build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14 in /src/go

[dependabot]

Bumps github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14.

Release notes

Sourced from github.com/go-ldap/ldap/v3's releases.

v3.4.14

I want to thank everyone who contributed in the recents months. Compared to last year, the number of activities and PRs (including open ones) has increased dramatically. I would like to thank everyone who contributed to the project.

Personal note: Please keep in mind that this project is not funded or supported by a large company or similar organization. We work on the library in our free time after work. I appreciate your support, but please keep this in mind (including with other open-source projects).

What's Changed

• make stop-local-server fails with Docker due to unsupported -t option by @​t2y in go-ldap/ldap#584
• Fix panic on malformed LDAP responses by @​Bahtya in go-ldap/ldap#586
• chore(deps): bump github.com/Azure/go-ntlmssp from 0.1.0 to 0.1.1 in /v3 by @​dependabot[bot] in go-ldap/ldap#587
• Reject unescaped special characters in DN values per RFC 4514 by @​t2y in go-ldap/ldap#588
• v3/control: replace unchecked type asserts in DecodeControl with comma-ok by @​c-tonneslan in go-ldap/ldap#589
• fix(conn): parse ldapi:// URLs per RFC 4516 by @​c-tonneslan in go-ldap/ldap#590
• fix: decode Server Side Sorting controlValue as BER-encoded OCTET STRING per RFC 2891 by @​ahanwhite in go-ldap/ldap#593
• fix: generate digest-md5 cnonce with crypto/rand by @​netliomax25-code in go-ldap/ldap#594
• fix: escape quoted-string metacharacters in digest-md5 response by @​netliomax25-code in go-ldap/ldap#595
• fix: escape attribute and matching rule in DecompileFilter by @​netliomax25-code in go-ldap/ldap#596
• fix: set Result code when decoding ServerSideSortingResult control by @​netliomax25-code in go-ldap/ldap#597
• fix: reject trailing bytes in hex-encoded DN attribute value by @​netliomax25-code in go-ldap/ldap#598
• fix: synchronize writes to Conn.err with GetLastError by @​netliomax25-code in go-ldap/ldap#601
• unescape quoted-pair sequences in digest-md5 challenge parser by @​netliomax25-code in go-ldap/ldap#600
• fix: avoid uint16 overflow in gssapi UnmarshalWrapToken offset by @​netliomax25-code in go-ldap/ldap#602
• fix(conn): finish Unbind message context to prevent Close deadlock by @​efd6 in go-ldap/ldap#599
• fix: compare multi-valued RDN attributes as a multiset by @​netliomax25-code in go-ldap/ldap#604
• fix: respect backslash parity for escaped trailing space in DN value by @​netliomax25-code in go-ldap/ldap#603
• fix: skip empty referral sequence in getReferral by @​netliomax25-code in go-ldap/ldap#610
• fix: guard malformed paging control in DecodeControl by @​netliomax25-code in go-ldap/ldap#611
• handle linear whitespace in digest-md5 challenge parser by @​netliomax25-code in go-ldap/ldap#607
• chore: crypto update by @​CameronJHall in go-ldap/ldap#613
• fix: guard malformed responseValue in PasswordModify by @​netliomax25-code in go-ldap/ldap#614
• decode extended responseName by context class by @​netliomax25-code in go-ldap/ldap#605
• fix: prevent SearchAsync goroutine leak when context is cancelled during send by @​t2y in go-ldap/ldap#615
• fix: guard nil responseValue when parsing WhoAmI result by @​johnweldon in go-ldap/ldap#617
• fix: guard constructed-form attributeType in server-side sort decode by @​johnweldon in go-ldap/ldap#618
• chore: Update dependencies by @​cpuschma in go-ldap/ldap#620

New Contributors

• @​Bahtya made their first contribution in go-ldap/ldap#586
• @​c-tonneslan made their first contribution in go-ldap/ldap#589
• @​ahanwhite made their first contribution in go-ldap/ldap#593
• @​netliomax25-code made their first contribution in go-ldap/ldap#594
• @​efd6 made their first contribution in go-ldap/ldap#599
• @​CameronJHall made their first contribution in go-ldap/ldap#613

Full Changelog: go-ldap/ldap@v3.4.13...v3.4.14

Commits

• 9e343e2 chore: update dependencies (#620)
• c381fd4 fix: guard constructed-form attributeType in server-side sort decode (#618)
• be69007 fix: guard nil responseValue when parsing WhoAmI result (#617)
• d6d6b04 fix: prevent SearchAsync goroutine leak when context is cancelled during send...
• c90b197 decode extended responseName by context class (#605)
• ab9c0c1 guard malformed responseValue decode in PasswordModify (#614)
• 8656c7a chore(deps): bump golang.org/x/net from 0.50.0 to 0.55.0 in /v3 (#613)
• 8a98971 handle linear whitespace in digest-md5 challenge parser (#607)
• 0059675 fix: guard malformed paging control in DecodeControl (#611)
• 189d84e fix: skip empty referral sequence in getReferral (#610)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Upgrade github.com/go-ldap/ldap/v3 to v3.4.14 to harden LDAP parsing and prevent crashes/leaks. This improves stability, security, and RFC compliance across our LDAP flows.

• Bug Fixes

  • Avoid panic on malformed responses and synchronize connection error handling.
  • Fix Unbind Close deadlock and prevent SearchAsync goroutine leaks on context cancel.
  • Enforce RFC 4514/4516 for DN and ldapi:// parsing with correct escaping.
  • Harden control/extended response decoding (paging, server-side sort, PasswordModify, WhoAmI) and improve DIGEST-MD5 cnonce/escaping.

• Dependencies

  • Bump github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14.
  • Pin indirect github.com/go-asn1-ber/asn1-ber to v1.5.8.

^{Written for commit 9881903. Summary will update on new commits.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud