Released 3.4.8 (2026-09-16)

Fixes:
* Plugged memory and reference leaks at error-handling time (#40, #617, #619,
  #620, #621, #622, #632)
* VLV control now honours contextID passed in (#618)
* ldapurl now correctly escapes when emitting a HTML anchor (#628)
* _ldap.str2dn now handles empty string correctly (#549)
* handle server-sent invalid UTF-8 correctly (by throwing an error) (#624)
* corrected ldap.functions export list to remove long gone items

Doc:
* fd ownership has now been clarified - if providing an fd to set up a new
  LDAPObject, it is now owned and managed by the module, do not close it
  yourself (#575)
* clarifications on handling EINTR -> use OPT_RESTART (#242)
* clarified build dependencies (#569)
* clarified OPT_CLIENT_CONTROLS/OPT_SERVER_CONTROLS (#639)

Infrastructure:
* Build requirement pinned to ``setuptools>=61``: older setuptools ignores
  the PEP 621 ``[project]`` table and produces an sdist with broken metadata
  (``Name: unknown``), which made pip silently fall back to ancient releases
  when building 3.4.5 from source (#616). Old environments now fail with a
  clear resolver error instead.
* Removed the ``[install]`` section (``compile``/``optimize``) from
  ``setup.cfg``; it caused ``bdist_wheel`` to embed ``__pycache__``
  byte-code files in published wheels (#615).

Released 3.4.7 2026-05-19

No code changes, correcting for the fact that the previous release artifacts
uploaded to PyPI contained unintended files.

Released 3.4.6 2026-05-14

Fixes:
* ``attrlist`` parameter is now properly checked before use, avoiding memory
  errors due to type mismatches
* Fixed errors with requestName/requestValue in ``extop.dds``
* ``ldif`` and ``ldap.schema`` modules now actively close sockets as they're
  finished with them

Infrastructure:
* Package no longer requires setuptools-scm

python-ldap-3.4.5

Released 3.4.5 2025-10-10

Security fixes:
* CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce ``str`` input in
  ``ldap.filter.escape_filter_chars`` with ``escape_mode=1``; ensure proper
  escaping. (thanks to lukas-eu)
* CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in
  ``ldap.dn.escape_dn_chars`` to ``\00`` per RFC 4514. (thanks to aradona91)

Fixes:
* ReconnectLDAPObject now properly reconnects on UNAVAILABLE, CONNECT_ERROR
  and TIMEOUT exceptions (previously only SERVER_DOWN), fixing reconnection
  issues especially during server restarts
* Fixed syncrepl.py to use named constants instead of raw decimal values
  for result types
* Fixed error handling in SearchNoOpMixIn to prevent a undefined variable error

Tests:
* Added comprehensive reconnection test cases including concurrent operation
  handling and server restart scenarios

Doc/
* Updated installation docs and fixed various documentation typos
* Added ReadTheDocs configuration file

Infrastructure:
* Add testing and document support for Python 3.13

Released 3.4.4 2022-11-17

Fixes:
* Reconnect race condition in ReconnectLDAPObject is now fixed
* Socket ownership is now claimed once we've passed it to libldap
* LDAP_set_option string formats are now compatible with Python 3.12

Doc/
* Security Policy was created
* Broken article links are fixed now
* Bring Conscious Language improvements

Infrastructure:
* Add testing and document support for Python 3.10, 3.11, and 3.12

Prepare a new release

Released 3.4.2 2022-07-06

This is a minor release to provide out-of-the-box compatibility with the merge
of libldap and libldap_r that happened with OpenLDAP's 2.5 release.

The following undocumented functions are deprecated and scheduled for removal:
- ``ldap.cidict.strlist_intersection``
- ``ldap.cidict.strlist_minus``
- ``ldap.cidict.strlist_union``

The following deprecated option has been removed:
- ``OPT_X_TLS``

Doc/
* SASL option usage has been clarified

Lib/
* ppolicy control definition has been updated to match Behera draft 11

Modules/
* By default, compile against libldap, checking whether it provides a
  threadsafe implementation at runtime
* When decoding controls, the module can now distinguish between no value
  (now exposed as ``None``) and an empty value (exposed as ``b''``)
* Several new OpenLDAP options are now supported:
  * ``OPT_SOCKET_BIND_ADDRESSES``
  * ``OPT_TCP_USER_TIMEOUT``
  * ``OPT_X_SASL_MAXBUFSIZE``
  * ``OPT_X_SASL_SECPROPS``
  * ``OPT_X_TLS_ECNAME``
  * ``OPT_X_TLS_PEERCERT``
  * ``OPT_X_TLS_PROTOCOL``-related options and constants

Fixes:
* Encoding/decoding of boolean controls has been corrected
* ldap.schema.models.Entry is now usable
* ``method`` keyword to ReconnectLDAPObject.bind_s is now usable

Released 3.4.1 2022-07-05

This is a minor release to provide out-of-the-box compatibility with the merge
of libldap and libldap_r that happened with OpenLDAP's 2.5 release.

The following undocumented functions are deprecated and scheduled for removal:
- ``ldap.cidict.strlist_intersection``
- ``ldap.cidict.strlist_minus``
- ``ldap.cidict.strlist_union``

The following deprecated option has been removed:
- ``OPT_X_TLS``

Doc/
* SASL option usage has been clarified

Lib/
* ppolicy control definition has been updated to match Behera draft 11

Modules/
* By default, compile against libldap, checking whether it provides a
  threadsafe implementation at runtime
* When decoding controls, the module can now distinguish between no value
  (now exposed as ``None``) and an empty value (exposed as ``b''``)
* Several new OpenLDAP options are now supported:
  * ``OPT_SOCKET_BIND_ADDRESSES``
  * ``OPT_TCP_USER_TIMEOUT``
  * ``OPT_X_SASL_MAXBUFSIZE``
  * ``OPT_X_SASL_SECPROPS``
  * ``OPT_X_TLS_ECNAME``
  * ``OPT_X_TLS_PEERCERT``
  * ``OPT_X_TLS_PROTOCOL``-related options and constants

Fixes:
* Encoding/decoding of boolean controls has been corrected
* ldap.schema.models.Entry is now usable
* ``method`` keyword to ReconnectLDAPObject.bind_s is now usable

Released 3.4.0 2021-11-26

This release requires Python 3.6 or above,
and is tested with Python 3.6 to 3.10.
Python 2 is no longer supported.

New code in the python-ldap project is available under the MIT licence
(available in ``LICENCE.MIT`` in the source). Several contributors have agreed
to apply this licence their previous contributions as well.
See the ``README`` for details.

The following undocumented functions are deprecated and scheduled for removal:
- ``ldap.cidict.strlist_intersection``
- ``ldap.cidict.strlist_minus``
- ``ldap.cidict.strlist_union``

Security fixes:
* Fix inefficient regular expression which allows denial-of-service attacks
  when parsing specially-crafted LDAP schema.
  (GHSL-2021-117)

Changes:
* On MacOS, remove option to make LDAP connections from a file descriptor
  when built with the system libldap (which lacks the underlying function,
  ``ldap_init_fd``)
* Attribute values of the post read control are now ``bytes``
  instead of ISO8859-1 decoded ``str``
* ``LDAPUrl`` now treats urlscheme as case-insensitive
* Several OpenLDAP options are now supported:
  * ``OPT_X_TLS_REQUIRE_SAN``
  * ``OPT_X_SASL_SSF_EXTERNAL``
  * ``OPT_X_TLS_PEERCERT``

Fixes:
* The ``copy()`` method of ``cidict`` was added back. It was unintentionally
  removed in 3.3.0
* Fixed getting/setting ``SASL`` options on big endian platforms
* Unknown LDAP result code are now converted to ``LDAPexception``,
  rather than raising a ``SystemError``.

slapdtest:
* Show stderr of slapd -Ttest
* ``SlapdObject`` uses directory-based configuration of ``slapd``
* ``SlapdObject`` startup is now faster

Infrastructure:
* CI now runs on GitHub Actions rather than Travis CI.

Released 3.3.1 2020-06-29

Changes:
* On MacOS, remove option to make LDAP connections from a file descriptor
  when built wit the system libldap (which lacks the underlying function,
  ``ldap_init_fd``)