v1.16.0 closes a user-enumeration side channel and brings the dependency graph current.
Security: CheckPasswordForDN no longer leaks DN existence through timing
The DN authentication path returned early when the lookup failed — no bind attempt — while an existing DN went through lookup, verification bind and the service rebind. That latency gap let a caller distinguish existing from non-existing DNs; the sAMAccountName path has had a constant-time dummy bind against this all along, and the #217 service rebind had widened the gap by one round-trip on the existent side only. The not-found case now performs the same escaped dummy bind plus the service rebind, and the probe is recorded in the rate limiter's failure metric, matching the sAMAccountName path; the returned error shape is unchanged, so no caller adjustments are needed (#219, #222). The regression guard observes the failure metric and was red-green verified against a real OpenLDAP.
Dependencies
All Go dependencies updated across the module graph — indirect-only version moves (#218).
Full Changelog: v1.15.0...v1.16.0