v0.9.1

Thank you to the contributors in this release: @stefan-kolb, @arpitjain099, @istyf, @jackchenjc, @skartikey, @mschm, and @jminardi.

go get github.com/gopcua/opcua@v0.9.1

gopcua ships both a client and a server. Each item is tagged (client) or (server) for which side it affects, and items that only matter to developers building against the library API carry API. If you consume gopcua through Telegraf or benthos-umh, the plain (client) items are the runtime behavior you get automatically; (server) items only matter if you build a server on gopcua.

No breaking changes in this release.

Security

• A malformed message can no longer make the decoder allocate far more memory than the message itself. The declared element count of an array is now checked against the bytes actually remaining before the slice is allocated, so a 4-byte body claiming 100 million elements fails immediately instead of allocating roughly 800 MB first; counts near MaxInt32 could push a process into multi-GB allocation and out-of-memory. Reachable on both sides, by a server decoding a client request and by a client decoding a server or man-in-the-middle response (#884) (client + server)

New

• PKCS#8 private keys (BEGIN PRIVATE KEY) are now accepted wherever a private key is loaded. These are the default output of OpenSSL 3.x, Java and .NET, and previously failed with Failed to decode PEM block with private key; only PKCS#1 (BEGIN RSA PRIVATE KEY) worked (#871) (client + server)
• Certificate and key loading now detects PEM or DER from the file contents rather than the extension, accepts a full chain of leaf plus intermediates, and reports a PKCS#1/PKCS#8 mismatch as a named error instead of a generic decode failure (#872) (client + server)
• A gopcua server now supports Browse continuation points and BrowseNext, so a client can page through a node that has more references than fit in one response instead of silently receiving a truncated list (#865) (server)

Fixes

• Subscriptions now recover after a reconnect when one of them cannot be restored. Previously the client reported itself Connected with no live subscription and a dead publish loop, delivered no data again, and never retried; it now rebuilds the session and retries, waiting between attempts instead of hammering the server (#877) (client)
• A subscription being restored after a reconnect no longer loses every monitored item because the server rejected one of them. A node that disappeared during the outage is dropped on its own and logged, and the items the server accepted keep delivering data (#887) (client)
• Monitoring a batch of nodes no longer gives every item in the batch the same client handle, which could deliver a node's values under the wrong node's identity (#881) (client)
• A server node that denies current-read is browsable again. AccessLevel governs the Value attribute only, so BrowseName, NodeClass, DisplayName and the rest are readable; previously such a node answered Bad_UserAccessDenied for every attribute and could not be described at all (#878) (server)
• A server no longer panics when a client writes the DataType attribute in the ordinary NodeId form. The attribute is spec-typed NodeId, but the server asserted ExpandedNodeId without checking, so a conformant write crashed the process on the next browse that resolved a reference to that node (#867) (server)
• RegisterNodes now returns the node IDs it was given, which is the required behaviour for a server that performs no node-access optimization, and UnregisterNodes ignores IDs it does not know instead of failing (#867) (server)
• The UserAccessLevel attribute is stored with the type the read path expects, so reading it works (#875) (server)

Full Changelog: v0.9.0...v0.9.1