There is 1 open security issue in trixie.
There are 6 open security issues in bullseye.
There are 5 open security issues in bookworm.
You can find information about how to handle these issues in the security team's documentation.
There are 6 open security issues in buster.
commit 5f05321422f3abcbdff74e3fdddae1e6a2197751
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 21:40:48 2026 +0300
some archs require libdb-dev still
commit 64132c22285271179e4ed68a4ed41dd446143e97
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 20:49:42 2026 +0300
Drop old vendoring cruft.
commit 28ab1f56dfba7063276f9de45b45c787da67df86
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 20:48:07 2026 +0300
control: Drop unnecessary direct python dependencies from python3- lib389.
commit 1e89f93ffeca97056bda3daa582512907cfd2b45
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 20:43:31 2026 +0300
control: Drop python3-packaging from (build-)depends.
commit d4f6babb5b13158c9b4ea57d3dfa1ff95ca16dc0
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 20:42:48 2026 +0300
rules: Don't clean Cargo.toml.orig-files.
commit 05473d15b3bef30f1a416434240d377ebc757b48
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 20:35:03 2026 +0300
Drop libdb-dev from build-depends, include a read-only implementation derived from rpm (librobdb.so). (Closes: #1119174)
commit 885f34a08f5bd93e534e887588f07fa2f5bbcfbe
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 20:31:41 2026 +0300
patches: Fix nss includes.
commit 6989008f654c68f7ea4e74d7eafd3e449a76947b
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 20:29:54 2026 +0300
Migrate to pybuild.
commit d32406eaf933c6ce08685a3e78f4ab19d68f37ec
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 10:37:19 2026 +0300
watch: Updated.
commit f5d2bf7dcdd42587dce752cd91d260212a1d9e78
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 10:35:06 2026 +0300
patches: Drop upstreamed patches.
commit 97728ef6d55227f1d9bcf495930cbd273b7e26fa
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 10:21:14 2026 +0300
version bump
commit b0916a76e53d629e29b11b27752a2d3f0aca7e0e
Merge: 6143c90 09a3408
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 10:20:25 2026 +0300
Merge branch 'upstream' into m
commit 6143c9025c8b7380618946c06e1ec21f57c6616d
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 10:16:56 2026 +0300
releasing package 389-ds-base version 3.1.2+vendor1-2
commit 6a7ec5c1cb30c34c341cecd7b75bb3b553f9c6f0
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 10:02:13 2026 +0300
patches: Fix CVE-2025-14905. (Closes: #1130910)
commit fd520c4f08190dd2444cd553daa689b6a00ac734
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Mon Apr 20 10:00:33 2026 +0300
patches: Fix build with python 3.14.
commit 39be79eb0f652a484960d43bf7813d2121905f6c
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Fri Apr 17 16:43:08 2026 +0300
releasing package 389-ds-base version 3.1.2+vendor1-1
commit 9212e29271c785da100e4345508bb6c44dc3043e
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Fri Apr 17 16:42:41 2026 +0300
Use the upstream tarball with vendored dependencies. (FTBFS)
* Use the upstream tarball with vendored dependencies. (FTBFS)
* Add patches to fix with gcc15, current rustc.
commit 09a3408bd3512ea7da0c66231a1dd2b15cc93fbe
Author: Mark Reynolds <mreynolds@redhat.com>
Date: Tue Dec 16 15:43:53 2025 -0500
Bump version to 3.1.4
commit 7b2104c2eb21ed899d69757529bd997ea65a5310
Author: progier389 <progier@redhat.com>
Date: Tue Dec 16 12:37:26 2025 +0100
Issue: 7147 - entrycache_eviction_test is failing (#7148)
Several reason explain the test failure:
log buffereing is not disabled
a race condition causing double free in slapi_re_exec_nt when several thread uses the same compiled regex
The searched done during the test were silently unindexed so some entries were unexpectedly added to the entry cache
Issue: #7147
Reviewed by: @tbordaz, @droideck (Thanks!)
commit 40527f748240e03410557b04a4cd353942211af1
Author: Mark Reynolds <mreynolds@redhat.com>
Date: Wed Dec 10 15:48:09 2025 -0500
Issue 1793 - RFE - Dynamic lists - UI and CLI updates
Description:
Add UI and CLI support for the new dynamic lists configuration
Relates: https://github.com/389ds/389-ds-base/issues/1793
Reviewed by: spichugi(Thanks!)
commit 7ba274f346f7f82b6cd73f24bc9c04be66a8837d
Author: Simon Pichugin <spichugi@redhat.com>
Date: Wed Dec 10 20:35:35 2025 -0800
Issue 7119 - Fix DNA shared config replication test (#7143)
Description: Modify test_dna_shared_config_replication to validate shared
config updates through actual DNA value allocation rather than direct
modification.
Creates a user to trigger DNA allocation and verifies the dnaRemainingValues
decrements and replicates correctly across all suppliers.
Relates: https://github.com/389ds/389-ds-base/issues/7119
Reviewed by: @tbordaz (Thanks!)
commit 97ae7306b75b344608a413c4d4f125f7ba0db3fe
Author: Simon Pichugin <spichugi@redhat.com>
Date: Wed Dec 10 19:53:35 2025 -0800
Issue 7081 - Repl Log Analysis - Implement data sampling with performance and timezone fixes (#7086)
Description: Add configurable data sampling to handle large datasets efficiently.
Implement three precision modes (fast/balanced/full) with uniform sampling on
backend and client-side fallback sampling when datasets exceed file size limits.
Track sampling metadata in JSON output and surface to users via UI notices.
Optimize chart rendering with series caching and debounced resize handlers.
Increase file size limits to 64 MiB and add proper async loading with
cancellation tokens. Make timezone handling consistent with all timestamps
timezone-aware throughout the stack. Add tracking for skipped directories,
accurate end-time reporting, and per-tab loading states.
Fixes: https://github.com/389ds/389-ds-base/issues/7081
Reviewed by: @mreynolds389 (Thanks!)
commit 446f3a485e8c27c11a5647266d5434dffdc6641e
Author: Mark Reynolds <mreynolds@redhat.com>
Date: Mon Dec 8 11:37:20 2025 -0500
Issue 1793 - RFE - Implement dynamic lists
Implement a backend feature to build dynamic content based of
LDAP URI's. Configuration includes an identifying objectclass to mark
an entry as a dynamic content entry. Another setting for the attribute
that contains the LDAP URI, and an attribute for storing the dynamic
content. Attributes specified in the LDAP URI override the content
attribute and instead write that attribute's value into the dynamic
content entry.
Design doc: https://www.port389.org/docs/389ds/design/dynamic-lists-design.html
Relates: https://github.com/389ds/389-ds-base/issues/1793
Reviewed by: progier(Thanks!)
commit afffed9ede9fa729a26f482767f0f837faf8323f
Author: progier389 <progier@redhat.com>
Date: Tue Dec 9 18:02:04 2025 +0100
Issue 7112 - dsctrl dblib bdb2mdb core dumps and won't allow conversion (#7144)
Avoid a crash we trying to free twice some bdb resources when read-only bdb is used.
Just by making sure not to dereference NULL pointer.
Issue: #7112
Reviewed by: @mreynolds389 (Thanks!)
commit d9360cb81039ec87356aee01284ecb10f15bf96f
Author: Alex Kulberg <vectinx@yandex.ru>
Date: Tue Dec 9 17:11:56 2025 +0300
Issue 7053 - Remove memberof_del_dn_from_groups from MemberOf plugin (#7064)
Bug Description:
The member plugin creates redundant changes to the member attribute
in groups when deleting a user, although the referential integrity
of the member attribute should be controlled by the Referential Integrity plugin.
Furthermore, memberof doesn't take replication of operations into account
and performs the change on every server instance in the topology.
Fix Description:
Remove the `memberof_del_dn_from_groups` function from the MemberOf plugin,
completely transferring responsibility for deleting users from groups
to the Referential Integrity plugin.
Relates: https://github.com/389ds/389-ds-base/issues/7053
Reviewed by: @tbordaz
commit c341731ff1085b43a0816ded471029585857471b
Author: progier389 <progier@redhat.com>
Date: Mon Dec 8 15:21:54 2025 +0100
Issue 7138 - test_cleanallruv_repl does not restart supplier3 (#7139)
Fix CI by ensuring that all suppliers are started when completing the test
Issue: #7138
Reviewed by: @droideck (Thanks!)
commit 4db2f3c6b2525e31ef9d4deda6d6f5797fd854e5
Author: Akshay Adhikari <aadhikar@redhat.com>
Date: Mon Dec 8 16:24:06 2025 +0530
Issue 6753 - Port ticket47921 test to indirect_cos_test using DSLdapObject (#7134)
Description: The old ticket47921_test.py had compatibility issues.
This ports the functionality to indirect_cos_test.py using modern DSLdapObject methods.
Relates: https://github.com/389ds/389-ds-base/issues/6753
Reviewed by: @progier389 (Thanks!)
commit f7156790d8e38f86a6495957e4fe4cb44a0bbc81
Author: James Chapman <jachapma@redhat.com>
Date: Mon Dec 8 10:33:59 2025 +0000
Issue 7128 - memory corruption in alias entry plugin (#7131)
Description:
The plugin was freeing the original search base sdn, leading
to memory corruption during operation teardown.
Fix:
Track ownership of sdn values in the alias dereference loop, only free
temp alias sdn's created by the plugin.
Fixes: https://github.com/389ds/389-ds-base/issues/7128
Reviewed by: @vashirov, @tbordaz (Thank you)
commit 50ef48ad840da49cfacd80f5522db28223cb7c6e
Author: James Chapman <jachapma@redhat.com>
Date: Mon Dec 8 10:20:42 2025 +0000
Issue 7091 - Duplicate local password policy entries listed (#7092)
Bug description:
When listing local password policies, duplicate entries are shown
if a subtree password policy exists under a sub suffix. The parent
suffix search also returns the same policy, resulting in duplicates.
Fix description:
Add a check for duplicate policy entries when iterating over results from multiple suffixes.
Fixes: https://github.com/389ds/389-ds-base/issues/7091
Reviewed by: @droideck (Thank you)
commit ff26302ec561a47209b5dfcb71a7f286bc304b97
Author: Viktor Ashirov <vashirov@redhat.com>
Date: Mon Dec 8 08:58:25 2025 +0100
Issue 7124 - BDB cursor race condition with transaction isolation (#7125)
Bug Description:
ASAN reported crashes in `__db_ditem_nolog()` with negative-size-param
errors. Cursor operations without transaction isolation allowed
concurrent page modifications to corrupt cursor state, leading to
invalid memory access.
The race condition occurs when:
1. T1 opens a cursor without transaction protection
2. T2 modifies the same index page
3. T1 cursor operates on stale page metadata
4. `__db_ditem_nolog()` calculates negative size for `memmove()`
5. Crash: `AddressSanitizer: negative-size-param: (size=-8)`
Reproducer: dirsrvtests/tests/stress/backend/bdb_cursor_race_test.py
Crash under ASAN usually happens within 10-30 minutes, but sometimes it
can run for hours without any crash.
Fix Description:
Implement transaction isolation for cursors in `idl_new_fetch()` and
`idl_new_range_fetch()` by always calling `dblayer_read_txn_begin()`.
In `bdb_txn_begin()` verify if the environment supports transactions
(has DB_INIT_TXN flag) before attempting to begin a transaction.
This prevents errors during offline import which uses a private
environment without transaction support.
In `bdb_public_new_cursor()` skip transaction usage when the database's
environment doesn't support transactions.
Fixes: https://github.com/389ds/389-ds-base/issues/7124
Reviewed by: @progier389, @tbordaz (Thanks!)
commit 337e2c905a24c1c3b9e2bc32cb7be62f1908ddac
Author: progier389 <progier@redhat.com>
Date: Fri Dec 5 17:20:18 2025 +0100
Issue 6951 - Dynamic Certificate refresh phase 1 - Search support (#7117)
First phase of Dynamic Certificate Refresh
Implement a new backend handling cn=dynamiccertificates suffix
and the code supporting search request to list and show nss db certificates
issue: #6951
Reviewed by: @vashirov (Thanks!)
* Dynamic Certificate - Phase1- Search
* Fix sourcery-ai remarks
* Minor changes
* Fix broken search and memory leaks
Co-authored-by: Viktor Ashirov <vashirov@redhat.com>
commit 8fe7bfe6ba2a21bcee34c6a383f080b02ecc4683
Author: progier389 <progier@redhat.com>
Date: Fri Dec 5 11:39:53 2025 +0100
Issue 7132 - Keep alive entry updated too soon after an offline import (#7133)
* Issue 7132 - Keep alive entry updated too soon after an offline import
Problem: first keep alive update is done 30 seconds after restarting the server which may be before the other replica have the time to replicate local changes after a re-initialization.
Solution: unify the timer management so that it starts after the keep alive interval (which is configurable) in the 3 following cases:
server starts
replica is enabled (i.e after bulk import)
keep alive interval is changed (to avoid having to restart the server after configuration change)
Also logs a warning if the keep alive interval is smaller than the maximum backoff timer value
Issue: #7132
Reviewed by: @tbordaz , @droideck (Thanks!)
commit 49ed4ad368406c8e1447b440b6115f599b2e9494
Author: Viktor Ashirov <vashirov@redhat.com>
Date: Fri Dec 5 08:22:48 2025 +0100
Issue 7135 - Not enough space for tests on GH runner (#7136)
Description:
Recently healthcheck tests started to fail with DSDSLE0001
> The disk partition used by the server (/), either for the database,
the configuration files, or the logs is over 90% full.
A fresh runner has 78% free space:
```
Filesystem Size Used Avail Use% Mounted on
/dev/root 73G 57G 17G 78% /
tmpfs 7.9G 172K 7.9G 1% /dev/shm
tmpfs 3.2G 1.1M 3.2G 1% /run
tmpfs 5.0M 0 5.0M 0% /run/lock
/dev/sdb15 105M 6.1M 99M 6% /boot/efi
/dev/sda1 74G 4.1G 66G 6% /mnt
tmpfs 1.6G 12K 1.6G 1% /run/user/1001
```
There is preinstalled software that we don't use, like dotnet, GHC,
CodeQL, docker images. We can remove them as part of the CI job to free
up disk space.
Fixes: https://github.com/389ds/389-ds-base/issues/7135
Reviewed by: @droideck (Thanks!)
commit 75e0e487545893a7b0d83f94f9264c10f8bb0353
Author: Viktor Ashirov <vashirov@redhat.com>
Date: Thu Dec 4 22:09:13 2025 +0100
Issue 7121 - LeakSanitizer: various leaks during replication (#7122)
1. CSN Leaks
In `resolve_attribute_state_deleted_to_present()` we set CSN set pointer
to NULL without freeing the allocated memory.
In `valueset_remove_valuearray()` we overwrite `csnset` pointer without
freeing the existing `csnset`.
2. Leak in replica_add_session_abort_control()
Control's OID and value are allocated but never freed after
`slapi_pblock_set`, which duplicates the control. Added cleanup to free
`ctrl.ldctl_oid` and `ctrl.ldctl_value.bv_val` after `slapi_pblock_set`.
3. LDAP controls leak
`ldap_parse_result` allocates controls that are not being freed when not
transferred to caller or on error paths. Free `loc_returned_controls`
in cleanup section and NULL the pointer after the transfer.
`returned_controls` allocated in `conn_read_result_ex` are used to check
for abort session control, but never freed before the next loop
iteration.
Fixes: https://github.com/389ds/389-ds-base/issues/7121
Reviewed by: @progier389, @tbordaz (Thanks!)
commit 3dd7d2854a2d8b6e328b44912ec234263e8ef5fc
Author: Viktor Ashirov <vashirov@redhat.com>
Date: Thu Dec 4 22:03:31 2025 +0100
Issue 7115 - LeakSanitizer: leak in `slapd_bind_local_user()` (#7116)
Bug Description:
1. In `slapd_bind_local_user()` when checking LDAPI auth mappings,
`slapi_search_internal_get_entry()` allocates and returns a duplicated
entry. This entry was never freed before jumping to the `done:` label,
causing a memory leak on each BIND operation.
2. When LDAPI mapping points to a locked account or a non-existent entry
`auth_dn` is allocated but not freed when `slapi_check_account_lock()`
returns non-zero.
3. When the root DN account is locked, `root_dn` is allocated via
`config_get_rootdn()` but not freed when the account lock check fails.
Fix Description:
1. Free the duplicated `e` before jumping to the `done:` label.
2. Free `auth_dn` when acount is locked or doesn't exist.
3. Free `root_dn` when root account is locked.
Fixes: https://github.com/389ds/389-ds-base/issues/7115
Reviewed by: @mreynolds389, @droideck (Thanks!)
commit f697e71121c4d40dce2509bb1a57f8fbd0501cf8
Author: Viktor Ashirov <vashirov@redhat.com>
Date: Thu Dec 4 21:56:28 2025 +0100
Issue 7109 - AddressSanitizer: SEGV ldap/servers/slapd/csnset.c:302 in csnset_dup (#7114)
Bug Description:
In `extensible_candidates` we pass a `berval` struct directly to the
pblock instead of `Slapi_Value`, which have different memory layouts.
Reproducible with
`dirsrvtests/tests/suites/filter/filter_index_match_test.py::test_do_extensible_search`.
Fix Description:
Convert the `berval` to `Slapi_Value` before passing to the pblock.
Fixes: https://github.com/389ds/389-ds-base/issues/7109
Reviewed by: @progier389 (Thanks!)
commit 764b500cee718bb05c107d592e918159bba6039e
Author: Simon Pichugin <spichugi@redhat.com>
Date: Wed Dec 3 17:47:34 2025 -0800
Issue 7119 - Harden DNA plugin locking for shared server list operations (#7120)
Description: Hold dna_server_write_lock() across both the global list
teardown and full rebuild in dna_load_shared_servers(), eliminating
rare races where concurrent config updates could free or append entries
while the list is being reconstructed.
Guard dna_delete_global_servers() at shutdown behind the same lock,
ensuring teardown doesn't run in parallel with active readers.
Add comprehensive multi-supplier DNA test suite covering basic
allocation, uniqueness, shared config replication, restart recovery,
and range exhaustion scenarios.
Fixes: https://github.com/389ds/389-ds-base/issues/7119
Reviewed by: @tbordaz (Thanks!)
commit 1248019a74d8507733b9d03bee768a5f0fcea6db
Author: Mark Reynolds <mreynolds@redhat.com>
Date: Thu Nov 6 08:31:19 2025 -0500
Issue 7084 - UI - schema - sorting attributes breaks expanded row
Description:
When sorting attributes the expanded row is not properly set and it crashes
the browser when trying to see it. The problem is that during sorting we
are not transfering the "attribute data" to the new sorted row.
Also fixed small issue in VlvIndexes where the wrong function name was
used.
Relates: https://github.com/389ds/389-ds-base/issues/7084
Reviewed by: spichugi(Thanks!)
commit 12ab69e5d655df4c9db3de31e0ae4885144c7a9e
Author: Akshay Adhikari <aadhikar@redhat.com>
Date: Thu Nov 27 15:40:40 2025 +0530
Issue 6753 - Port ticket47910 test to logconv_test using DSLdapObject (#7098)
Description:
Port ticket47910_test.py(file removed) to logconv_test.py with new tests for logconv
time filtering (-S/-E options). Fixes dataclass access bug in logconv.py
and adds proper error exit codes.
Relates: https://github.com/389ds/389-ds-base/issues/6753
Reviewed by: @jchapma (Thanks!)
commit 67d8c649538560ea0e4cea763c46185c4817249a
Author: Akshay Adhikari <aadhikar@redhat.com>
Date: Wed Nov 26 15:33:53 2025 +0530
Issue 6753 - Port ticket47920 test to ldap_controls_test using DSLdapObject (#7103)
Description:
The old ticket47920_test.py had compatibility issues.
This ports the functionality to ldap_controls_test.py using modern DSLdapObject methods.
Relates: https://github.com/389ds/389-ds-base/issues/6753
Reviewed by: @droideck (Thanks!)
commit 2876e7672dce8307f053b80a4ff412b3993da02e
Author: Mark Reynolds <mreynolds@redhat.com>
Date: Tue Nov 18 15:04:45 2025 -0500
Issue 7007 - Improve paged result search locking
Description:
Hold the paged result connection hash mutex while acquiring the global
connection paged result lock. Otherwise there is a window where the
mutex could be rmoved and lead to a crash
Relates: https://github.com/389ds/389-ds-base/issues/7007
Reviewed by: progier, spichugi, and tbordaz(Thanks!!!)
commit 9d068856f460d70d9f1ba1bc96b33f56e769cdf4
Author: Akshay Adhikari <aadhikar@redhat.com>
Date: Tue Nov 25 15:12:07 2025 +0530
Issue 7041 - Add WebUI test for group member management (#7111)
Description: Added test for group member add/remove functionality via checkboxes,
testing both single and multiple member deletions.
Relates: https://github.com/389ds/389-ds-base/issues/7041
Reviewed by: @mreynolds389, @droideck
commit 3bd703cf129fef43cff86c21a2cc8ef331794c56
Author: Simon Pichugin <spichugi@redhat.com>
Date: Thu Nov 20 14:34:50 2025 -0800
Issue 3555 - UI - Fix audit issue with npm - glob (#7107)
Description: Run npm audit fix to address the vulnerability
in glob.
Relates: https://github.com/389ds/389-ds-base/issues/3555
Reviewed by: @vashirov (Thanks!)
commit 7df263085999f256caa88f753e79f87d58c1733d
Author: Lenka Doudova <mirielka@users.noreply.github.com>
Date: Wed Nov 19 07:01:12 2025 +0100
Issue 7089 - Fix dsconf certificate list (#7090)
Description:
Fixing regex matching for listing certificates to also match a single
character certificate name instead of failing the 'dsconf security
certificate list' command
Relates: #7089
Author: Lenka Doudova
Reviewer: James Chapman
commit e86c212878ba692af340c14413b2f8bdcad8f514
Author: Akshay Adhikari <aadhikar@redhat.com>
Date: Tue Nov 18 21:57:10 2025 +0530
Issue 7076, 6992, 6784, 6214 - Fix CI test failures (#7077)
- Fixed import test bugs in regression_test.py (cleanup handler, LDIF permissions) -
https://github.com/389ds/389-ds-base/issues/6992
- Fixed ModRDN cache corruption on failed operations (parent update check, cache cleanup)
- Fixed attribute uniqueness test fixture cleanup in attruniq_test.py
- mproved test stability by fixing race conditions in replication, healthcheck,
web UI, memberOf, and basic tests.
- Fixed entrycache_eviction_test.py to track incremental log counts instead of cumulative -
https://github.com/389ds/389-ds-base/issues/6784
Fixes: https://github.com/389ds/389-ds-base/issues/7076
Relates: https://github.com/389ds/389-ds-base/issues/6992
Relates: https://github.com/389ds/389-ds-base/issues/6784
Fixes: https://github.com/389ds/389-ds-base/issues/6214
Reviewed by: @vashirov, @progier389 (Thanks!)
commit cf277a9420639d9e95fbf14982bcefca2cb0c781
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon Nov 17 19:57:18 2025 -0800
Bump js-yaml from 4.1.0 to 4.1.1 in /src/cockpit/389-console (#7097)
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: js-yaml
dependency-version: 4.1.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
commit 8ac17d60030e29c84ced9f0ce61c16504695b3fc
Author: Simon Pichugin <spichugi@redhat.com>
Date: Thu Nov 13 11:56:45 2025 -0800
Issue 7069 - Fix error reporting in HAProxy trusted IP parsing (#7094)
Description: Add missing errorbuf population in haproxy_parse_trusted_ips()
for CIDR validation failures.
Initialize parse_errorbuf to zero to fix Coverity warning.
Fixes: https://github.com/389ds/389-ds-base/issues/7069
Reviewed by: progier389, mreynolds389 (Thanks!!)
commit dbc4b2ed70526c03bfedb2474c0205cf1ca6c17b
Author: Viktor Ashirov <vashirov@redhat.com>
Date: Mon Nov 10 13:20:28 2025 +0100
Issue 7049 - RetroCL plugin generates invalid LDIF
Bug Description:
When a replicated modification marked with LDAP_MOD_IGNORE is logged,
`changes` attribute contains invalid LDIF:
```
replace: modifiersName
modifiersName: cn=MemberOf Plugin,cn=plugins,cn=config
-
modifyTimestamp: 20250903092211Z
-
```
Line `replace: modifyTimestamp` is missing.
A similar issue is present in audit log:
```
time: 20251031064114
dn: ou=tuser,dc=example,dc=com
result: 0
changetype: modify
add: objectClass
objectClass: nsMemberOf
-
replace: modifiersName
modifiersName: cn=MemberOf Plugin,cn=plugins,cn=config
-
-
```
Dash separator is logged, while the operation is not.
This issue is not present wheh JSON format is used.
Fix Description:
* retrocl_po.c: add a default case to skip the entire modification if it
has LDAP_MOD_IGNORE flag.
* auditlog.c: write the dash separator only if operation type is not
LDAP_MOD_IGNORE
Fixes: https://github.com/389ds/389-ds-base/issues/7049
Reviewed by: @progier389 (Thanks!)
commit 2a782b8f290a25476d4d5bfd4d976315fe36753c
Author: tbordaz <tbordaz@redhat.com>
Date: Fri Nov 7 15:41:40 2025 +0100
Issue 7055 - Online initialization of consumers fails with error -23 (#7075)
Bug description:
During a total initialization, if the supplier is not able
to send a new entry because the consumer is LDAP_BUSY,
then it returns a failure (CONN_OPERATION_FAILED).
The failure ends the replication session
Fix description:
Instead of failing it should retry (maxretry=5)
fixes: #7055
Reviewed by: Pierre Rogier (thanks)
commit 717541d198f194ac2df7b5a0e7f81c4bb0e60ada
Author: Lenka Doudova <mirielka@users.noreply.github.com>
Date: Fri Nov 7 14:46:26 2025 +0100
Issue 6753 - Remove ticket 47900 test (#7087)
Description:
Removing ticket 47900 test since the tescases are already covered by
dirsrvtests/tests/suites/password/pwdAdmin_test.py
Relates: #6753
Author: Lenka Doudova
Reviewer: Barbora Simonova
commit 52fa2944b4b27b40aab8b67190d98c7252314e40
Author: Lenka Doudova <mirielka@users.noreply.github.com>
Date: Fri Nov 7 14:46:00 2025 +0100
Issue 6753 - Port ticket 49008 test (#7080)
Description:
Porting ticket 49008 test into
dirsrvtests/tests/suites/replication/ruvstore_test.py::test_ruv_after_aborted_plugin_operation.
Relates: #6753
Author: Lenka Doudova
Assisted by: Cursor
Reviewer: Pierre Rogier
commit e7c55aa0370664caa7b152ab2dee27e3b3e4facb
Author: James Chapman <jachapma@redhat.com>
Date: Fri Nov 7 09:57:02 2025 +0000
Issue 7042 - Enable global_backend_lock when memberofallbackend is enabled (#7043)
Description: When the memberOf plugin is configured with memberOfAllBackends=on
option, concurrent updates to group memberships across multiple backends can lead
to deadlock.
Fix: A healthcheck was added to detect this configuration and alert the user to the
potential deadlock risk.
Fixes: https://github.com/389ds/389-ds-base/issues/7042
Reviewed by: @droideck, @firstyear, @tbordaz, @progier389 (Thank you)
commit 427aebb1ac1e2b45c0caa916964c7a03cc5c5a62
Author: Mark Reynolds <mreynolds@redhat.com>
Date: Mon Nov 3 16:24:50 2025 -0500
Issue 7078 - audit json logging does not encode binary values
Description:
Audit log does encode binary values, and this breaks the UI when it tries
displaying the log contents. When the value is not "printable" base64
encode it.
Relates: https://github.com/389ds/389-ds-base/issues/7078
Reviewed by: progier & spichugi(Thanks!!)
commit 2df7244effb8b83c86f507dfb56ddf62dc74093a
Author: Simon Pichugin <spichugi@redhat.com>
Date: Tue Nov 4 17:09:00 2025 -0800
Issue 7069 - Add Subnet/CIDR Support for HAProxy Trusted IPs (#7070)
Description: nsslapd-haproxy-trusted-ip now supports CIDR notation
(192.168.0.0/24, 2001:db8::/32) instead of requiring individual IPs
for each address in a subnet. This makes it practical to trust entire
HAProxy network ranges without manually adding hundreds of entries.
The implementation includes CIDR parsing with validation, netmask
precomputation for performance, and support for mixing individual IPs
and subnets. Added comprehensive tests for subnet matching, edge cases,
and malformed input validation. Updated Cockpit console UI accordingly.
Fixes: https://github.com/389ds/389-ds-base/issues/7069
Reviewed by: @mreynolds389 (Thanks!)
commit 1d72eeaaa414d64246df5163f802cfba9da65a76
Author: Viktor Ashirov <vashirov@redhat.com>
Date: Tue Nov 4 12:05:51 2025 +0100
Issue 7056 - DSBLE0007 doesn't generate remediation steps for missing indexes
Bug Description:
dsctl healthcheck doesn't generate remediation steps for missing
indexes, instead it prints an error message:
```
- Unable to check index ancestorId: No object exists given the filter criteria: ancestorId (&(&(objectclass=nsIndex))(|(cn=ancestorId)))
```
Fix Description:
Catch `ldap.NO_SUCH_OBJECT` when index is missing and generate
remediation instructions.
Update remediation instructions for missing index.
Fix failing tests due to missing idlistscanlimit.
Fixes: https://github.com/389ds/389-ds-base/issues/7056
Reviewed by: @progier389, @droideck (Thank you!)
commit fcfaad5a0a82eea816b547822b55c369bc9cf649
Author: Timo Aaltonen <tjaalton@debian.org>
Date: Wed Jun 25 12:34:39 2025 +0300
control: Add libcrypt-dev to build-depends. (Closes: #1106912)
Among the 8 debian patches available in version 3.1.2+vendor1-2 of the package, we noticed the following issues:
Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.
Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/3/389-ds-base.png){kind=link}