Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[deps]: Update ldapjs to v3 #457

Closed
wants to merge 1 commit into from
Closed

[deps]: Update ldapjs to v3 #457

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 17, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
ldapjs (source) 2.3.3 -> 3.0.7 age adoption passing confidence
@types/ldapjs (source) 2.2.5 -> 3.0.6 age adoption passing confidence

Release Notes

ldapjs/node-ldapjs (ldapjs)

v3.0.7

Compare Source

What's Changed

New Contributors

Full Changelog: ldapjs/node-ldapjs@v3.0.6...v3.0.7

v3.0.6

Compare Source

What's Changed

New Contributors

Full Changelog: ldapjs/node-ldapjs@v3.0.5...v3.0.6

v3.0.5

Compare Source

What's Changed

Full Changelog: ldapjs/node-ldapjs@v3.0.4...v3.0.5

v3.0.4

Compare Source

What's Changed

New Contributors

Full Changelog: ldapjs/node-ldapjs@v3.0.3...v3.0.4

v3.0.3

Compare Source

What's Changed

New Contributors

Full Changelog: ldapjs/node-ldapjs@v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: ldapjs/node-ldapjs@v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed

Full Changelog: ldapjs/node-ldapjs@v3.0.0...v3.0.1

v3.0.0

Compare Source

🎉🎉🎉 Version 3.0.0 Is Here

This release has been in development for many months. The first commit toward this goal happened on 2019-09-01, but work really started with a commit on 2022-03-27.

This is not a trivial release. There are significant changes under the hood. They include:

  • Common modules have been broken out into separate installable modules:
    • @ldapjs/attribute -- a comprehensive implementation of the LDAP attribute spec.
    • @ldapjs/change -- a full implementation of RFC 4511 §4.6.
    • @ldapjs/controls -- specific implementations for all supported controls (with a caveat detailed below) that inherit from a base identifiable object.
    • @ldapjs/dn -- provides DN and RDN objects to represent LDAP distinguished names.
    • @ldapjs/messages -- all supported messages as their own objects with methods and properties matching the specs, including a complete overhaul of the extension (renamed from extended) request and response objects (with added support for several extensions, e.g. "password modify").
    • @ldapjs/protocol -- now with a full suite of operation identifiers, result codes, and search tags.
  • ldap-filter has been forked to @ldapjs/filter. It includes improvements around value escaping, modern method signatures, and identifiable "class" objects. The full set of changes can be reviewed at ldapjs/filter@daa5a5d...v2.0.0
  • asn1 has been forked to @ldapjs/asn1. Methods have been improved, e.g. BerReader.readBoolean now accepts a tag to expect, new ones added, e.g. BerWriter.appendBuffer, unreachable code removed, and bugs fixed. The full set of changes can be reviewed at ldapjs/asn1@bf1bb90...v2.0.0

Additionally, all of the above modules now have complete, 100%, test coverage (except for @ldapjs/filter; PRs are welcome to help out here). They are also comprehensively documented with jsdoc.

We expect there are going to be issues with this release. We worked hard to make sure all of the current tests pass without any changes (or at least none that affect the purpose of the test). But the current test suite is by no means comprehensive, and such sweeping changes as are present in this release are almost guaranteed to introduce new bugs. Please bear with us as we resolve them. Your contributions to fix any such bugs will help greatly.

Even the simple act of opening an issue describing something you've found that should be in these release notes would be a big help. For example, if you have determined that a change in some object API, e.g. the SearchRequest object, should be highlighted, then please open an issue describing the change so that we can add an it to an addendum on these release notes.

The Biggest Change

We think that the most impactful change is going to be the decoupling of the underlying byte arrays from all objects. In v2 and earlier, the client, server, controls, messages, and everything else passed around single byte arrays during the handling of requests. The benefit of this is reduced memory consumption and faster handling of requests. The downside is an extremely difficult to understand and maintain codebase. As part of the work to modularize this codebase, we opted to make byte array processing idempotent in the majority of cases. This will have an impact on performance, but we do not know how much of an impact. We do not have any way to benchmark the before and after of this change. We suspect (hope) that in the majority of cases it will not be noticeable.

VLV Controls

During the development of v3 we were not clear if the VLV implementation that was added to v2 was correct. So we opted to cut it for the release. Shortly after cutting it, we determined that the implementation is very likely correct. You can read about this decision at #​797 (comment) and the realization at #​797 (comment).

Ultimately, we decided to postpone adding this feature back so that we could get v3 shipped.

Conclusion

A lot of hard work has gone into this release. We think it lays the ground work for a much more maintainable codebase. We envision being able to re-implement the server and client components as @ldapjs/server and @ldapjs/client at some point in the future. We think there is a real opportunity to refactor both components into more modern interfaces with significant improvements (particularly in the form of error handling). No promises are made about when such projects might be undertaken, if ever. But they wouldn't be possible without the work in this v3 release.

In regard to my (James Sumners) personal contributions to this release, please consider using my ❤️ GitHub Sponsor link to show your gratitude. Contributions will be particularly helpful at this time; I was laid off as part of a significant downsizing event at my previous employer and am currently unemployed.

Additionally, a big thank you to @​dirmgr for his willingness to answer general LDAP protocol questions and the abundance of well written documentation he has provided at https://nawilson.com/ldapv3-wire-protocol-reference/ and https://ldap.com/learn-about-ldap/. The help and articles were indispensable in crafting this release.


Known Breaking Changes

Client
  • options.strictDN: removed. All DN parsing is now "strict". It does not make any sense to try and parse DN strings that are not spec compliant.
  • .modify: no longer accepts plain objects as change descriptors. An instance of @ldapjs/change is now required.
  • searchEntry object: the searchEntry object no longe provides a .raw property. The access this property provided is now supplied by the searchEntry object's standard methods and accessors, e.g. .attributes for the set of attributes returned on the entry. Further, accessing binary field values should be done by specifying the ;binary attribute option as per the LDAP spec. See https://github.com/ldapjs/node-ldapjs/issues/850 and https://github.com/ldapjs/node-ldapjs/issues/858 for more detail.
  • Change objects: generic JavaScript objects are no longer supported as change objects. When creating a new change object, @ldapjs/attribute objects must be provided (or a plain object that conforms to an attribute object). See https://github.com/ldapjs/node-ldapjs/issues/859 for more detail.
Server
  • options.strictDN: removed. All DN parsing is now "strict". It does not make any sense to try and parse DN strings that are not spec compliant.
  • .listen: No longer listens on 0.0.0.0 when no host parameter is provided. It now uses the secure default of 127.0.0.1.
  • .search: the results of SearchRequest.scope changed to the spec defined search scope names. With [email protected] (and @ldapjs/[email protected]) you must match against base, single, and subtree instead of base, one, and sub. This has been corrected in [email protected] (with @ldapjs/[email protected]) via PR #​847. See the unit test included in that release for the recommended approach for matching search scopes.
General
  • Message objects no longer have a .object accessor. This has been replaced with the .pojo accessor. It didn't make any sense to have a message object with an accessor that returns an object (it's confusing). The .pojo accessor states what will be returned: a plain JavaScript object. You may find that the actual message object now has fields you can directly use. See https://github.com/ldapjs/node-ldapjs/issues/841.
  • Filter strings no longer provide a static exception on case sensitive comparisons for objectClass. In ldapjs@2 and earlier, there were many explicit checks for objectClass being compared. When such a comparison was found, the code always performed that specific comparison in a case insensitive manner. As of ldapjs@3, you must specify that you want to perform case insensitive comparisons on property names. See https://github.com/ldapjs/filter/issues/3 for more detail.

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner February 17, 2024 01:14
@renovate renovate bot requested a review from eliykat February 17, 2024 01:14
@bitwarden-bot bitwarden-bot changed the title [deps]: Update ldapjs to v3 [AC-2226] [deps]: Update ldapjs to v3 Feb 17, 2024
@bitwarden-bot
Copy link

Internal tracking:

@bitwarden-bot
Copy link

bitwarden-bot commented Feb 17, 2024

Logo
Checkmarx One – Scan Summary & Detailsa2367a89-308f-4311-a772-5ff8d4d36a59

No New Or Fixed Issues Found

@renovate renovate bot changed the title [AC-2226] [deps]: Update ldapjs to v3 [deps]: Update ldapjs to v3 Feb 17, 2024
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 3 times, most recently from d0518e7 to 3079a39 Compare March 6, 2024 13:04
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 4 times, most recently from 12ecda3 to 50f2acb Compare March 18, 2024 17:39
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 2 times, most recently from 74b66fe to c671a06 Compare March 25, 2024 14:19
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 2 times, most recently from 9591f39 to 315a892 Compare March 27, 2024 17:10
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 3 times, most recently from 4c05c98 to 0f77464 Compare April 29, 2024 14:01
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 3 times, most recently from d10c3d7 to 09d6a41 Compare May 13, 2024 13:27
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 3 times, most recently from 11f4379 to e5db765 Compare May 27, 2024 21:36
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 3 times, most recently from 858d64c to 0107fa4 Compare June 3, 2024 18:13
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch from 0107fa4 to e5180a6 Compare June 14, 2024 04:38
@eliykat
Copy link
Member

eliykat commented Jun 14, 2024

This library is no longer being maintained so we need to decide to fork it or replace it. I've started a conversation internally about how to handle this. In the meantime we will hold off on upgrading. I am leaving the PR open to make sure I follow up on it.

@eliykat eliykat added the hold do not merge, do not approve yet label Jun 14, 2024
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 2 times, most recently from 94d5808 to eace0a2 Compare July 1, 2024 17:18
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch 3 times, most recently from 311a039 to 7c251d5 Compare July 23, 2024 09:50
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch from 7c251d5 to 3b0824f Compare August 5, 2024 16:16
Copy link

sonarqubecloud bot commented Aug 5, 2024

@withinfocus
Copy link
Contributor

@eliykat did the team decide where to go here? I was hoping we could just directly implement the small amount of what we need and drop the library altogether.

@eliykat
Copy link
Member

eliykat commented Aug 11, 2024

@withinfocus not yet, I have been monitoring the dependency and community chatter for any updates/successor projects, but nothing has emerged. I agree we need to do something about it ourselves, I'll schedule it for an upcoming sprint to look at it again.

@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch from 3b0824f to 8779df7 Compare August 26, 2024 20:16
@renovate renovate bot force-pushed the renovate/ldapjs-3.x branch from 8779df7 to f03e7b7 Compare September 16, 2024 03:52
Copy link

codecov bot commented Sep 16, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 0.00%. Comparing base (5600f20) to head (f03e7b7).
Report is 26 commits behind head on main.

✅ All tests successful. No failed tests found.

Additional details and impacted files
@@          Coverage Diff          @@
##            main    #457   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files         58      58           
  Lines       2542    2542           
  Branches     462     462           
=====================================
  Misses      2542    2542           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@eliykat
Copy link
Member

eliykat commented Oct 1, 2024

We will replace this with ldapts, which is tracked in a separate ticket: https://bitwarden.atlassian.net/browse/PM-13007.

@eliykat eliykat closed this Oct 1, 2024
Copy link
Contributor Author

renovate bot commented Oct 1, 2024

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the renovate/ldapjs-3.x branch October 1, 2024 03:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
hold do not merge, do not approve yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants