Bug Fixes 6

• Apply log level filtering and masking to OTEL log exports (#12997)

  Ensures configured log levels and masking keys are applied to OpenTelemetry log exports. Previously, OTEL handlers reported all levels as enabled, potentially exposing debug data and unmasked attributes in production environments.

  Observability OTEL
• Reduced latency in session creation by dropping user search triggers (#13027, #9635, #6537)

  Improves performance by skipping user search triggers during session creation via the v2 beta service and SAML. This resolves high latency and mutual exclusion issues during parallel requests using login names.

  Session V2 Service SAML
• Enforce browser size limits for session cookies to prevent 'session expired' errors (#12995, #12968, #12656, #12735, #12520)

  Enforces a 3800-byte limit on the session HTTP-only cookie to prevent browsers from dropping cookies that exceed the 4096-byte header limit. Includes an eviction policy for expired or least recently changed entries.

  Login V2 UI/UX
• Replace deepmerge with internal utility in i18n message merging (#13013, #13012)

  Replaces the `deepmerge` dependency with an internal utility to address security audit flags. The new implementation skips prototype/constructor keys for improved security.

  Login UI Internationalization
• Make email addresses case-insensitive for improved user lookup (#12571, #12025)

  Updates email comparison to be case-insensitive in Login V2, resolving issues where mobile keyboard auto-capitalization prevented user lookup or domain discovery.

  Login V2 Domain Discovery
• Fix nil pointer dereference in debug logging for event execution (#12996, #12045)

  Fixes a critical nil pointer dereference panic in the River job queue logger that occurred when debug logging was enabled (or when info was enabled with OTEL).

  Actions v2 Logging