v0.6.3
Security relevant
Security fixes
- dep: GHSA-qcxq-75wr-5cm8 — Updated LDAP dependency stack (including ldap3_proto) to prevent crash from specially crafted LDAP queries
Notable features
- Added LDAP schema definitions for memberOf, modifyTimestamp, and pwdChangedTime
- Configurable healthcheck listen addresses
- Usernames included in password recovery emails
Full changelog
[0.6.3] 2026-05-01
Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.
Added
- LDAP schema definitions for
memberOf,modifyTimestampandpwdChangedTime - Support for configuring the healthcheck listen addresses
- Usernames are now included in password recovery emails
Changed
- JWT
expandiatclaims are now serialized as NumericDate values to comply with RFC7519 - Migrated to
rustls0.23 and centralized TLS handling - The login form no longer enforces a password length limit
Fixed
pwdChangedTimeis now emitted as LDAP GeneralizedTime instead of RFC3339- LDAP base-scope searches for non-existent entries now return
NoSuchObject cnequality filters are now case insensitive- The server now shuts down the database connection pool gracefully
- The bootstrap script now handles empty globs correctly
Security
- Updated the LDAP dependency stack, including
ldap3_proto, in response to
security advisory
GHSA-qcxq-75wr-5cm8,
where a specially crafted LDAP query could make the server crash
Cleanups
- Split GraphQL queries and mutations into smaller modules
- Refactored configuration and user update logic
- Upgraded the Rust toolchain and shared dependencies
New services
- Apache WebDAV
- Continuwuity
- Gerrit
- Gogs
- Open WebUI
- OpenCloud
- Pocket ID
- Semaphore
- TrueNAS
