Thank you to the contributors in this release: @stefan-kolb, @arpitjain099, @istyf, @jackchenjc, @skartikey, @mschm, and @jminardi.

go get github.com/gopcua/[email protected]

gopcua ships both a client and a server. Each item is tagged (client) or (server) for which side it affects, and items that only matter to developers building against the library API carry API. If you consume gopcua through Telegraf or benthos-umh, the plain (client) items are the runtime behavior you get automatically; (server) items only matter if you build a server on gopcua.

No breaking changes in this release.

Security

• A malformed message can no longer make the decoder allocate far more memory than the message itself. The declared element count of an array is now checked against the bytes actually remaining before the slice is allocated, so a 4-byte body claiming 100 million elements fails immediately instead of allocating roughly 800 MB first; counts near MaxInt32 could push a process into multi-GB allocation and out-of-memory. Reachable on both sides, by a server decoding a client request and by a client decoding a server or man-in-the-middle response (#884) (client + server)

New

• PKCS#8 private keys (BEGIN PRIVATE KEY) are now accepted wherever a private key is loaded. These are the default output of OpenSSL 3.x, Java and .NET, and previously failed with Failed to decode PEM block with private key; only PKCS#1 (BEGIN RSA PRIVATE KEY) worked (#871) (client + server)
• Certificate and key loading now detects PEM or DER from the file contents rather than the extension, accepts a full chain of leaf plus intermediates, and reports a PKCS#1/PKCS#8 mismatch as a named error instead of a generic decode failure (#872) (client + server)
• A gopcua server now supports Browse continuation points and BrowseNext, so a client can page through a node that has more references than fit in one response instead of silently receiving a truncated list (#865) (server)

Fixes

• Subscriptions now recover after a reconnect when one of them cannot be restored. Previously the client reported itself Connected with no live subscription and a dead publish loop, delivered no data again, and never retried; it now rebuilds the session and retries, waiting between attempts instead of hammering the server (#877) (client)
• A subscription being restored after a reconnect no longer loses every monitored item because the server rejected one of them. A node that disappeared during the outage is dropped on its own and logged, and the items the server accepted keep delivering data (#887) (client)
• Monitoring a batch of nodes no longer gives every item in the batch the same client handle, which could deliver a node's values under the wrong node's identity (#881) (client)
• A server node that denies current-read is browsable again. AccessLevel governs the Value attribute only, so BrowseName, NodeClass, DisplayName and the rest are readable; previously such a node answered Bad_UserAccessDenied for every attribute and could not be described at all (#878) (server)
• A server no longer panics when a client writes the DataType attribute in the ordinary NodeId form. The attribute is spec-typed NodeId, but the server asserted ExpandedNodeId without checking, so a conformant write crashed the process on the next browse that resolved a reference to that node (#867) (server)
• RegisterNodes now returns the node IDs it was given, which is the required behaviour for a server that performs no node-access optimization, and UnregisterNodes ignores IDs it does not know instead of failing (#867) (server)
• The UserAccessLevel attribute is stored with the type the read path expects, so reading it works (#875) (server)

Full Changelog: v0.9.0...v0.9.1

v0.9.1 Latest

Latest

Compare

Choose a tag to compare

Thank you to all the contributors in this release: @jminardi, @diericd, @istyf, @semihbkgr, @skartikey, @sruehl, @mvandergrift, @oliverpool, @skaldesh, @bostroemc, @kung-foo, @mschm, and @led0nk for reviews. It was a difficult year since we switched the core maintainer, and it took us some time to get into a good working mode. This release is our summarized work from the past year.

go get github.com/gopcua/[email protected]

gopcua ships both a client and a server. Each item is tagged (client) or (server) for which side it affects, and items that only matter to developers building against the library API carry API. If you consume gopcua through Telegraf or benthos-umh, the plain (client) items are the runtime behavior you get automatically; (client, API) items only matter if you write Go code against gopcua; (server) items only matter if you build a server on gopcua.

Breaking change (API): Node operations now run against a Client interface instead of the concrete *Client type (#847). If you construct nodes against the concrete client type, update those call sites. See the "List of Breaking Changes" in the README.

New

• Basic256Sha256 channels now complete a handshake end to end in both Sign and SignAndEncrypt mode between a gopcua client and server, so you can run signed and encrypted connections (client + server)
• A StateChangedFunc callback lets a client run your own code on every connection-state change (Connected, Connecting, Disconnected, Reconnecting), for example to log drops, update health, or trigger reconnect-aware logic (client, API)

Improvements

• Monitoring a batch of nodes now succeeds for the valid ones instead of failing the whole batch when one node ID is bad; each rejected node is reported individually as a monitor.ItemError you can read with errors.As (client)
• Node operations now run against a client interface, so you can inject a mocked client when unit-testing code that calls node methods; if you construct nodes against the concrete client type, review those call sites (client, API)

Fixes

• Reading or subscribing to large sets of nodes (roughly a thousand or more) over an encrypted connection no longer drops the connection with an EOF; smaller requests and unencrypted connections were not affected (client + server)
• Subscriptions now survive a reconnect: after a network interruption the client no longer loses its subscriptions and stops receiving data until it is restarted (client)
• Recovering missed data after a reconnect no longer hangs in an endless retry loop or silently drops the recovered notifications (client)
• Connecting to servers that present their certificate as a chain of leaf plus intermediate certificates, such as Siemens WinCC Unified Runtime, now works (client)
• Browsing now returns a usable node ID for references typed as ExpandedNodeID instead of nil, which previously caused a panic (client)
• Calling Close on a client that never established a session no longer panics (client)
• expvar counters (read, send, dial, subscription) render again under /debug/vars on Go 1.23, where nested stats had shown as empty objects (client, API)
• A server no longer crashes when a client writes to a node in a namespace that does not exist; it returns Bad_NodeIdUnknown (server)
• Server writes to non-Value attributes such as Description or DisplayName now report success instead of a false bad-attribute error (server)
• Server responses larger than the negotiated chunk size, such as browsing a folder with many nodes, are now split across multiple chunks instead of dropping the connection (server)
• A server now returns a valid, non-zero session timeout, so strict clients such as UaExpert no longer fail to connect with BadTimeout (server)
• Creating a folder node in a server address space no longer panics (server)

The server now also sets the ReceiverCertificateThumbprint on its handshake response, so strict clients (Prosys, UaExpert) accept encrypted channels against a gopcua server (server).

Full Changelog: v0.8.0...v0.9.0

v0.9.0

Compare

Choose a tag to compare

Thank you to all the contributors in this release: @jminardi, @diericd, @istyf, @semihbkgr, @skartikey, @sruehl, @mvandergrift, @oliverpool, @skaldesh, @bostroemc, @kung-foo, @mschm, and @led0nk for reviews. It was a difficult year since we switched the core maintainer, and it took us some time to get into a good working mode. This release is our summarized work from the past year.

This is a pre-release for testing. Please try it against your servers and report issues before the final v0.9.0. It installs only on explicit opt-in:

go get github.com/gopcua/[email protected]

gopcua ships both a client and a server. Each item is tagged (client) or (server) for which side it affects, and items that only matter to developers building against the library API carry API. If you consume gopcua through Telegraf or benthos-umh, the plain (client) items are the runtime behavior you get automatically; (client, API) items only matter if you write Go code against gopcua; (server) items only matter if you build a server on gopcua.

New

• Basic256Sha256 channels now complete a handshake end to end in both Sign and SignAndEncrypt mode between a gopcua client and server, so you can run signed and encrypted connections (client + server)
• A StateChangedFunc callback lets a client run your own code on every connection-state change (Connected, Connecting, Disconnected, Reconnecting), for example to log drops, update health, or trigger reconnect-aware logic (client, API)

Improvements

• Monitoring a batch of nodes now succeeds for the valid ones instead of failing the whole batch when one node ID is bad; each rejected node is reported individually as a monitor.ItemError you can read with errors.As (client)
• Node operations now run against a client interface, so you can inject a mocked client when unit-testing code that calls node methods; if you construct nodes against the concrete client type, review those call sites (client, API)

Fixes

• Reading or subscribing to large sets of nodes (roughly a thousand or more) over an encrypted connection no longer drops the connection with an EOF; smaller requests and unencrypted connections were not affected (client + server)
• Subscriptions now survive a reconnect: after a network interruption the client no longer loses its subscriptions and stops receiving data until it is restarted (client)
• Recovering missed data after a reconnect no longer hangs in an endless retry loop or silently drops the recovered notifications (client)
• Connecting to servers that present their certificate as a chain of leaf plus intermediate certificates, such as Siemens WinCC Unified Runtime, now works (client)
• Browsing now returns a usable node ID for references typed as ExpandedNodeID instead of nil, which previously caused a panic (client)
• Calling Close on a client that never established a session no longer panics (client)
• expvar counters (read, send, dial, subscription) render again under /debug/vars on Go 1.23, where nested stats had shown as empty objects (client, API)
• A server no longer crashes when a client writes to a node in a namespace that does not exist; it returns Bad_NodeIdUnknown (server)
• Server writes to non-Value attributes such as Description or DisplayName now report success instead of a false bad-attribute error (server)
• Server responses larger than the negotiated chunk size, such as browsing a folder with many nodes, are now split across multiple chunks instead of dropping the connection (server)
• A server now returns a valid, non-zero session timeout, so strict clients such as UaExpert no longer fail to connect with BadTimeout (server)
• Creating a folder node in a server address space no longer panics (server)

The server now also sets the ReceiverCertificateThumbprint on its handshake response, so strict clients (Prosys, UaExpert) accept encrypted channels against a gopcua server (server).

Full Changelog: v0.8.0...v0.9.0-rc1

v0.9.0-rc1 Pre-release

Pre-release

Compare

Choose a tag to compare

Changelog

• 9dfd8bd add DialTimeout and cleanup ResolveEndpoint (#372)
• c59e64d update CHANGELOG
• 5cf4db0 update CHANGELOG

• add DialTimeout and cleanup ResolveEndpoint (#372)

v0.8.0

Compare

Choose a tag to compare

Changelog

• a7aa972 Ignore trailing slashes when checking matching endpoints.
• f8b3589 Merge pull request #770 from gopcua/issue-768-call-method-no-input-args
• 0069fd1 Merge pull request #788 from gopcua/issue-783-trailing-slash
• 22fce09 github: auto-close stale issues/prs
• f7b9bfb tests/python: add test for issue #768
• 7128e13 tests/python: allow setting of fields in constructor
• a095727 tests/python: fix typo
• f70e838 tests/python: use ua.CallMethodResult
• 9288bb2 update README
• 8924493 update README

• Add test for method call with no inputs and an array of extobjs as output (#770)
• Server: Ignore trailing slashes when checking matching endpoints (#788)

v0.7.5

Compare

Choose a tag to compare

Changelog

• 2137c45 - added security mode check when creating the channel to ensure proper securityMode is provided - removed overwrite in readChunk since it will not reach without valid securityMode
• 4470d9b Check if node value is a func() *Datavalue and don't wrap if it is.
• db5fdbf Merge pull request #778 from gopcua/server_accesslevels
• ad9aac9 Merge pull request #780 from ioansiran/main
• 985a6f0 Removed hardcoded SecurityMode in SecureChannel readChunk method.
• 4b38728 add Access() check function to Node
• e95b012 add access level integration tests
• b210bf4 add betterexamples of access levels in the server
• 3012e9f added default value when it gets a bad security mode
• 326bc4a handle int type passed into DataValueFromValue
• 5d04457 implement linter fixes
• cabb348 make datavaluefromvalue better encode the value
• 1b47c9f re-run tests
• 4f48815 retract v0.7.2
• f23711f start checking node attribute access rules
• 090ef6c update CHANGELOG

• Removed hardcoded SecurityMode in SecureChannel readChunk method (#780)
• Obey access levels in the server (#778, #776)

v0.7.4

Compare

Choose a tag to compare

Changelog

• 808cd22 Add unit test for security auth policy uri fallback.
• ef1c8c8 Merge pull request #767 from gopcua/issue-741-state-change-channel
• c25f030 Merge pull request #771 from piggito/write-deadline
• ccecc84 Merge pull request #779 from gopcua/pr-706-fallback-auth-policy-uri
• 8c72b97 Merge pull request #785 from oliverpool/prevent-panic-ctx-cancel
• 2943efa Prevent panic on context cancellation
• e9c20e0 Remove auth policy check in client.
• fae2506 Set conn write deadline for sendAsyncWithTimeout
• 454da9c add error check, extend test
• dcf5e89 add fmt option
• 4a2e53b adjust error message
• 65c1388 bump to go1.23
• f44bb63 client: add connState channel
• 1b1adfb config.go: setting session.AuthPolicyURI from endpoint when identityToken does not provide it
• 96f3cb8 fix integration test
• 07d192e gofmt
• 4fc3aa8 started test for unset useridentitytoken
• e4335a9 using Username seciruty ID

v0.7.2 changes

• server: Prevent panic on context cancellation (#785)
• Add Fallback to set session.AuthPolicyURI (#706, #779)
• client: send events con connection changes (#741, #767)
• uasc: Set conn write deadline for sendAsyncWithTimeout (#771)

v0.7.3 changes

• uasc: Removed hardcoded SecurityMode in SecureChannel reacDhunk method (#780)
• server: obay access levels in the server (#778)

v0.7.3

Compare

Choose a tag to compare

Retracted since I've tagged the wrong branch

Only the tag and the CHANGELOG are on the wrong branch. The code is on main.

Changelog

• 578c8e5 Merge pull request #775 from gopcua/issue-774-read-failed
• 8f6df6d bump go to 1.23/1.24
• c58424a client: use nil-checked secure channel
• a5114da update CHANGELOG

• client: use nil-checked secure channel (#775)

v0.7.1

Compare

Choose a tag to compare

Changelog

• 3652fd6 Mark datavalue's as having values.
• f4f7fae Merge pull request #766 from gopcua/server_UseDVs
• 4a70b13 Migrate attributes to use DataValues instead of Variants.
• 8a8675f Update CHANGELOG
• 768858f Update LICENSE
• 4476e95 Update README
• 00d3eff remove test example

• server: use DataValue instead of Variant for node attributes (#766)

v0.7.0

Compare

Choose a tag to compare

Changelog

• d948bf8 Address review comment
• f89c7b6 Merge pull request #764 from jackchenjc/issue-710
• cdb7218 monitor: add modification functionality
• 6b1ec73 update CHANGELOG

• monitor: add modification functionality (#764)

v0.6.5

Compare

Choose a tag to compare

• subscription: add ModifySubscription functionality (#714)

• Remove calls to log.Fatal (#762,#763)

• uasc: remove debug log (#761,#760)
• Test with stretchr/verify (#757,#758)
• fix: regression in examples introduced by #753 (#759)

• Fix Variant to handle nil slices (#755,#678)
• Set DataValue.Value to Variant(nil) for no value (#756,#722)
• Split id_gen.go into smaller files (#680,#679)

• Add Wolfram Manufacturing to README (#707)
• example/crypto: add auth-mode in error message (#720)
• Connection refused with valid security options (#718)
• subscription: add SetMonitoringMode functionality (#711,#712)
• docs: add more targets to README (#725)
• remove pkg dependency (#723,#731)
• add IOTech to README (#747)
• Add server implementation (#737)
• use maps and slices from stdlib (#754)
• Add error return to SelectEndpoint function (#753)