chore(deps): bump node-opcua from 2.143.0 to 2.178.0

[dependabot]

Bumps node-opcua from 2.143.0 to 2.178.0.

Release notes

Sourced from node-opcua's releases.

🚀 v2.178.0

Released: 20 August 2026

The theme of this release is private-key protection and seamless certificate rotation. It incorporates the newest security-hardened PKI and crypto modules — node-opcua-pki 6.20.0 and node-opcua-crypto 5.6.0 — and builds on them so that servers and clients benefit directly.

New Features

• Encrypted-at-rest private keys. OPCUACertificateManager now accepts privateKeyPassphrase (a string or an async function) and privateKeyProvider. OPCUAServer / OPCUAClient resolve the possibly encrypted key once during initialization, so the synchronous secure-channel layer never touches the disk again. A key pushed through push certificate management is written already encrypted, never in clear. Default behavior (no passphrase) is unchanged.
• Seamless server certificate rotation. Server secure channels are now bound to their creation-time key pair, as OPC UA Part 6 (6.7.2 / 6.7.4) defines the asymmetric handshake per SecureChannel, not per current server state. Combined with the new closeChannelsOnApplyChanges: false option of installPushCertificateManagementOnServer, rotating the server certificate no longer breaks token renewal on live channels: connected clients — unmodified third-party clients included — keep working, reconnects spread over a token lifetime instead of all at once. The default (close channels immediately) is unchanged and remains the right choice for a compromised key.

Fixes

• Client keeps its session across a server certificate rotation. ActivateSession now signs against the server's current certificate instead of the one captured at CreateSession; previously the reactivation was rejected and the client silently fell back to a new session (the sessionId changed on every rotation).
• Certificate rotation no longer leaves a stale private key in use. After UpdateCertificate/ApplyChanges, the rotated key is re-resolved instead of served from the certificate manager's lifetime cache, and executeUpdateCertificate compares against the same cached key that signed the CSR — fixing handshake signature failures and spurious BadSecurityChecksFailed ("certificate doesn't match privateKey") after a rotation.
• Nodeset loading survives a malformed node. A bad <Value> in one node (e.g. Opc.Ua.PADIM.NodeSet2.xml) no longer silently aborts post-loading and leaves the address space without a DataTypeManager; failing tasks are logged and skipped, and the eventual error names the real cause (#1564).

Updated PKI and crypto modules — what you get transitively

node-opcua-pki 6.20.0

• Private-key directories are created and repaired as 0700 and key files as 0600 (POSIX; documented no-op on Windows).
• CertificateManager and CertificateAuthority support passphrase-protected private keys: a fresh key is written encrypted, an existing plaintext key is encrypted in place on initialize, and a missing or wrong passphrase fails closed with PrivateKeyPassphraseRequiredError.
• OpenSSL is now invoked without a shell, with a curated environment allowlist; passphrases reach OpenSSL only via -passin/-passout env:, never a command-line string or a debug log.
• The threat model is documented in docs/private-key-protection.md.

node-opcua-crypto 5.6.0

• Native PKCS#12 (PFX) support — createPfx() / parsePfx() implement RFC 7292 in pure JavaScript, no OpenSSL binary needed. Parsing handles DER and BER files and pairs certificate to key via localKeyId; writing uses the OpenSSL 3.x defaults (PBES2, PBKDF2-HMAC-SHA256, AES-256-CBC).
• Passphrase-encrypted private keys — readPrivateKey accepts a passphrase and fails closed on an encrypted key without one; writePrivateKeyFile writes encrypted PKCS#8. This is the primitive the privateKeyPassphrase features above are built on.
• Private key files are written with mode 0600, and pre-existing looser permissions are tightened.

Together these mean a node-opcua server can now keep its OPC UA application private key encrypted on disk end to end — generation, CSR signing, push-certificate updates, and secure-channel use — without any change for existing plaintext-key deployments.

Full changelog: node-opcua/node-opcua@v2.177.1...v2.178.0

🚀 v2.177.0

What's Changed

• fix(server-configuration): give each TrustList a real, unique backing file by @​erossignon in node-opcua/node-opcua#1555
• feat(alias-name-client): recover the per-target ReferenceType of an AliasName by @​erossignon in node-opcua/node-opcua#1559
• docs(alias-name): bless lastChange.touch() for out-of-band store mutations by @​erossignon in node-opcua/node-opcua#1558
• feat(server): supported API for contributing Server_ServerArray entries (Part 17 Annex C.2) by @​erossignon in node-opcua/node-opcua#1557
• fix(nodeid): coerceExpandedNodeId no longer drops namespaceUri and serverIndex by @​erossignon in node-opcua/node-opcua#1556
• fix(server): a session's SessionContext now sees the whole IServerBase by @​erossignon in node-opcua/node-opcua#1560
• fix(role-set): X509Subject matching silently dropped the OU by @​erossignon in node-opcua/node-opcua#1561

Full Changelog: node-opcua/node-opcua@v2.176.0...v2.177.0

v2.176.0

node-opcua 2.176.0 — release notes

... (truncated)

Commits

• d0e850e v2.178.0
• b756d36 test: fix flaky GZZE3 - don't demand backoff events that may never fire
• 71cb152 fix: don't abandon nodeset post-loading when one task throws (#1564)
• 21260a3 feat(secure-channel): bind server channels to their creation-time key pair
• a7c55e4 feat(push-cert): opt out of closing channels on ApplyChanges
• e1b59b2 fix(client): reactivate session with the server's current certificate
• f452f20 test: replace SCT-3's fixed 6s wait with a poll for reconnection
• dd0f1ea fix: re-resolve rotated private key without pki's stale per-instance cache
• 79edfed feat: support encrypted-at-rest private keys via pki privateKeyPassphrase
• b0339a5 fix(server-configuration): compare against CertificateManager's cached key, n...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for node-opcua since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[erossignon]

assigned to @erossignon

[danielpeintner]

Closed in favor of #1553

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.