v2026.13

It's spooky month! And we've got a fresh batch of new features for you! Most of what's below came straight out of client feedback from the first events run on 2026.11 and planning on 2026.12, plus a long security pass that we'd promised ourselves since July. There's also a quiet theme running through it: a lot of things that used to live in Discord, a spreadsheet, or a shared password doc now live in Midsummer.

Three new staff tools ship that we can enable per-account, so nothing new shows up in your Staff module until we switch it on for your org. Ask us!

Register

• Frontline Check-In. A new, chromeless check-in station built for the door. One big search box, always focused, fed by keyboard, wedge scanner, webcam QR, or a tethered kiosk. It searches every form in the event at once and never loads a form's full registration list, so it's fast on day one of a large con. An exact badge or QR hit opens the registrant straight away; a fuzzy name match never does. Pair it to a tether-mode kiosk and it picks up that kiosk's name and form scope automatically. Find it under Register → Frontline Check-In.
• Badge labels, rebuilt. Label templates now use real physical units. Millimeters for the label, points for fonts, percentages for element placement instead of the old "mm times two, sort of" scheme. Existing templates convert automatically. The two separate label editors are now one shared editor, and the badge-print step, the check-in test badge, and the editor preview all render from the same code so what you see is what prints.
• Badges can now be rendered server-side as a PNG, both as an editor preview and as badge.png per registration, for events whose printers need it.
• Watch list copy. Copy an event's name watch list to another event in your org with one click. Names already present on the target are skipped, case-insensitively.
• Merch items are now built with the shared form builder, so the options editor behaves like every other form editor in the app.
• The registration edit flow only accepts values for fields the registrant is actually allowed to edit; everything else keeps its stored value.

Forms

• Server-side form validation. Every form definition an admin saves, and every submission an attendee, vendor, panelist, shopper or staffer sends, is now checked against the server's own copy of the form: required fields, choice lists, types, signature images. The client can no longer hand us a form that says required: false on something you marked required.
  • This function ships in logging mode by default. Problems are recorded, not rejected. We're not forcing it mandatory until we do some checks to make sure it doesn't mess anything up.
• Form editor redesign. One shared builder now powers every form editor. Registration forms, check-in procedures, panel forms, vendor forms and tasks, shop items, onboarding flows, merch options and the new staff agreement. A grouped palette on the left, draggable field cards in the middle, an inspector on the right, a Preview toggle that runs the required-field check without submitting anything, and a dirty indicator on Save. Collapses to dialogs on narrow screens.
• Inline errors. Validation problems, client or server, now show under the field they belong to and the page jumps to the first one on registration, vendor, panel, shop and onboarding forms alike.
• Three long-standing form bugs fixed while we were in there: adding two fields of the same type no longer lets configuring one silently change the other, the signature pad redraws a stored signature instead of showing blank, and a required checkbox actually has to be checked.
• Typed custom fields. Custom fields (inventory, membership profiles) gain number, currency, URL and multi-select types, values are type-checked, and errors come back per field instead of as one flat list. The custom-field core is now shared across modules.

Staff

• Staff Hotel Rooms (feature flag) - staff create one room request per event with preferred dates inside an admin-set window, then group up by sharing their Member ID. Admins get a room management page: occupancy, roster add/remove/move, per-room hotel and room-number assignment, a waitlist, room merging, and locks for "no new requests" and "no more swapping".
• Staff Wiki (feature flag) - a Notion-style wiki inside the Staff module. Hierarchical pages, a WYSIWYG editor with real-time multi-user editing (live cursors, concurrent edits merge), revision history, image embeds, search, an event-wide General space plus one per department, and public share links that publish a single page to anyone with the URL.
• Staff Password Manager (feature flag) - a shared credential vault for the logins that otherwise get pasted into chat: social accounts, vendor portals, hotel tools. Entries are encrypted at rest with a key independent of the app secret, owned by a person or a department, shared with viewer / editor / manager roles, and every reveal requires re-authentication and writes an audit row.
• Staff Agreement - an optional per-event agreement, built with the same form builder as onboarding, that every roster member must sign before they count as active staff. Unsigned members see only the agreement prompt on their dashboard. Editing the form bumps a version and you choose whether everyone has to re-sign. Rosters and the HR Staff Members list show who's still pending. Carries over with the event wizard.
• Application Status page for HR and Staff Module Admins. See where every staff application sits in the hiring flow, with a separate table for applications that have left it (declined or fully onboarded).
• HR placement confirmation. Approving an application now asks HR to confirm – and lets them change – the department and rank the applicant lands in. The placement is recorded on the application, not just the audit log, so the status page shows where people actually ended up.
• Inactive department members. Leadership and HR can mark a deputy, staff member or volunteer inactive in one department without removing them. They keep their history, titles and timesheets, but lose that department's permissions, shift self-service, chat room and planner assignability. Reactivate any time; both transitions are audit-logged.
• HR tags. An event-scoped tag catalog (name, color, description) HR can pin on individual staff members, with an optional private note per assignment. Shown as chips and a filter on Staff Members and in the profile modal. Visible only to staff-module admins; nobody below that tier ever receives tag data.
• Staff registration history. The profile modal and the Staff Members list now show a check mark per past event where the person held a paid registration on that event's staff form, so "have they staffed before?" is one glance.
• Onboarding flows can target roles. A flow can be restricted to specific department roles (oversight, lead, second, deputy, staff, volunteer), and onboarding records are now assigned automatically on every path that adds someone to a roster – invitations, HR approval, transfers, and direct roster edits – instead of needing a manual regenerate.
• Staff invitation e-mails now look like the rest of the system's mail, and the subject and body can be customized per event.
• Audit log pagination actually paginates now; it used to show page one forever.
• Time clock kiosk. The result screen shows an honest "Returning in N seconds" countdown, and an abandoned confirm screen self-cancels after 45 seconds so nobody's punch sits armed for the next walk-up.

Schedule

• Guest panelists. Add panelists who don't have a Midsummer account by name. They show up after the registered names everywhere: the public slots API, ICS feed, digital signage and the panel page. Panelists can add them to their own panels; admins to any.
• Panel edit dialogs on the responses and check-in pages now render with the schedule component set, so the basic-details element no longer errors.
• The basic-details element uses your event's noun ("Panel", "Event", whatever you configured) instead of always saying Panel.
• Track color picker is inline with a hex box, so it no longer gets clipped or closes when you scroll.
• Fixed white-on-white description boxes on the responses page.
• Grid view column headers line up again when a room name is long.

Vendors

• The Register for Event task now lets you pick which registration form it points at, instead of a form hard-coded for one event, and "has a paid registration" is scoped to the vendor type's event. Existing tasks keep working and show the new picker.
• Sending a status e-mail from vendor check-in now asks for confirmation first — it goes straight to the vendor and can't be recalled.
• Fixed the separate-table-payment settings read returning (and overwriting) an arbitrary event's Stripe configuration when more than one event had it configured.
• A vendor whose first Checkout succeeded can no longer be charged a second time by returning through a second session.
• Fixed a 500 on the first read of a vendor property that hadn't been written yet, and a case where raw request bytes were stored as a string repr.

Shop

• Fulfillment QR links in e-mails are now signed, so a leaked fulfillment ID alone is no longer enough to redeem someone's merch. Old unsigned links still work; a setting lets you require signatures once they've aged out of inboxes.
• Fixed order finalization crashing under the Stripe SDK 15 object API.

Accounts & Security

• Step-up re-authentication. Adding or removing a passkey or authenticator now asks you to confirm it's you (password, or a current authenticator code) within a five-minute window, so a stolen session cookie can't strip your factors and enroll its own.
• Passkey sign-in now requires user verification on the authenticator.
• Login rate limiting on password, password-reset and resend-verification endpoints, per client and per account, with counters that survive restarts and are shared across workers.
• Event-scoped permissions everywhere. A sweep across Register, Vendors, Schedule, Shop and Staff removed every remaining permission check that answered for the whole tenant instead of the current event. A role at one event no longer carries to another. The old blind page-permission decorator is gone, and a test pins the set of ungated pages so a new one can't slip in unnoticed.
• Anonymous callers hitting a gated endpoint now get a proper 403 instead of a 500.

Tenant & Platform

• One event-admin roster. "Who administers this event" is now answered in exactly one place: the Tenant UI Users page, where owners edit each member's event access. Org owners administer every event implicitly, so people wearing both hats no longer need to be on two lists. The event app's Event Admins tab is read-only and links to the portal.
• Self-service billing. Tenant admins can open their own Stripe Billing Portal for cards, invoices and billing contact. The Billing page's usage tiles, invoice table and payment method now show real data (or an honest empty state); the placeholder numbers are gone.
• Contact info — enter your org's e-mail, phone, website and mailing address under tenant Settings, and every event page shows a Contact link in a new footer that opens it.
• Event wizard: a confirmation before discarding six steps of input, and the option to transfer the password manager's credentials to the new event.
• Self-serve signup lands you in your new portal automatically, with a fallback link if the hand-off fails.
• Outbound e-mail links are now built on a host that actually serves the event. Orgs whose primary domain was their management portal were sending registrants links that bounced to the tenant login page.

UI

• Instant navigation. Sidebar and submenu links that point at SPA routes now navigate in-app instead of doing a full page load, and the current module shows as a breadcrumb in the header.
• Accessibility pass. Every icon-only button across Register, Inventory, Schedule, Chat and the kiosk pages now carries a label and tooltip; tables got empty-state messages instead of blank space.
• Check-in stat tiles show a placeholder until the numbers load instead of flashing "0", status chips mark exceptions rather than every row, and wide tables scroll inside the page instead of pushing it sideways.

API

• Environment and discovery endpoints under /api/v2026-01/ no longer take a subdomain in the path. They always resolved from the request host anyway, and the parameter was the one place cross-tenant enumeration was possible. The old URLs still work as aliases.
• Per-token rate limiting on the v2026-01 Event Data API.
• The OpenAPI schema, Swagger and ReDoc pages are now gated the way the comment above them always claimed they were.

Docs

• New setup walkthroughs in the user docs: new event, Register, Schedule, Staff, Vendors, Shop and Inventory, end to end.

Bugfixes

• Fixed shop form inputs refusing all typing when the field declared no options.
• Fixed the event settings save rejecting the very event admins it was meant to allow.
• Fixed HQ feature-flag changes failing when made from the platform host.
• Fixed a negative merch quantity slipping through on a registration (the new validator catches it).
• Fixed an esbuild out-of-memory crash on large UI builds.

That's the release. Thanks to everyone who filed feedback from their first 2026.12 event — most of this list is yours. Enjoy your show! 🎉