Bump node-opcua from 2.175.3 to 2.181.1

[dependabot]

Bumps node-opcua from 2.175.3 to 2.181.1.

Release notes

Sourced from node-opcua's releases.

v2.181.0

node-opcua 2.181.0 - One small step for the version number, one giant leap for nodeset loading.

Compare: v2.180.0...v2.181.0 · 180 commits · 41 pull requests

A security, conformance and performance release, and a large one. The application private key can now live in an HSM, a cloud KMS or a TPM and never be read by node-opcua. Loading a NodeSet2 file takes well under half the time it did, thanks to precompiled images shipped with node-opcua-nodesets and a rewritten loader. A campaign against the OPC Foundation Compliance Test Tool (CTT) fixed eleven conformance defects in Read, Write, Subscriptions, GetEndpoints and the server capabilities. The published API of node-opcua-address-space has been repaired so that what TypeScript accepts is what exists at run time. Underneath, the whole monorepo was prepared for a future ESM migration without changing the module format: require("node-opcua") works exactly as before.

Highlights

• 🔐 HSM/KMS-held application keys end to end (secure channels, session signatures, user tokens, push certificate management). File-based keys are unchanged and not deprecated.
• ⚡ NodeSet2 loading is 2 to 2.5 times faster by default, with a precompiled image beside every nodeset of the catalog and zero configuration.
• 🧩 OPCUAServer({ nodesets: [...] }) loads paths, gzip files, URLs and streams in one list; nodeset_filename is deprecated.
• ✅ Eleven CTT conformance fixes, including subscription keep-alive timing, MaxAge, DateTime precision and operation limits.
• 🔔 subscriptionId_changed client event when a subscription had to be recreated during reconnection (fixes #1368).
• 📦 node-opcua-client-browser ships its ESM build again: previous tarballs had no dist-esm folder at all.

---

⚠️ Behaviour changes to review before upgrading

None of these need code changes for a typical application, but each one is observable.

Server operation limits now have real defaults and are enforced. In 2.180.0 every OperationLimits value defaulted to 0 (not exposed, not enforced). The defaults are now 10 000 for Read, Write, Browse, RegisterNodes, TranslateBrowsePaths and MonitoredItemsPerCall, and 1 000 for MethodCall and the two HistoryRead limits. A request above a limit is answered with BadTooManyOperations. An explicit 0 in serverCapabilities.operationLimits still means "not exposed". [9e06cf0a3] [63c4eb9e7] [56ef7ee03]

ensureObjectIsSecure keeps the structure browsable by default. The nodes of a secured object are now visible to every session, including Anonymous, and only Read, Write and Call stay restricted to the admin roles on a signed and encrypted channel. This is what the CTT expects of the mandatory Identities of the well-known roles. Pass { hideStructure: true } to keep the previous behaviour. [28a71d160] [a62d2cfd8]

A subscription's first message goes out after one publishing interval, not immediately. A PublishRequest that arrived before the first tick used to be answered in about 20 ms. Part 4 §5.13.1 requires the first keep-alive after one cycle. Tests that timed the first response as "immediate" will need adjusting. [9b9f8e776]

SetMonitoringMode to the mode an item already has returns Good. It returned BadNothingToDo per item, which the specification reserves for the service-level result of an empty request. [833247c7d]

OPCUAServer.initialize() rejects when a nodeset fails to load. It used to resolve with a half-loaded address space, and the engine callback was invoked twice. [50c86bf30]

Two write status codes corrected. A write allowed by AccessLevel but withheld by UserAccessLevel returns BadUserAccessDenied (was BadWriteNotSupported). Writing Historizing on a variable without an HA Configuration returns BadNotWritable (was BadNotSupported). [a993a716a] [b277a1b54]

Read semantics aligned with Part 4. A Read with MaxAge refreshes a cached ServerTimestamp older than MaxAge. TimestampsToReturn.Source no longer leaks the server timestamp. A BadDataEncodingInvalid result carries the requested timestamps. [9756c306e] [3d505f758] [48668f13d]

GetEndpoints serves ApplicationName in the first requested LocaleId instead of a hard-coded en-US. [efc6ccdf1]

Child accessors are inherited, non-enumerable, and never shadow a member. Object.hasOwn(node, "enabledState") is now false and Object.keys(node) no longer lists children, while "enabledState" in node is true on every node. A child named like an attribute, a method or a field (eventNotifier, namespaceUri, Then) is no longer reachable as node.eventNotifier; use getChildByName. Only a structural reference (component, property, subtype, organizes) makes a dotted child; a node that is only an event source or notifier of its parent is not one. [2db095c15] [30feed20e]

INamespace gained members. It now extends INamespaceIterable (nodeIterator, objectTypeIterator, objectTypeCount, the same for variable, data and reference types, aliasCount). Code that implements INamespace by hand must add them; code that only consumes the interface is unaffected. [07d3ed4cf]

A method's ParentNodeId is now translated into the address space's namespace table like every other id of a loaded nodeset; it used to be passed through as the file's string. [4f3550520]

dumpXml can no longer be imported from node-opcua. It was declared, exported by no module and undefined at run time. [b22a0dd7c]

Internal secure-channel plumbing changed. MessageBuilder, ClientSecureChannelLayer, ServerSecureChannelLayer and OPCUAServerEndPoint construction are tagged @internal and now work on key operations only. invalidPrivateKey, MessageBuilderOptions.privateKey, the channel and endpoint getPrivateKey() and the endpoint certificateChain + privateKey options are deleted. Applications configuring security through OPCUAClient, OPCUAServer and OPCUACertificateManager options are not affected. See migrating_to_key_operations.md. [3961b5f59]

node-opcua-nodesets grows by about 0.8 MB for the precompiled images. [3811e2998]

... (truncated)

Commits

• b3b762e v2.181.1
• c4cd90a fix(transport): never raise a MaxMessageSize the client asked for
• 9594446 fix(test): keep the sizing tests type-checkable
• 1db0fa5 fix(server): size a PublishResponse to the channel, not to a count
• c85a4a7 test(server): 985 T5 expects the malformed-token code for a corrupted blob
• 5187d05 fix(server): a UserNameIdentityToken without the serverNonce is invalid
• 675f175 chore(server): drop the last non-null assertion in GetEndpoints
• 0c896e4 chore: fix biome warnings
• ecc90e5 test(address-space): count actual yields instead of sampling with a timer
• f8f472c v2.181.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)