v1.0.4

Security and correctness fix for tag addresses. Upgrade if you write to S7comm PLCs, in particular with large DB offsets, timers or counters.

Highlights

• Out-of-range addresses are now rejected. Before this release, a byte offset above 2097151 did not fit in the 24-bit address field of the S7comm request and wrapped around: DB1.DBB2097152 read and wrote DB1.DBB0. Timer and counter numbers above 65535 lost their high bits, and an element count above 32767 (T5[70000]) was cut. A very large count made the connection thread panic, and that connection stopped working. All three address syntaxes (Siemens, parse_tag and nodes7) now give an error such as DB1.DBB2097152: address out of range (byte offset 0-2097151).
• Fuzz testing. The parsers of PLC replies (S7comm and S7CommPlus) and of tag addresses run under cargo-fuzz in CI on every change and for 10 minutes each week. The fuzzer found the address bug above.

Upgrade notes

• A flow with an out-of-range tag now gets an error for that tag instead of a value from another address. Valid addresses do not change.
• No change to the nodes, their settings or the supported PLCs.

Details (CHANGELOG)

Fixed

• Tag addresses out of the S7 address range are now an error. Before, a byte offset past 2097151 (DB1.DBB2097152) wrapped in the 24-bit address field and reached another address (DB1.DBB0), a timer/counter number past 65535 lost its high bits, and a count past 32767 (T5[70000]) was cut (and a very large one made the connection thread panic). All three address syntaxes check the range.

Added

• Fuzzing: cargo-fuzz targets for S7comm replies (COTP, S7 header, ReadVar data, Userdata), tag addresses and values, block information and clock, S7CommPlus PDU reassembly, messages, values, objects, notifications, alarm texts and comment blobs (fuzz/, CI workflow fuzz.yml).

Changed

• GitHub releases start with a summary for users (.github/release-notes/), then the CHANGELOG section.
• CI: cargo-zigbuild installed from a hash-pinned requirements file; Node-RED 4 tests use the locked alias node-red-4 (no unpinned npm install); node-red-dev pinned; SECURITY.md links the private reporting form.

Full diff: v1.0.3...v1.0.4

v1.0.3

Maintenance release: the native addon moves to current versions of its two main Rust libraries. Nothing changes for flows.

Highlights

• Node-API layer on napi-rs 3. The bridge between Node.js and the Rust clients uses the new napi-rs 3 API. The JavaScript API, the values and the error messages are the same: the output of every call was compared byte for byte with 1.0.2.
• AES library 0.9 for the S7CommPlus password login (legitimation), checked against the official NIST test vectors.
• Checked against a real S7-1200 (read only) over S7comm and S7CommPlus.

Upgrade notes

None.

Details (CHANGELOG)

Changed

• Node-API layer on napi 3 / napi-derive 3 (native API, no compat mode): results are built by ToNapiValue types, callbacks are weak thread-safe functions, status is converted with the serde-json feature instead of JSON.parse. The JS API and the values are the same (byte-identical output against the fake PLCs).
• aes 0.9 (cipher 0.5) for the S7CommPlus legitimation.

Added

• Tests: NIST SP 800-38A known-answer test for AES-256-CBC; test/addon.test.js for the shapes and value conversions at the Node-API boundary.

Full diff: v1.0.2...v1.0.3

v1.0.2

Maintenance release for the development tool chain. The published package and its behaviour do not change.

Highlights

• Security updates of development-only dependencies (multer, body-parser, and undici inside the npm CLI that Node-RED bundles). The package has no runtime dependencies, so installed nodes were not affected.

Upgrade notes

None.

Details (CHANGELOG)

Security

• Development dependencies only (the published package has no dependencies): npm overrides for multer 2.5.0 (GHSA high), body-parser 1.20.9 (high) and the npm CLI bundled by Node-RED 11.21.2, which brings undici 6.29.1 (high and medium). No change to the nodes or the binaries.

Full diff: v1.0.1...v1.0.2

v1.0.1

First release built and published entirely by GitHub Actions. The code is the same as 1.0.0.

Highlights

• Published to npm with Trusted Publishing (no stored npm token) and a signed provenance statement: npm audit signatures shows that the package comes from this repository and this workflow.

Upgrade notes

None.

Details (CHANGELOG)

Changed

• Release built and published by GitHub Actions with npm Trusted Publishing (OIDC) and provenance. No code change.

Full diff: v1.0.0...v1.0.1

v1.0.0

First release of node-red-contrib-s7-rust: Node-RED nodes for Siemens S7 PLCs, with the protocol clients written in Rust and running inside the Node-RED process. It is the next generation of @oriolrius/node-red-contrib-s7.

Highlights

• Two protocols: classic S7comm (S7-200/300/400/1200/1500, LOGO! 8) and S7CommPlus (S7-1200/1500) with symbolic access to optimized DBs, TLS and password login.
• Five nodes: s7 endpoint, s7 read, s7 write, s7 watch (with a conditional rate) and s7 info (CPU state, SZL, clock, blocks, browse, alarms).
• Fast and light: no child process and no IPC; reads are grouped into as few requests as the PDU allows; changes are detected on the raw PLC bytes.
• Linux x64 only, prebuilt for glibc ≥ 2.28 and musl (Alpine, the Node-RED Docker image).
• Licence LGPL-3.0-only. The README has the exact map of the S7 functions that are covered.

Upgrade notes

New package: install node-red-contrib-s7-rust from the palette. It does not replace @oriolrius/node-red-contrib-s7 in existing flows.

Details (CHANGELOG)

First release: the next generation of @oriolrius/node-red-contrib-s7.

Added

• S7comm client in Rust (crate s7): S7-200/300/400/1200/1500 and LOGO! 8, Siemens and nodes7 address syntax, all S7 data types, request optimization with gap spanning, reconnection, SZL, clock, block information.
• S7CommPlus client in Rust (crate s7plus): S7-1200/1500 symbolic access to optimized DBs and PLC tags, absolute area access, TLS 1.3, legitimation (password), browse, alarms.
• Node-API addon (crate s7napi): one thread per connection, columnar results, change detection on the raw PLC bytes.
• Nodes s7 endpoint, s7 read, s7 write, s7 watch (conditional rate) and s7 info.
• Admin API GET /s7rs/status/:id and GET /s7rs/call/:id/:action (read-only actions).
• Prebuilt binaries for Linux x64: glibc ≥ 2.28 and musl (Alpine).
• Example flows, editor help, en-US message catalogs.
• CI: tests on Node-RED 4 and 5, gitleaks, GitGuardian, RustSec and npm audit, CodeQL, OpenSSF Scorecard, Dependabot. License LGPL-3.0-only.

[Unreleased]: v1.0.4...HEAD [1.0.4]: v1.0.3...v1.0.4 [1.0.3]: v1.0.2...v1.0.3 [1.0.2]: v1.0.1...v1.0.2 [1.0.1]: v1.0.0...v1.0.1 [1.0.0]: https://github.com/oriolrius/node-red-contrib-s7-rust/releases/tag/v1.0.0