafizzo in #616
• build(deps): bump golang.org/x/image from 0.28.0 to 0.38.0 by @dependabot[bot] in #614
• build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 by @dependabot[bot] in #615
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #617
• build(deps): bump actions/cache from 4 to 5 by @dependabot[bot] in #618
• build(deps): bump R-J-dev/bunny-deploy from 2.1.1 to 3.0.0 by @dependabot[bot] in #619
• build(deps): bump actions/create-github-app-token from 1 to 3 by @dependabot[bot] in #620
• build(deps): bump EndBug/add-and-commit from 9 to 10 by @dependabot[bot] in #622
• build(deps): bump github.com/shirou/gopsutil/v4 from 4.25.11 to 4.26.3 by @dependabot[bot] in #621
• build(deps): bump github.com/olahol/melody from 1.2.1 to 1.4.0 by @dependabot[bot] in #623
• build(deps): bump github.com/go-playground/validator/v10 from 10.28.0 to 10.30.2 by @dependabot[bot] in #624
• build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 by @dependabot[bot] in #625
• build(deps): bump github.com/pressly/goose/v3 from 3.24.3 to 3.27.0 by @dependabot[bot] in #626
• feat(updater): add beta update channel with schema version guard by @wizzomafizzo in #627
• ci: harden workflows with pinned SHAs and explicit permissions by @wizzomafizzo in #629
• ci: add CodeQL code scanning by @wizzomafizzo in #631
• feat(api): add PAKE pairing and AES-256-GCM WebSocket encryption by @wizzomafizzo in #630
• ci: add OpenSSF Scorecard workflow by @wizzomafizzo in #632
• ci: add dependency review workflow by @wizzomafizzo in #633
• ci: add SBOM generation and artifact attestations to releases by @wizzomafizzo in #634
• Add license deny list to dependency review by @wizzomafizzo in #638
• feat: encryption feedback - pairing CLI, docs rewrite by @wizzomafizzo in #639
• chore: update README to remove nightly builds section by @wizzomafizzo in #640
• perf(daemon): skip service binary copy when unchanged by @wizzomafizzo in #654
• build(deps): bump signpath/github-action-submit-signing-request from 2.0 to 2.1 by @dependabot[bot] in #643
• build(deps): bump actions/checkout from 4.3.1 to 6.0.2 by @dependabot[bot] in #644
• build(deps): bump dev-drprasad/delete-older-releases from 0.3.0 to 0.3.4 by @dependabot[bot] in #645
• build(deps): bump github.com/getsentry/sentry-go/zerolog from 0.40.0 to 0.45.0 by @dependabot[bot] in #646
• build(deps): bump akhilmhdh/contributors-readme-action from 2.3.10 to 2.3.11 by @dependabot[bot] in #647
• build(deps): bump github.com/godbus/dbus/v5 from 5.2.0 to 5.2.2 by @dependabot[bot] in #648
• build(deps): bump actions/setup-go from 5.6.0 to 6.4.0 by @dependabot[bot] in #649
• build(deps): bump github.com/fsnotify/fsnotify from 1.6.0 to 1.9.0 by @dependabot[bot] in #651
• build(deps): bump github.com/clausecker/nfc/v2 from 2.1.4 to 2.2.0 by @dependabot[bot] in #652
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.3 to 2.3.0 by @dependabot[bot] in #650
• feat(zapscript): harden execution pipeline by @wizzomafizzo in #656
• refactor(config): add LoadTOML, remove SetXxxForTesting methods by @wizzomafizzo in #657
• build(deps): bump github.com/ZaparooProject/go-pn532 from 0.21.0 to 0.21.1 by @wizzomafizzo in #658
• fix: ZapLink size limit, signed checksum updater verification, execute process hardening by @wizzomafizzo in #660
• fix(input): Sensitive input sequences are logged in plaintext by @tomaioo in #659
• fix(ci): truncate debug log that stalls GitHub Actions runner by @wizzomafizzo in #661
• fix(service): add context cancellation to itq channel sends in readerManager by @wizzomafizzo in #663
• fix(api): use ASCII field names and string coordinates in PAKE wire format by @wizzomafizzo in #664
• feat(test): add fuzz tests for attacker-reachable code paths and nightly CI by @wizzomafizzo in #665
• build(deps): upgrade go-zapscript to v0.7.1 by @wizzomafizzo in #669
• fix(mister): add LLAPISuperGrafx launcher for .sgx files on LLAPI cores by @wizzomafizzo in #670
• fix(mister): increase Saturn MGL delay and fix cross-compilation by @wizzomafizzo in #671
• fix(windows): hold mode with RetroBat and relative config paths by @wizzomafizzo in #674
• fix(api): add HKDF transcript salt and fix API doc inaccuracies by @wizzomafizzo in #676
• feat(audio): add volume setting and preserve external config edits by @wizzomafizzo in #678
• feat(config): add enabled field to reader connections by @wizzomafizzo in #679
• fix(readers): speed up PN532 I2C auto-detect with parallel bus probing by @wizzomafizzo in #680
• fix(helpers): resolve fuzz crashes in DecodeURIIfNeeded and FilenameFromPath by @wizzomafizzo in #681
• fix(mediascanner): skip macOS junk files and throttle indexing notifications by @wizzomafizzo in #683
• fix(ci): handle branch protection in contributors workflow and fix Windows test paths by @wizzomafizzo in #684
• docs(contributor): contributors readme action update by @zaparoo-automation-bot[bot] in #685
• fix(ci): grant missing permissions for lint-and-test reusable workflow by @wizzomafizzo in #686
• fix(ci): remove lint-and-test from build workflow for SignPath compatibility by @wizzomafizzo in #687

New Contributors

• @dep...

v2.10.0

What's Changed

• feat(api): add media history, lookup, control endpoints and MediaDB performance by @wizzomafizzo in #543
• feat(api): add auth.toml credential claim and apply to all HTTP paths by @wizzomafizzo in #546
• feat: add self-update system with graceful restart by @wizzomafizzo in #547
• fix(mediascanner): prevent indefinite hangs on stale network mounts by @wizzomafizzo in #549
• perf(mediascanner): use fastwalk for parallel directory walking by @wizzomafizzo in #550
• feat: add Kodi and RetroArch playback controls by @wizzomafizzo in #554
• fix(zapscript): normalize path prefix in launch.random command by @wizzomafizzo in #555
• feat(batocera): enrich custom launchers with ES overlay config by @wizzomafizzo in #556
• fix(ndef): support long NDEF records in tag parsing by @wizzomafizzo in #557
• fix: convert launcher paths to OS-native format by @wizzomafizzo in #558
• feat(database): disambiguate ZapScript tags by sibling comparison by @wizzomafizzo in #559
• feat(config): add ignore_on_connect option to suppress initial reader scans by @wizzomafizzo in #560
• feat(batocera): add .squashfs and .zcci extensions for 3DS by @wizzomafizzo in #562
• fix(database): add fallback systems for media types by @wizzomafizzo in #564
• feat(pn532): skip re-probing failed serial ports by @wizzomafizzo in #563
• feat(api): return relative paths with system ID in media.search and media.lookup by @wizzomafizzo in #565
• fix: selectively downgrade expected errors from Error to Warn by @wizzomafizzo in #568
• feat(tui): add first-run error reporting opt-in prompt by @wizzomafizzo in #566
• feat(bench): add benchmark infrastructure and optimization targets by @wizzomafizzo in #569
• perf: optimize media indexing pipeline for ARM by @wizzomafizzo in #572
• perf(mediadb): add trigram index and system-range sorting to slug search cache by @wizzomafizzo in #573
• feat(api): add media.browse endpoint by @wizzomafizzo in #577
• feat(api): add input.keyboard and input.gamepad endpoints by @wizzomafizzo in #578
• feat(api): add cross-platform screenshot endpoint and ZapScript command by @wizzomafizzo in #579
• feat(zapscript): add mister.wallpaper command by @wizzomafizzo in #580
• fix(helpers): remove backslash escape from SplitCommand by @wizzomafizzo in #582
• feat(mister): add 3DO core support by @wizzomafizzo in #583
• fix: audio crash resilience, tag matching, and mediadb query performance by @wizzomafizzo in #584
• fix(zapscript): add filesystem fallback for launch.random absolute paths by @wizzomafizzo in #585
• fix(mister): write CURRENTPATH/FULLPATH for arcade .mra launches by @wizzomafizzo in #586
• feat(mister): add Jaguar CD core support by @wizzomafizzo in #588
• fix(build): add retry logic to doc download in makezip by @wizzomafizzo in #590

Full Changelog: v2.9.1...v2.10.0

v2.10.0-beta2

What's Changed

• fix(helpers): remove backslash escape from SplitCommand by @wizzomafizzo in #582
• feat(mister): add 3DO core support by @wizzomafizzo in #583
• fix: audio crash resilience, tag matching, and mediadb query performance by @wizzomafizzo in #584
• fix(zapscript): add filesystem fallback for launch.random absolute paths by @wizzomafizzo in #585
• fix(mister): write CURRENTPATH/FULLPATH for arcade .mra launches by @wizzomafizzo in #586

Full Changelog: v2.10.0-beta1...v2.10.0-beta2

v2.10.0-beta1

What's Changed

• feat(api): add media history, lookup, control endpoints and MediaDB performance by @wizzomafizzo in #543
• feat(api): add auth.toml credential claim and apply to all HTTP paths by @wizzomafizzo in #546
• feat: add self-update system with graceful restart by @wizzomafizzo in #547
• fix(mediascanner): prevent indefinite hangs on stale network mounts by @wizzomafizzo in #549
• perf(mediascanner): use fastwalk for parallel directory walking by @wizzomafizzo in #550
• feat: add Kodi and RetroArch playback controls by @wizzomafizzo in #554
• fix(zapscript): normalize path prefix in launch.random command by @wizzomafizzo in #555
• feat(batocera): enrich custom launchers with ES overlay config by @wizzomafizzo in #556
• fix(ndef): support long NDEF records in tag parsing by @wizzomafizzo in #557
• fix: convert launcher paths to OS-native format by @wizzomafizzo in #558
• feat(database): disambiguate ZapScript tags by sibling comparison by @wizzomafizzo in #559
• feat(config): add ignore_on_connect option to suppress initial reader scans by @wizzomafizzo in #560
• feat(batocera): add .squashfs and .zcci extensions for 3DS by @wizzomafizzo in #562
• fix(database): add fallback systems for media types by @wizzomafizzo in #564
• feat(pn532): skip re-probing failed serial ports by @wizzomafizzo in #563
• feat(api): return relative paths with system ID in media.search and media.lookup by @wizzomafizzo in #565
• fix: selectively downgrade expected errors from Error to Warn by @wizzomafizzo in #568
• feat(tui): add first-run error reporting opt-in prompt by @wizzomafizzo in #566
• feat(bench): add benchmark infrastructure and optimization targets by @wizzomafizzo in #569
• perf: optimize media indexing pipeline for ARM by @wizzomafizzo in #572
• perf(mediadb): add trigram index and system-range sorting to slug search cache by @wizzomafizzo in #573
• feat(api): add media.browse endpoint by @wizzomafizzo in #577
• feat(api): add input.keyboard and input.gamepad endpoints by @wizzomafizzo in #578
• feat(api): add cross-platform screenshot endpoint and ZapScript command by @wizzomafizzo in #579
• feat(zapscript): add mister.wallpaper command by @wizzomafizzo in #580

Full Changelog: v2.9.1...v2.10.0-beta1

v2.9.1

What's Changed

• feat(tui): replace termbin with self-hosted log upload service by @wizzomafizzo in #500
• feat(mediascanner): add lazy loading for resume and centralize composite keys by @wizzomafizzo in #511
• refactor: improve nested playlist command handling by @wizzomafizzo in #513
• feat(mister): installer context propagation and MGL improvements by @wizzomafizzo in #516
• feat: Added Github Issue forms by @Anime0t4ku in #519
• refactor(logging): improve log quality and add mDNS retry by @wizzomafizzo in #501
• fix(readers): preserve prevToken on reader error to prevent false re-scans by @wizzomafizzo in #520
• fix(publishers): add connection retry to MQTT publisher by @wizzomafizzo in #521
• fix(mediascanner): load tag maps during selective indexing to prevent silent tag loss by @wizzomafizzo in #522
• fix(api): refresh launcher cache on settings reload and fix disk reload by @wizzomafizzo in #523
• fix(audio): add Player interface, file cache, and fix feedback sound bugs by @wizzomafizzo in #524
• fix: normalize VDF keys to lowercase for case-insensitive lookups by @wizzomafizzo in #525
• fix(batocera): skip hotkeygen exit when no launcher is active by @wizzomafizzo in #528
• fix(readers): clear PN532 detection cache on close by @wizzomafizzo in #529
• fix(mister): embed ArcadeDB CSV as fallback for offline first boot by @wizzomafizzo in #530
• fix(mediascanner): add diagnostic logging and tests for custom launcher file matching by @wizzomafizzo in #531
• fix(readers): libnfc connection strings, double-close race, and NTP false wake by @wizzomafizzo in #532
• docs: tidy up documentation and fix scan behavior bugs by @wizzomafizzo in #533
• refactor: remove duplicate zapscript code after go-zapscript migration by @wizzomafizzo in #534
• fix(mediascanner): isolate SkipFilesystemScan scanners to prevent file wipe by @wizzomafizzo in #536
• fix: select most specific launcher instead of first match by @wizzomafizzo in #537

Full Changelog: v2.9.0...v2.9.1

v2.9.1-beta1

What's Changed

• feat(tui): replace termbin with self-hosted log upload service by @wizzomafizzo in #500
• feat(mediascanner): add lazy loading for resume and centralize composite keys by @wizzomafizzo in #511
• refactor: improve nested playlist command handling by @wizzomafizzo in #513
• feat(mister): installer context propagation and MGL improvements by @wizzomafizzo in #516
• feat: Added Github Issue forms by @Anime0t4ku in #519
• refactor(logging): improve log quality and add mDNS retry by @wizzomafizzo in #501
• fix(readers): preserve prevToken on reader error to prevent false re-scans by @wizzomafizzo in #520
• fix(publishers): add connection retry to MQTT publisher by @wizzomafizzo in #521
• fix(mediascanner): load tag maps during selective indexing to prevent silent tag loss by @wizzomafizzo in #522
• fix(api): refresh launcher cache on settings reload and fix disk reload by @wizzomafizzo in #523
• fix(audio): add Player interface, file cache, and fix feedback sound bugs by @wizzomafizzo in #524
• fix: normalize VDF keys to lowercase for case-insensitive lookups by @wizzomafizzo in #525
• fix(batocera): skip hotkeygen exit when no launcher is active by @wizzomafizzo in #528
• fix(readers): clear PN532 detection cache on close by @wizzomafizzo in #529
• fix(mister): embed ArcadeDB CSV as fallback for offline first boot by @wizzomafizzo in #530
• fix(mediascanner): add diagnostic logging and tests for custom launcher file matching by @wizzomafizzo in #531

Full Changelog: v2.9.0...v2.9.1-beta1