v1.14.0

Added

NewObject(cn, dn string) Object — a way to build a User, Group or Computer fixture with a known DN through the public API.

Object.cn and Object.dn were written only by objectFromEntry when decoding a directory response, so a consumer had no way to construct one. Both downstream repositories did it with reflection plus an unsafe write to the unexported fields, which gosec reports as G103. A constructor rather than setters keeps the fields read-only after construction: an Object still cannot be edited to disagree with what the directory returned.

u := &ldap.User{
    Object:         ldap.NewObject("admin", "CN=admin,OU=Users,DC=example,DC=com"),
    SAMAccountName: "admin",
}

Closes #191.

Fixed

Cache size accounting no longer wraps. Entry counts and byte sizes are computed as int and stored as int32, and the conversion was unchecked — a value past MaxInt32 became negative and corrupted the memory accounting that drives eviction. Conversions now saturate at the int32 bounds. Reaching that size takes a cache far larger than any realistic directory, so this is a latent defect rather than one you are likely to have hit.

Under the hood

gosec became a blocking check. Its four context.WithCancel findings in concurrency.go are false positives — WorkerPool, Pipeline, FanOut and BatchProcessor each store the cancel function and call it from Close(), where a defer cancel() in the constructor would cancel immediately — and carry that reason rather than a bare suppression.

The Go toolchain directive moved to 1.26.5, clearing four standard-library advisories. The go directive stays at 1.25.0, so this release does not force consumers onto a newer language version.

Full changelog: v1.13.0...v1.14.0