Bump node-opcua from 2.175.3 to 2.178.0

[dependabot]

Bumps node-opcua from 2.175.3 to 2.178.0.

Release notes

Sourced from node-opcua's releases.

🚀 v2.178.0

Released: 20 August 2026

The theme of this release is private-key protection and seamless certificate rotation. It incorporates the newest security-hardened PKI and crypto modules — node-opcua-pki 6.20.0 and node-opcua-crypto 5.6.0 — and builds on them so that servers and clients benefit directly.

New Features

• Encrypted-at-rest private keys. OPCUACertificateManager now accepts privateKeyPassphrase (a string or an async function) and privateKeyProvider. OPCUAServer / OPCUAClient resolve the possibly encrypted key once during initialization, so the synchronous secure-channel layer never touches the disk again. A key pushed through push certificate management is written already encrypted, never in clear. Default behavior (no passphrase) is unchanged.
• Seamless server certificate rotation. Server secure channels are now bound to their creation-time key pair, as OPC UA Part 6 (6.7.2 / 6.7.4) defines the asymmetric handshake per SecureChannel, not per current server state. Combined with the new closeChannelsOnApplyChanges: false option of installPushCertificateManagementOnServer, rotating the server certificate no longer breaks token renewal on live channels: connected clients — unmodified third-party clients included — keep working, reconnects spread over a token lifetime instead of all at once. The default (close channels immediately) is unchanged and remains the right choice for a compromised key.

Fixes

• Client keeps its session across a server certificate rotation. ActivateSession now signs against the server's current certificate instead of the one captured at CreateSession; previously the reactivation was rejected and the client silently fell back to a new session (the sessionId changed on every rotation).
• Certificate rotation no longer leaves a stale private key in use. After UpdateCertificate/ApplyChanges, the rotated key is re-resolved instead of served from the certificate manager's lifetime cache, and executeUpdateCertificate compares against the same cached key that signed the CSR — fixing handshake signature failures and spurious BadSecurityChecksFailed ("certificate doesn't match privateKey") after a rotation.
• Nodeset loading survives a malformed node. A bad <Value> in one node (e.g. Opc.Ua.PADIM.NodeSet2.xml) no longer silently aborts post-loading and leaves the address space without a DataTypeManager; failing tasks are logged and skipped, and the eventual error names the real cause (#1564).

Updated PKI and crypto modules — what you get transitively

node-opcua-pki 6.20.0

• Private-key directories are created and repaired as 0700 and key files as 0600 (POSIX; documented no-op on Windows).
• CertificateManager and CertificateAuthority support passphrase-protected private keys: a fresh key is written encrypted, an existing plaintext key is encrypted in place on initialize, and a missing or wrong passphrase fails closed with PrivateKeyPassphraseRequiredError.
• OpenSSL is now invoked without a shell, with a curated environment allowlist; passphrases reach OpenSSL only via -passin/-passout env:, never a command-line string or a debug log.
• The threat model is documented in docs/private-key-protection.md.

node-opcua-crypto 5.6.0

• Native PKCS#12 (PFX) support — createPfx() / parsePfx() implement RFC 7292 in pure JavaScript, no OpenSSL binary needed. Parsing handles DER and BER files and pairs certificate to key via localKeyId; writing uses the OpenSSL 3.x defaults (PBES2, PBKDF2-HMAC-SHA256, AES-256-CBC).
• Passphrase-encrypted private keys — readPrivateKey accepts a passphrase and fails closed on an encrypted key without one; writePrivateKeyFile writes encrypted PKCS#8. This is the primitive the privateKeyPassphrase features above are built on.
• Private key files are written with mode 0600, and pre-existing looser permissions are tightened.

Together these mean a node-opcua server can now keep its OPC UA application private key encrypted on disk end to end — generation, CSR signing, push-certificate updates, and secure-channel use — without any change for existing plaintext-key deployments.

Full changelog: node-opcua/node-opcua@v2.177.1...v2.178.0

🚀 v2.177.0

What's Changed

• fix(server-configuration): give each TrustList a real, unique backing file by @​erossignon in node-opcua/node-opcua#1555
• feat(alias-name-client): recover the per-target ReferenceType of an AliasName by @​erossignon in node-opcua/node-opcua#1559
• docs(alias-name): bless lastChange.touch() for out-of-band store mutations by @​erossignon in node-opcua/node-opcua#1558
• feat(server): supported API for contributing Server_ServerArray entries (Part 17 Annex C.2) by @​erossignon in node-opcua/node-opcua#1557
• fix(nodeid): coerceExpandedNodeId no longer drops namespaceUri and serverIndex by @​erossignon in node-opcua/node-opcua#1556
• fix(server): a session's SessionContext now sees the whole IServerBase by @​erossignon in node-opcua/node-opcua#1560
• fix(role-set): X509Subject matching silently dropped the OU by @​erossignon in node-opcua/node-opcua#1561

Full Changelog: node-opcua/node-opcua@v2.176.0...v2.177.0

v2.176.0

node-opcua 2.176.0 — release notes

... (truncated)

Commits

• d0e850e v2.178.0
• b756d36 test: fix flaky GZZE3 - don't demand backoff events that may never fire
• 71cb152 fix: don't abandon nodeset post-loading when one task throws (#1564)
• 21260a3 feat(secure-channel): bind server channels to their creation-time key pair
• a7c55e4 feat(push-cert): opt out of closing channels on ApplyChanges
• e1b59b2 fix(client): reactivate session with the server's current certificate
• f452f20 test: replace SCT-3's fixed 6s wait with a poll for reconnection
• dd0f1ea fix: re-resolve rotated private key without pki's stale per-instance cache
• 79edfed feat: support encrypted-at-rest private keys via pki privateKeyPassphrase
• b0339a5 fix(server-configuration): compare against CertificateManager's cached key, n...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #62.