Skip to main content

Release 9.5.0

🔄 Migrations​

✨ Keycloak upgraded from 26.4 to 26.6.1​

The Keycloak base image has been bumped from 26.4 to 26.6.1 as part of the OpenID4VP Wallet Extension Plugin integration. The oid4vp extension v0.6.2 requires Keycloak 26.6.1 or later (it references UserAuthenticationIdentityProvider, introduced in that version).

For deployments upgrading from 9.4.x:

  1. Keycloak image: all Keycloak Dockerfiles now use quay.io/keycloak/keycloak:26.6.1. Verify your Helm/compose overrides reference the updated image.
  2. New SPI module: the idp-linking-authenticator Keycloak SPI module is included for multi-IdP user linking. If you maintain custom Keycloak provider configurations, review the new provider ID idp-linking-authenticator.
  3. Multiple certificates: Election Events now support multiple certificates. Existing single-certificate configurations continue to work without changes.

See sequentech/meta#11928 for details.

✨ Import versioning constraints​

Events can no longer be imported into a different major version. If you rely on cross-version imports, review sequentech/meta#11114 before upgrading.

✨ Prefill login and registration fields from notification links​

Voting Portal /login and /enroll routes now accept up to five bounded login_hint__<field> query parameters. A username value is also forwarded as the standard OIDC login_hint. Existing links continue to work unchanged.

For deployments enabling prefill:

  1. Notification templates: append only approved login_hint__<field> parameters. Wrap every dynamic value with the Handlebars url_encode helper. Custom Keycloak attributes are available as user.<attribute> for the first value and user.attributes.<attribute> for the complete value array. Use {{lookup user "attribute.with-dots"}} for names containing dots or dashes.
  2. Stock Keycloak registration: add the Sequent: Login hint registration prefill action as Required before the registration user-creation execution, then bind the updated registration flow to the realm.
  3. Deferred registration: leave Prefill Parameters Policy at its default IGNORE value unless the realm explicitly permits prefill. Set it to ACCEPT only after reviewing which managed, writable profile fields may appear in notification URLs.
  4. Realm rollout: update and upload the default tenant and election-event realm templates for newly created realms. Update existing realms separately; replacing a default template does not modify them.
  5. Verification: test direct /enroll, /login redirected to registration, and deferred registration. Confirm submitted form values override hints and verification or credential fields are never prefilled.

Notification delivery records and logs changed alongside this feature. The electoral log entry for a sent message now records the channel, the receiver and the rendered subject instead of the rendered message bodies, and the AWS SES, SMTP and AWS SNS transports no longer log receivers, subjects or body previews. Rendered bodies carry the notification URL, including any login_hint__* values, and the electoral log cannot be redacted once written. The console transport used by local development still prints the complete message.

Hints are editable, untrusted convenience data. Do not include passwords, one-time passwords (OTPs), tokens, secrets, government identifiers, or other inappropriate sensitive values, and never use a hint to bypass authentication or mark identity, contact details, or eligibility as verified. Percent encoding protects query structure, not confidentiality or authenticity. See sequentech/meta#12617 for details.

📝 Highlights​

✨ Keycloak and authentication enhancements​

Release 9.5.0 adds OpenID4VP Wallet Extension Plugin support, including a Keycloak version bump from 26.4 to 26.6.1. It introduces multi-IdP user linking via custom attributes, multiple certificate support per Election Event, and a policy to disable browser language detection. Keycloak also gains Catalan OTP translations and 2FA/Passkeys across all environments.

✨ Voting and election-management improvements​

IRV support continues to expand with an external hat-procedure for ties, implicit invalid vote handling policies, and improved IRV voting experience display. The Voting Portal adds expand/collapse all lists, selected-candidate indicators in collapsed lists, and voter-facing text improvements. New capabilities include a participation report, an election preview API, single PDF with all-areas election results, and paginated electoral results reports.

🛠 Platform and developer updates​

This release removes unsafe Rust code, introduces the initial extension system with WebAssembly Components, and implements the step-cli happy path with voter generation improvements. It also adds event config versioning and import constraints, along with extensive Election Managers documentation and IVR telephone voting design.

🐞 Windmill and Harvest fail to start on production deployments with AWS S3​

In AWS deployments, windmill and harvest can fail during startup while initializing the plugin manager. The failure happens when the backend tries to list plugin objects under public/plugins/ using the current S3 abstraction, where:

  • AWS_S3_PRIVATE_URI and AWS_S3_PUBLIC_URI point to a real AWS bucket URL.
  • AWS_S3_BUCKET and AWS_S3_PUBLIC_BUCKET are treated as logical prefixes like election-event-documents and public. This works against MinIO, but it breaks on AWS because list_objects_v2 must address the real bucket and use the logical bucket as part of the prefix. See sequentech/meta#11570 for details.

📋 All Changes​

🚀 Features​

🛠 Bug Fixes​

  • 🐞 Admin portal - Reorder candidates UI does not show the candidates text (sequentech/meta#12050) by @BelSequent

  • 🐞 Keycloak - When Force Default language is enabled, login screen messages disappear too quickly (sequentech/meta#12120) by @Findeton

  • 🐞 Keycloak: Doesn't show SSO providers in deferred login mode (sequentech/meta#12125) by @xalsina-sequent

  • 🐞 Voting Portal - Overvote policy not disabling other list from being selected (sequentech/meta#12048) by @BelSequent

  • 🐞 Voting portal - Event localization override not working for alerts and errors if ballot styles are missing (sequentech/meta#11925) by @xalsina-sequent

  • 🐞 Step-Cli not compiling (sequentech/step#2647) by @Findeton

  • 🐞 Windmill and Harvest fail to start on production deployments with AWS S3 (sequentech/meta#11570) by @Findeton

  • 🐞 Windmill: Github action keeps failing (sequentech/meta#10956) by @oded-eid-sequentech, @Findeton

  • 🐞 Broken sequent-core WASM package (sequentech/meta#11089) by @Findeton

  • 🐞 Admin Portal > Electoral Logs > Timestamp filter does not work (sequentech/meta#9995) by @BelSequent

  • 🐞 Tally > Election aliases not used (sequentech/meta#8426) by @xalsina-sequent, @BelSequent

📖 Documentation​

Other Changes​