v4.29.0

Added

• feat: FIFO eviction for __txn_* cookies - total size capped at 3500 bytes; oldest in-flight transactions are evicted first when the limit is reached, preventing 431 Request Header Fields Too Large errors caused by unbounded accumulation #2748 (Piyush-85)

⚠️ Changed

• __txn_* cookies are now written as {timestamp}:{jwe} instead of bare {jwe}. Rolling deployments only: any login started on a v4.29.0 pod and completed on a v4.28.0 pod (or vice versa) will receive "state parameter is invalid" and the user must re-initiate login - the window is bounded by transactionCookie.maxAge (default 1 hour). To eliminate the overlap entirely, deploy v4.29.0 to all pods before accepting new logins, or shorten the TTL (transactionCookie: { maxAge: 600 }) to reduce the window. #2748 (Piyush-85)

Fixed

• fix: txn cookie accumulation #2748 (Piyush-85)
• fix: preserve multi-value query params in proxy URL builder #2834 (Piyush-85)

Summary by CodeRabbit

• Release

  • Updated the SDK to version 4.29.0.

• Bug Fixes

  • Prevented transaction cookie accumulation through FIFO eviction with a 3,500-byte limit.
  • Preserved query parameters containing multiple values when building proxy URLs.
  • Improved login-link prefetch behavior to avoid unintended login flows.

• Documentation

  • Updated the changelog and regenerated API documentation for version 4.29.0.