Skip to main content

Release 9.5.0

🔄 Migrations​

✨ Keycloak upgraded from 26.4 to 26.6.1​

The Keycloak base image has been bumped from 26.4 to 26.6.1 as part of the OpenID4VP Wallet Extension Plugin integration. The oid4vp extension v0.6.2 requires Keycloak 26.6.1 or later (it references UserAuthenticationIdentityProvider, introduced in that version).

For deployments upgrading from 9.4.x:

  1. Keycloak image: all Keycloak Dockerfiles now use quay.io/keycloak/keycloak:26.6.1. Verify your Helm/compose overrides reference the updated image.
  2. New SPI module: the idp-linking-authenticator Keycloak SPI module is included for multi-IdP user linking. If you maintain custom Keycloak provider configurations, review the new provider ID idp-linking-authenticator.
  3. Multiple certificates: Election Events now support multiple certificates. Existing single-certificate configurations continue to work without changes.

See sequentech/meta#11928 for details.

✨ Import versioning constraints​

Events can no longer be imported into a different major version. If you rely on cross-version imports, review sequentech/meta#11114 before upgrading.

📝 Highlights​

✨ Keycloak and authentication enhancements​

Release 9.5.0 adds OpenID4VP Wallet Extension Plugin support, including a Keycloak version bump from 26.4 to 26.6.1. It introduces multi-IdP user linking via custom attributes, multiple certificate support per Election Event, and a policy to disable browser language detection. Keycloak also gains Catalan OTP translations and 2FA/Passkeys across all environments.

✨ Voting and election-management improvements​

IRV support continues to expand with an external hat-procedure for ties, implicit invalid vote handling policies, and improved IRV voting experience display. The Voting Portal adds expand/collapse all lists, selected-candidate indicators in collapsed lists, and voter-facing text improvements. New capabilities include a participation report, an election preview API, single PDF with all-areas election results, and paginated electoral results reports.

🛠 Platform and developer updates​

This release removes unsafe Rust code, introduces the initial extension system with WebAssembly Components, and implements the step-cli happy path with voter generation improvements. It also adds event config versioning and import constraints, along with extensive Election Managers documentation and IVR telephone voting design.

🐞 Windmill and Harvest fail to start on production deployments with AWS S3​

In AWS deployments, windmill and harvest can fail during startup while initializing the plugin manager. The failure happens when the backend tries to list plugin objects under public/plugins/ using the current S3 abstraction, where:

  • AWS_S3_PRIVATE_URI and AWS_S3_PUBLIC_URI point to a real AWS bucket URL.
  • AWS_S3_BUCKET and AWS_S3_PUBLIC_BUCKET are treated as logical prefixes like election-event-documents and public. This works against MinIO, but it breaks on AWS because list_objects_v2 must address the real bucket and use the logical bucket as part of the prefix. See sequentech/meta#11570 for details.

📋 All Changes​

🚀 Features​

🛠 Bug Fixes​

  • 🐞 Admin portal - Reorder candidates UI does not show the candidates text (sequentech/meta#12050) by @BelSequent

  • 🐞 Keycloak - When Force Default language is enabled, login screen messages disappear too quickly (sequentech/meta#12120) by @Findeton

  • 🐞 Keycloak: Doesn't show SSO providers in deferred login mode (sequentech/meta#12125) by @xalsina-sequent

  • 🐞 Voting Portal - Overvote policy not disabling other list from being selected (sequentech/meta#12048) by @BelSequent

  • 🐞 Voting portal - Event localization override not working for alerts and errors if ballot styles are missing (sequentech/meta#11925) by @xalsina-sequent

  • 🐞 Step-Cli not compiling (sequentech/step#2647) by @Findeton

  • 🐞 Windmill and Harvest fail to start on production deployments with AWS S3 (sequentech/meta#11570) by @Findeton

  • 🐞 Windmill: Github action keeps failing (sequentech/meta#10956) by @oded-eid-sequentech, @Findeton

  • 🐞 Broken sequent-core WASM package (sequentech/meta#11089) by @Findeton

  • 🐞 Admin Portal > Electoral Logs > Timestamp filter does not work (sequentech/meta#9995) by @BelSequent

  • 🐞 Tally > Election aliases not used (sequentech/meta#8426) by @xalsina-sequent, @BelSequent

📖 Documentation​

Other Changes​