feat(container): update image ghcr.io/lldap/lldap ( v0.5.0 → v0.6.3 )

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/lldap/lldap	minor	v0.5.0 → v0.6.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

lldap/lldap (ghcr.io/lldap/lldap)

v0.6.3

Compare Source

[0.6.3] 2026-05-01

Small release, focused on LDAP compatibility, TLS maintenance, dependency upgrades and documentation/examples.

Added

• LDAP schema definitions for memberOf, modifyTimestamp and pwdChangedTime
• Support for configuring the healthcheck listen addresses
• Usernames are now included in password recovery emails

Changed

• JWT exp and iat claims are now serialized as NumericDate values to comply with RFC7519
• Migrated to rustls 0.23 and centralized TLS handling
• The login form no longer enforces a password length limit

Fixed

• pwdChangedTime is now emitted as LDAP GeneralizedTime instead of RFC3339
• LDAP base-scope searches for non-existent entries now return NoSuchObject
• cn equality filters are now case insensitive
• The server now shuts down the database connection pool gracefully
• The bootstrap script now handles empty globs correctly

Security

• Updated the LDAP dependency stack, including ldap3_proto, in response to
  security advisory
  GHSA-qcxq-75wr-5cm8,
  where a specially crafted LDAP query could make the server crash

Cleanups

• Split GraphQL queries and mutations into smaller modules
• Refactored configuration and user update logic
• Upgraded the Rust toolchain and shared dependencies

New services

• Apache WebDAV
• Continuwuity
• Gerrit
• Gogs
• Open WebUI
• OpenCloud
• Pocket ID
• Semaphore
• TrueNAS

v0.6.2

Compare Source

[0.6.2] 2025-07-21

Small release, focused on LDAP improvements and ongoing maintenance.

Added

• LDAP
  • Support for searching groups by their groupid
  • Support for whoamiOID
  • Support for creating groups
  • Support for subschema entry
• Custom assets path.
• New endpoint for requesting client settings

Changed

• A missing JWT secret now prevents startup.
• Attributes with invalid characters (such as underscores) cannot be created anymore.
• Searching custom (string) attributes is now case insensitive.
• Using the top-level firstName, lastName and avatar GraphQL fields for users is now deprecated. Use the attributes field instead.

Fixed

• lldap_set_password now uses the system's SSL certificates.

Cleanups

• Split the main lldap crate into many sub-crates
• Various dependency version bumps
• Upgraded to 2024 Rust edition
• Docs/FAQ improvements

Bootstrap script

• Custom attributes support
• Read the paswsord from a file
• Resilient to no user or group files

New services

• Discord integration (Discord role to LLDAP user)
• HashiCorp
• Jellyfin 2FA with Duo
• Kimai
• Mailcow
• Peertube
• Penpot
• PgAdmin
• Project Quay
• Quadlet
• Snipe-IT
• SSSD
• Stalwart
• UnifiOS

New Contributors

• @​fa-sharp made their first contribution in #​1080
• @​mbelangergit made their first contribution in #​1083
• @​tyami94 made their first contribution in #​1079
• @​maystar made their first contribution in #​1096
• @​geragio made their first contribution in #​1105
• @​hendrik1120 made their first contribution in #​1124
• @​baka-yuki made their first contribution in #​1127
• @​taiwan-king made their first contribution in #​1126
• @​meetpatty made their first contribution in #​1134
• @​ivan-sirosh made their first contribution in #​1132
• @​juntong20XX made their first contribution in #​1144
• @​vmd1 made their first contribution in #​1146
• @​avargaskun made their first contribution in #​1155
• @​cogdavid made their first contribution in #​1157
• @​broemp made their first contribution in #​1166
• @​MikaelUrankar made their first contribution in #​1170
• @​ChibyX made their first contribution in #​1174
• @​sdelnevo made their first contribution in #​1173
• @​ingalls made their first contribution in #​1177
• @​bryanalves made their first contribution in #​1182
• @​jaj42 made their first contribution in #​1183
• @​PHIDIAS0303 made their first contribution in #​1188
• @​AlexandreFoley made their first contribution in #​1192
• @​selfhoster1312 made their first contribution in #​1198
• @​T0byV made their first contribution in #​1071
• @​coredoesdev made their first contribution in #​1210

Full Changelog: lldap/lldap@v0.6.1...v0.6.2

v0.6.1

Compare Source

Small release, mainly to fix a migration issue with Sqlite and Postgresql.

Added

• Added a link to a community terraform provider (#​1035)

Changed

• The opaque dependency now points to the official crate rather than a fork (#​1040)

Fixed

• Migration of the DB schema from 7 to 8 is now automatic for sqlite, and fixed for postgres (#​1045)
• The startup warning about key_seed applying instead of key_file now has instructions on how to silence it (#​1032)

New services

• OneDev

New Contributors

• @​traverseda made their first contribution in #​1036
• @​tasansga made their first contribution in #​1035
• @​jduepmeier made their first contribution in #​1040
• @​xeoneox made their first contribution in #​1041

Full Changelog: lldap/lldap@v0.6.0...v0.6.1

v0.6.0

Compare Source

Long-awaited release, with the flagship feature of custom attributes! This unlock many integrations, notably Linux user management through PAM.

Thanks to all the contributors who sent some code, some configuration guide, reported a bug or otherwise helped the project!

Breaking

• The endpoint /auth/reset/step1 is now POST instead of GET (#​704)

Added

• Custom attributes are now supported (#​67) ! You can add new fields (string, integers, JPEG or dates) to users and query them. That unlocks many integrations with other services, and allows for a deeper/more customized integration. Special thanks to @​pixelrazor and @​bojidar-bg for their help with the UI.
• Custom object classes (for all users/groups) can now be added (#​833)
• Barebones support for Paged Results Control (no paging, no respect for windows, but a correct response with all the results) (#​698)
• A daily docker image is tagged and released. (#​613)
• A bootstrap script allows reading the list of users/groups from a file and making sure the server contains exactly the same thing. (#​654)
• Make it possible to serve lldap behind a sub-path in (#​752)
• LLDAP can now be found on a custom package repository for opensuse, fedora, ubuntu, debian and centos (Repository link). Thanks @​Masgalor for setting it up and maintaining it.
• There's now an option to force reset the admin password (#​748) optionally on every restart (#​959)
• There's a rootless docker container (#​755)
• entryDN is now supported (#​780)
• Unknown LDAP controls are now detected and ignored (#​787, #​799)
• A community-developed CLI for scripting (#​793)
• Added a way to print raw logs to debug long-running sessions (#​992)

Changed

• The official docker repository is now lldap/lldap
• Removed password length limitation in lldap_set_password tool
• Group names and emails are now case insensitive, but keep their casing (#​666)
• Better error messages (and exit code (#​745)) when changing the private key (#​778, #​1008), using the wrong SMTP port (#​970), using the wrong env variables (#​972)
• Allow member= filters with plain user names (not full DNs) (#​949)
• Correctly detect and refuse anonymous binds (#​974)
• Clearer logging (#​971, #​981, #​982)

Fixed

• Logging out applies globally, not just in the local browser. (#​721)
• It's no longer possible to create the same user twice (#​745)
• Fix wide substring filters (#​738)
• Don't log the database password if provided in the connection URL (#​735)
• Fix a panic when postgres uses a different collation (#​821)
• The UI now defaults to the user ID for users with no display names (#​843)
• Fix searching for users with more than one memberOf filter (#​872)
• Fix compilation on Windows (#​932) and Illumos (#​964)
• The UI now correctly detects whether password resets are enabled. (#​753)
• Fix a missing lowercasing of username when changing passwords through LDAP (#​1012)
• Fix SQLite writers erroring when racing (#​1021)
• LDAP sessions no longer buffer their logs until unbind, causing memory leaks (#​1025)

Performance

• Only expand attributes once per query, not per result (#​687)

Security

• When asked to send a password reset to an unknown email, sleep for 3 seconds and don't print the email in the error (#​887)

New services

Linux user accounts can now be managed by LLDAP, using PAM and nslcd.

• Apereo CAS server
• Carpal
• Gitlab
• Grocy
• Harbor
• Home Assistant
• Jenkins
• Kasm
• Maddy
• Mastodon
• Metabase
• MegaRAC-BMC
• Netbox
• OCIS
• Prosody
• Radicale
• SonarQube
• Traccar
• Zitadel

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[carpenike-bot]

--- kubernetes/cluster-0/apps/security/lldap/app Kustomization: flux-system/cluster-apps-lldap HelmRelease: security/lldap

+++ kubernetes/cluster-0/apps/security/lldap/app Kustomization: flux-system/cluster-apps-lldap HelmRelease: security/lldap

@@ -42,13 +42,13 @@

               TZ: America/New_York
             envFrom:
             - secretRef:
                 name: lldap-secret
             image:
               repository: ghcr.io/lldap/lldap
-              tag: v0.5.0
+              tag: v0.6.1
             resources:
               limits:
                 memory: 128M
               requests:
                 cpu: 5m
                 memory: 36M

[carpenike-bot]

🦙 MegaLinter status: ❌ ERROR

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
❌ COPYPASTE	jscpd	yes		2	no	1.44s
✅ REPOSITORY	git_diff	yes		no	no	0.04s
✅ REPOSITORY	secretlint	yes		no	no	3.83s
✅ YAML	prettier	1		0	0	0.46s
✅ YAML	yamllint	1		0	0	0.66s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff