- Update to 3.4.5

* Security fixes:
    + CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce str input in
      ldap.filter.escape_filter_chars with escape_mode=1; ensure proper
      escaping. (bsc#1251912)
    + CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in
      ldap.dn.escape_dn_chars to \00 per RFC 4514. (bsc#1251913)
  * Fixes:
    + ReconnectLDAPObject now properly reconnects on UNAVAILABLE,
      CONNECT_ERROR and TIMEOUT exceptions (previously only SERVER_DOWN),
      fixing reconnection issues especially during server restarts
    + Fixed syncrepl.py to use named constants instead of raw decimal values
      for result types
    + Fixed error handling in SearchNoOpMixIn to prevent a undefined variable
      error
- Switch to building with pip, wheel and the pyproject macros.
- Fix filename due to new setuptools.

0001-Use-reentrant-libldap.patch

@@ -0,0 +1,25 @@
+From de85e6b833fc43f273f688680d7a95e9a8330704 Mon Sep 17 00:00:00 2001
+From: William Brown <william@blackhats.net.au>
+Date: Tue, 5 Aug 2025 15:24:49 +1000
+Subject: [PATCH] Use reentrant libldap
+
+---
+ Build/setup.cfg.suse-linux | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Build/setup.cfg.suse-linux b/Build/setup.cfg.suse-linux
+index 0a48ef2..d715737 100644
+--- a/Build/setup.cfg.suse-linux
++++ b/Build/setup.cfg.suse-linux
+@@ -15,7 +15,7 @@ extra_objects =
+ # Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
+ # This needs recent OpenLDAP 2.0.26+ or 2.1.3+ built with
+ # ./configure --with-cyrus-sasl --with-tls
+-libs = ldap_r lber sasl2 ssl crypto
++libs = ldap lber sasl2 ssl crypto
+ 
+ [install]
+ # Installation options
+-- 
+2.39.5 (Apple Git-154)
+

python-ldap.changes

@@ -1,10 +1,29 @@
 -------------------------------------------------------------------
-Mon Jun 30 09:36:40 UTC 2025 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+Fri Oct 24 03:09:41 UTC 2025 - Steve Kowalik <steven.kowalik@suse.com>
 
-- Switch build system from setuptools to pyproject.toml
+- Update to 3.4.5:
-  * Add python-pip and python-wheel to BuildRequires
+  * Security fixes:
-  * Replace %python_build with %pyproject_wheel
+    + CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce str input in
-  * Replace %python_install with %pyproject_install
+      ldap.filter.escape_filter_chars with escape_mode=1; ensure proper
+      escaping. (bsc#1251912)
+    + CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in
+      ldap.dn.escape_dn_chars to \00 per RFC 4514. (bsc#1251913)
+  * Fixes:
+    + ReconnectLDAPObject now properly reconnects on UNAVAILABLE,
+      CONNECT_ERROR and TIMEOUT exceptions (previously only SERVER_DOWN),
+      fixing reconnection issues especially during server restarts
+    + Fixed syncrepl.py to use named constants instead of raw decimal values
+      for result types
+    + Fixed error handling in SearchNoOpMixIn to prevent a undefined variable
+      error
+- Switch to building with pip, wheel and the pyproject macros.
+- Fix filename due to new setuptools.
+
+-------------------------------------------------------------------
+Tue Aug  5 05:27:36 UTC 2025 - William Brown <william.brown@suse.com>
+
+- Allow building against OpenLDAP 2.5
+  * 0001-Use-reentrant-libldap.patch
 
 -------------------------------------------------------------------
 Thu Aug 29 07:22:28 UTC 2024 - Markéta Machová <mmachova@suse.com>

python-ldap.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-ldap
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -18,13 +18,14 @@
 
 %{?sle15_python_module_pythons}
 Name:           python-ldap
-Version:        3.4.4
+Version:        3.4.5
 Release:        0
 Summary:        Python LDAP interface
 License:        Python-2.0
 Group:          Development/Libraries/Python
 URL:            https://www.python-ldap.org/
-Source0:        https://files.pythonhosted.org/packages/source/p/python-ldap/python-ldap-%{version}.tar.gz
+Source0:        https://files.pythonhosted.org/packages/source/p/python-ldap/python_ldap-%{version}.tar.gz
+Patch0:         0001-Use-reentrant-libldap.patch
 BuildRequires:  %{python_module devel}
 BuildRequires:  %{python_module pip}
 BuildRequires:  %{python_module pyasn1 >= 0.3.7}
@@ -52,7 +53,7 @@ for that purpose.  Additionally the package contains modules for other
 LDAP-related stuff (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, etc.).
 
 %prep
-%setup -q
+%autosetup -p1 -n python_ldap-%{version}
 cp Build/setup.cfg.suse-linux setup.cfg
 
 %build
@@ -69,7 +70,7 @@ PATH=/sbin:/usr/sbin:/usr/local/bin:/usr/bin:/bin %pyunittest_arch discover -v -
 %license LICENCE
 %doc README Demo CHANGES TODO
 %{python_sitearch}/ldap
-%{python_sitearch}/python_ldap-%{version}*info
+%{python_sitearch}/python_ldap-%{version}.dist-info
 %{python_sitearch}/slapdtest
 %{python_sitearch}/ldapurl.py
 %{python_sitearch}/ldif.py