Bump OPCFoundation.NetStandard.Opc.Ua from 1.5.374.124 to 1.5.374.158 in /Applications

[dependabot]

Bumps OPCFoundation.NetStandard.Opc.Ua from 1.5.374.124 to 1.5.374.158.

Release notes

Sourced from OPCFoundation.NetStandard.Opc.Ua's releases.

OPC UA 1.05 Maintenance Update

1.05.374 roll up until Dec 4th.

This release is based on the 1.05.03 Nodeset with generated files from the ModelCompiler. The focus in this release was on perf improvements and bug fixes.

Breaking change

Based on a recent security review, the Https server endpoints enforce by request TLS mutual authentication and change behavior without. It is highly recommended to only use mutual TLS authentication. Some clients may not support the new scheme yet.

A new configuration variable

    <HttpsMutualTls>true</HttpsMutualTls>

enables or disables the mutual TLS authentication support (default: true).

The behavior of the https TLS endpoint changes according to the following settings:

HttpsMutualTls is true

• The server checks the trust on the certificate which is used by the client for TLS authentication. It must be a valid OPC UA application certificate which is trusted.
• A client can still connect without providing a client certificate, but then it is only able to call discovery services.
• In order to create a session, the client must use the same application certificate that was used for the TLS channel.

HttpsMutualTls is false

• There is no application authentication. The server endpoint uses security None and there is no client application authentication.
• Instead, only user authentication is used to secure the server, anonymous user authentication is disabled.
• Discovery service calls are supported.

Enhancements

• Supports native .NET 9 assemblies. A new X509CertificateLoader was introduced for older .NET versions to keep the code readable without ifdef.
• Server GDS Push CreateSigningRequest supports regeneration of the public/private key pair. by @​romanett.
• Callback to notify about channel token renewal.
• Server detection algorithm for clients which try to exploit the known Basic128Rsa15 vulnerability.

Bug fixes

• Client ReadNodes throws an BadInvalidType if a value type returns null.
• Client reading of large dictionaries is split in chunks. by @​ThomasNehring.
• Mixed opc.https and https endpoint prevent a server from starting up .
• Server endpoint certificates were not updated after GDS Push UpdateCertificate. by @​romanett.
• Event reports ignore session context. by @​Filippo-Oliva-ABB.
• Accept namespace Uri which are not well formed. Stricter handling was added in previous release, but for IOP is again relaxed.
• Reading complex types from a server could cause a null pointer exception in BinaryDecoder. by @​marcschier.
• Reading operation limits could cause an exception (thus operation limits were ignored).
• CRL with invalid content could cause exception when reading property with lazy decoding, decode CRL always when constructore is called to catch issues early.
• Channel token HMAC references were not disposed after a channel renew.
• Allow decoding of extension objects which set the length to -1.
• Fix for CauseMappings and bug in ConditionRefresh/2 by @​Archie-Miller

... (truncated)

Commits

• f5d00d9 Merge pull request #2881 from OPCFoundation/main374releaseconflict
• 8ea1aa4 merge release/1.5.374
• 6c62eb2 Fix serialization of CertificateTrustList (#2879)
• d0e89a3 Support mutual TLS on server https endpoints (#2849)
• a887f90 Allow ExtensionObjects which are encoded with an unknown size (#2869)
• 71a6e69 Bump BouncyCastle.Cryptography from 2.4.0 to 2.5.0, Serilog and Codecov (#2875)
• af7dc0f Merge pull request #2878 from OPCFoundation/mastercherrypicks
• 6f7b8e7 [Client] Fix: KeepAliveInterval was not updated on ModifySubscription (#2871)
• f98c8a9 Client fix for ConditionRefreshAsync always returns NodIdUnknown, add Conditi...
• ab364b9 Update CauseMappings to reflect issue (#2877)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.