slapd-2.5 in debian testing

[Stefan Weichinger]

greetings

I am currently researching how to get a (maintained by upstream) 
openldap-2.5 or -2.6 on Debian 11 VMs.

As far as I see debian stable still only brings 2.4, a ldap-guru told me 
not to use that in production because of security concerns ...

Could you help me to sort out my options?

- run 2.5 from "testing" repo on a "stable" machine?

If yes, are there any howtos on what to do .. ?

- wait for 2.5 in stable?

will that come, if yes, when?

The customer wants a longterm solution with security, so I am caught 
between using "stable" and avoiding an insecure package

maybe 2.4 isn't as bad as that guru told me, and we could easily wait 
for 2.5 coming in a few months?

Sorry if I ask an FAQ ...

Thanks for any help, Stefan