Azure/azure-iot-sdk-java

This release contains a security vulnerability fix.
Applications using com.microsoft.azure.sdk.iot:iot-device-client should upgrade to version 1.15.0.
Applications using com.microsoft.azure.sdk.iot:iot-deps should upgrade to version 0.8.0.
Applications using com.microsoft.azure.sdk.iot:iot-service-client should upgrade to version 1.16.0.
Applications using com.microsoft.azure.sdk.iot.provisioning:provisioning-service-client should upgrade to version 1.3.5.

Java IotHub Device Client (com.microsoft.azure.sdk.iot:iot-device-client:1.15.0)

• Enable AMQPS and AMQPS_WS communication with module client
• Enable Symmetric key attestation support over HTTP
• Remove support for WoSign trusted cert
• Set hsm http header limit
• Remove potentially sensitive information from all log statements

Bug Fixes
• Increased time limit for waiting for SUBACK when opening MQTT connection
• Fix issue where streams did not always close gracefully
• Fix issue where random number generation was not cryptographically secure
• Fix issue where constructors called into non-final methods with potentially sensitive information

Java IotHub Service Client (com.microsoft.azure.sdk.iot:iot-service-client:1.16.0)

• Removed implied exception details from http exceptions
• Added reporting of device capabilities in device twin

Bug Fixes
• Fix issue where streams did not always close gracefully
• Fix issue where random number generation used to generate keys was not cryptographically secure
• Fix issue where constructors called into non-final methods with potentially sensitive information

Java SDK Dependency (com.microsoft.azure.sdk.iot:iot-deps:0.8.0)

• Remove support for WoSign trusted cert
• Set certificate file maximum length

Bug Fixes
• Fix issue where streams did not always close gracefully
• Fix issue where constructors called into non-final methods with potentially sensitive information

Java Provisioning Device Client (com.microsoft.azure.sdk.iot.provisioning:provisioning-device-client:1.4.0)

• Enable Symmetric key attestation support over HTTP
• Fix MQTT exception message to not mention AMQP

Java Provisioning Service Client (com.microsoft.azure.sdk.iot.provisioning:provisioning-service-client:1.3.5)

Bug Fixes
• Fix issue where constructors called into non-final methods with potentially sensitive information

Java Provisioning Security Provider (com.microsoft.azure.sdk.iot.provisioning:security-provider:1.2.0)

• Enable Symmetric key attestation support over HTTP
• Remove support for WoSign trusted cert

Merge Pull Request

#394, #393, #392, #398, #399, #401, #405

Maven packages
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-device-client/1.15.0/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-service-client/1.16.0/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-deps/0.8.0/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-device-client/1.4.0/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-service-client/1.3.5/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/security-provider/1.2.0/jar

Java IotHub Device Client (com.microsoft.azure.sdk.iot:iot-device-client:1.14.2)

• update user agent string for Android
• Enable fileupload with SelfSigned device client (#371)
• Add support for Android API 28

Bug Fixes
• Fix bug where module clients communicating with IotHub over mqtt subscribed to inputs channel
• Fix thread leaks due to reconnection failure on amqp and mqtt
• Fix issue where mqtt layer unacknowledgedSentMessages never removed messages after they were ack'd (#364)
• Fix issue where amqp cbs auth did not proactively renew sas token (#365)
• Fix issue where connecting over unix socket to hsm for module client resulted in broken pipe occasionally (#353)

Java IotHub Service Client (com.microsoft.azure.sdk.iot:iot-service-client:1.15.2)

• update user agent string for Android
• Add support for Android API 28

Java Provisioning Device Client (com.microsoft.azure.sdk.iot.provisioning:provisioning-device-client:1.3.4)

• update user agent string for Android

Java Provisioning Service Client (com.microsoft.azure.sdk.iot.provisioning:provisioning-service-client:1.3.4)

• update user agent string for Android

Java X509 Provider (com.microsoft.azure.sdk.iot.provisioning.security:x509-provider:1.1.2)

• Remove explicit specifiying BC provider to support Android Pie (#348)

Java SDK Dependency (com.microsoft.azure.sdk.iot:iot-deps:0.7.2)

• Remove explicit specifiying BC provider to support Android Pie (#348)

Maven packages
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-device-client/1.14.2/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-service-client/1.15.2/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-device-client/1.3.4/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-service-client/1.3.4/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning.security/security-provider/1.1.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning.security/tpm-provider/1.1.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning.security/x509-provider/1.1.2/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-deps/0.7.2/jar

Java IotHub Device Client (com.microsoft.azure.sdk.iot:iot-device-client:1.14.1)

• Improved deserializers to not deserialize unnecessary fields

Bug Fixes
• Fixed issue where amqp token renewal task spawns too many threads (#294)
• Fixed issue device clients using mqtt or mqtt_ws could not set set default trusted cert or default trusted cert path (#342)

Java IotHub Service Client (com.microsoft.azure.sdk.iot:iot-service-client:1.15.1)

• Improved deserializers to not deserialize unnecessary fields
• Added logic to notify user if amqp connections failed to be opened

Bug Fixes
• Deprecated updateDesiredProperties (#222)
• Fixed issue where module id is not included in the results of a module twin query (#340)

Java SDK Dependency (com.microsoft.azure.sdk.iot:iot-deps:0.7.1)

• Improved deserializers to not deserialize unnecessary fields
• Added logic to notify user if amqp connections failed to be opened

Bug Fixes
• Fixed issue where configurations did not allow an empty schemaVersion
• Fixed issue where you cannot set desired properties or tags at the maximum level (#339)

Java Provisioning Service Client (com.microsoft.azure.sdk.iot.provisioning:provisioning-service-client:1.3.3)

• Improved deserializers to not deserialize unnecessary fields
• Fixed issue where you cannot set desired properties or tags at the maximum level (#339)

Java Provisioning Device Client (com.microsoft.azure.sdk.iot.provisioning:provisioning-device-client:1.3.3)

• Improved deserializers to not deserialize unnecessary fields
• Add proper error parsing for registration operation status checking (#332)

Merge Pull Request

#347, #346, #345, #344,

Maven packages
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-device-client/1.14.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-service-client/1.15.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-deps/0.7.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-device-client/1.3.3/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-service-client/1.3.3/jar

Java IotHub Device Client (com.microsoft.azure.sdk.iot:iot-device-client:1.13.3)

Bug Fixes
• fix issue where module client could not receive input messages (#303)

https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-device-client/1.13.3/jar

Java IotHub Device Client (com.microsoft.azure.sdk.iot:iot-device-client:1.13.2)

Bug Fixes
• map SocketTimeoutException to be retryable (#268)
• Fix memory leak for amqp reconnection (#273)
• Re-enable and fix invokeMethod APIs
• Fix moduleClient.createFromEnvironment HSM issues for HTTP and Unix sockets (#281, #280, #274)
• Fix issue where mqtt messages that IotHubTransport doesn't track for acks are given to IotHubTransport anyways
• Fix bug where mqtt acks message faster than expected
• Stop including cdid and cmid in mqtt topic strings while edgehub fixes a bug that can't handle them
• Fix mqtt subscribe topic strings for ModuleClient cases
• Fix classification of SocketExceptions by MQTT to be retryable
• Fix issue where sending messages with input did not get sent to IotHub (#283)

Java IotHub Service Client (com.microsoft.azure.sdk.iot:iot-service-client:1.14.1)

Bug Fixes
• Fix bug where RegistryManager.removeDevice requires double quoted etag (#292)

Java SDK Dependency (com.microsoft.azure.sdk.iot:iot-deps:0.6.2)

Bug Fixes
• Fix bug where authentication failed when using X509 certs signed by CA (#266)
• Fix bug where RegistryManager.removeDevice requires double quoted etag (#292)
• Fix bug where DeviceTwin.getTwin depth was incorrect for module twins (#290)

Merge Pull Request

#287, #291, #293, #297, #300

Maven packages
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-device-client/1.13.2/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-service-client/1.14.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot/iot-deps/0.6.2/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-device-client/1.3.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning/provisioning-service-client/1.3.1/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning.security/security-provider/1.1.0/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning.security/tpm-provider/1.1.0/jar
https://search.maven.org/artifact/com.microsoft.azure.sdk.iot.provisioning.security/x509-provider/1.1.0/jar

Java IotHub Device Client (com.microsoft.azure.sdk.iot:iot-device-client:1.13.1)

• Throw unsupported operation when communicating with edgehub if not using MQTT/MQTT_WS due to issues with other protocols
• Throw unsupported operation when calling invokeMethod from module due to issue with HTTPS communication

Bug Fixes
• Fix issue where MQTT/MQTT_WS connection could not be established between client and edgehub

Maven packages

http://search.maven.org/#artifactdetails%7Ccom.microsoft.azure.sdk.iot%7Ciot-device-client%7C1.13.1%7Cjar

Java IotHub Device Client (com.microsoft.azure.sdk.iot:iot-device-client:1.13.0)

• Add ability for module client to retrieve trusted certificates from environment variables during createFromEnvironment
• Add ability for module client to retrieve trusted certificates from HSM during createFromEnvironment
• Add API for module client to invoke methods on another module or on a device

Java Provisioning Service Client (com.microsoft.azure.sdk.iot.provisioning:provisioning-service-client:1.3.1)

• Fix bug where device capabilities did not default to a normal device

Java SDK Dependency (com.microsoft.azure.sdk.iot:iot-deps:0.6.1)

• Fix bug where device capabilities did not default to a normal device

Maven packages

http://search.maven.org/#artifactdetails%7Ccom.microsoft.azure.sdk.iot%7Ciot-device-client%7C1.13.0%7Cjar
http://search.maven.org/#artifactdetails%7Ccom.microsoft.azure.sdk.iot%7Ciot-deps%7C0.6.1%7Cjar
http://search.maven.org/#artifactdetails%7Ccom.microsoft.azure.sdk.iot.provisioning%7Cprovisioning-service-client%7C1.3.1%7Cjar