Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refactor: Upgrade ldapjs from 2.3.3 to 3.0.2 #8592

Closed
wants to merge 2 commits into from
Closed

refactor: Upgrade ldapjs from 2.3.3 to 3.0.2 #8592

wants to merge 2 commits into from

Conversation

parseplatformorg
Copy link
Contributor

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade ldapjs from 2.3.3 to 3.0.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 3 versions ahead of your current version.
  • The recommended version was released 2 months ago, on 2023-03-28.
Release notes
Package name: ldapjs
  • 3.0.2 - 2023-03-28

    What's Changed

    New Contributors

    Full Changelog: v3.0.1...v3.0.2

  • 3.0.1 - 2023-03-08

    What's Changed

    Full Changelog: v3.0.0...v3.0.1

  • 3.0.0 - 2023-02-22

    🎉🎉🎉 Version 3.0.0 Is Here

    This release has been in development for many months. The first commit toward this goal happened on 2019-09-01, but work really started with a commit on 2022-03-27.

    This is not a trivial release. There are significant changes under the hood. They include:

    • Common modules have been broken out into separate installable modules:
    • ldap-filter has been forked to @ ldapjs/filter. It includes improvements around value escaping, modern method signatures, and identifiable "class" objects. The full set of changes can be reviewed at ldapjs/filter@daa5a5d...v2.0.0
    • asn1 has been forked to @ ldapjs/asn1. Methods have been improved, e.g. BerReader.readBoolean now accepts a tag to expect, new ones added, e.g. BerWriter.appendBuffer, unreachable code removed, and bugs fixed. The full set of changes can be reviewed at ldapjs/asn1@bf1bb90...v2.0.0

    Additionally, all of the above modules now have complete, 100%, test coverage (except for @ ldapjs/filter; PRs are welcome to help out here). They are also comprehensively documented with jsdoc.

    We expect there are going to be issues with this release. We worked hard to make sure all of the current tests pass without any changes (or at least none that affect the purpose of the test). But the current test suite is by no means comprehensive, and such sweeping changes as are present in this release are almost guaranteed to introduce new bugs. Please bear with us as we resolve them. Your contributions to fix any such bugs will help greatly.

    Even the simple act of opening an issue describing something you've found that should be in these release notes would be a big help. For example, if you have determined that a change in some object API, e.g. the SearchRequest object, should be highlighted, then please open an issue describing the change so that we can add an it to an addendum on these release notes.

    The Biggest Change

    We think that the most impactful change is going to be the decoupling of the underlying byte arrays from all objects. In v2 and earlier, the client, server, controls, messages, and everything else passed around single byte arrays during the handling of requests. The benefit of this is reduced memory consumption and faster handling of requests. The downside is an extremely difficult to understand and maintain codebase. As part of the work to modularize this codebase, we opted to make byte array processing idempotent in the majority of cases. This will have an impact on performance, but we do not know how much of an impact. We do not have any way to benchmark the before and after of this change. We suspect (hope) that in the majority of cases it will not be noticeable.

    VLV Controls

    During the development of v3 we were not clear if the VLV implementation that was added to v2 was correct. So we opted to cut it for the release. Shortly after cutting it, we determined that the implementation is very likely correct. You can read about this decision at #797 (comment) and the realization at #797 (comment).

    Ultimately, we decided to postpone adding this feature back so that we could get v3 shipped.

    Conclusion

    A lot of hard work has gone into this release. We think it lays the ground work for a much more maintainable codebase. We envision being able to re-implement the server and client components as @ ldapjs/server and @ ldapjs/client at some point in the future. We think there is a real opportunity to refactor both components into more modern interfaces with significant improvements (particularly in the form of error handling). No promises are made about when such projects might be undertaken, if ever. But they wouldn't be possible without the work in this v3 release.

    In regard to my (James Sumners) personal contributions to this release, please consider using my ❤️ GitHub Sponsor link to show your gratitude. Contributions will be particularly helpful at this time; I was laid off as part of a significant downsizing event at my previous employer and am currently unemployed.

    Additionally, a big thank you to @ dirmgr for his willingness to answer general LDAP protocol questions and the abundance of well written documentation he has provided at https://nawilson.com/ldapv3-wire-protocol-reference/ and https://ldap.com/learn-about-ldap/. The help and articles were indispensable in crafting this release.

    Known Breaking Changes

    Client

    • options.strictDN: removed. All DN parsing is now "strict". It does not make any sense to try and parse DN strings that are not spec compliant.
    • .modify: no longer accepts plain objects as change descriptors. An instance of @ ldapjs/change is now required.
    • searchEntry object: the searchEntry object no longe provides a .raw property. The access this property provided is now supplied by the searchEntry object's standard methods and accessors, e.g. .attributes for the set of attributes returned on the entry. Further, accessing binary field values should be done by specifying the ;binary attribute option as per the LDAP spec. See #850 and #858 for more detail.
    • Change objects: generic JavaScript objects are no longer supported as change objects. When creating a new change object, @ ldapjs/attribute objects must be provided (or a plain object that conforms to an attribute object). See #859 for more detail.

    Server

    • options.strictDN: removed. All DN parsing is now "strict". It does not make any sense to try and parse DN strings that are not spec compliant.
    • .listen: No longer listens on 0.0.0.0 when no host parameter is provided. It now uses the secure default of 127.0.0.1.
    • .search: the results of SearchRequest.scope changed to the spec defined search scope names. With ldapjs@3.0.0 (and @ ldapjs/messages@1.0.0) you must match against base, single, and subtree instead of base, one, and sub. This has been corrected in ldapjs@3.0.1 (with @ ldapjs/messages@1.0.1) via PR #847. See the unit test included in that release for the recommended approach for matching search scopes.

    General

    • Message objects no longer have a .object accessor. This has been replaced with the .pojo accessor. It didn't make any sense to have a message object with an accessor that returns an object (it's confusing). The .pojo accessor states what will be returned: a plain JavaScript object. You may find that the actual message object now has fields you can directly use. See #841.
    • Filter strings no longer provide a static exception on case sensitive comparisons for objectClass. In ldapjs@2 and earlier, there were many explicit checks for objectClass being compared. When such a comparison was found, the code always performed that specific comparison in a case insensitive manner. As of ldapjs@3, you must specify that you want to perform case insensitive comparisons on property names. See ldapjs/filter#3 for more detail.
  • 2.3.3 - 2022-06-08
    Read more
from ldapjs GitHub release notes
Commit messages
Package name: ldapjs

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@parse-github-assistant
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title [Snyk] Upgrade ldapjs from 2.3.3 to 3.0.2 refactor: Upgrade ldapjs from 2.3.3 to 3.0.2 May 29, 2023
@parse-github-assistant
Copy link

Thanks for opening this pull request!

  • ❌ Please link an issue that describes the reason for this pull request, otherwise your pull request will be closed. Make sure to write it as Closes: #123 in the PR description, so I can recognize it.

@mtrezza mtrezza mentioned this pull request Jun 1, 2023
Open
9 tasks
@dblythy dblythy mentioned this pull request Jun 7, 2023
Closed
4 tasks
@mtrezza mtrezza closed this Jan 3, 2024
@mtrezza mtrezza deleted the snyk-upgrade-109139bc95961cf05f1235e8fce35127 branch January 3, 2024 00:11
@onurhanife onurhanife mentioned this pull request Jan 16, 2024
Closed
4 tasks
@mtrezza mtrezza mentioned this pull request Mar 1, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

object not found for update #597
3 participants
@parseplatformorg @mtrezza @snyk-bot