Skip to main content

Changelog

This document provides a high-level overview of customer-facing features, improvements, and critical fixes introduced in each version.

[3.40.0]​

The editor release: dark mode everywhere, a reworked address browser, and an end to the NodeId that silently changed under you.

🌓 Dark mode, following Node-RED​

  • The configuration panel and every node dialog now follow the editor theme. Not the operating system — Node-RED's own Theme setting, so a light editor on a dark desktop stays light. Certificates, licence, onboarding, the address browser, its menus and hints were all reworked for contrast on both grounds.

🌲 A better address browser​

  • Browse before you deploy. The address-space tree can be opened as soon as an endpoint is configured, so you can wire and fill in a flow in a single pass instead of deploying just to look up a NodeId.
  • The first click on a branch shows its children instead of an empty branch.
  • Picking a node writes a browse path, the notation that survives a namespace re-index.
  • Verify says what actually went wrong — the server reason is surfaced instead of a generic failure.

🎯 Explicit NodeId source​

  • The prefix of every address field now has two stops: the first says where the value comes from at runtime — this node, this node, templated, or the message — and the second says how the address is written. Two questions that used to share one seven-entry menu.

    One sentence: a message always triggers a node; whether it also targets it is now your choice. The classic trap — a stock inject node whose timestamp payload silently replaced a carefully configured NodeId and failed far downstream with a cryptic parse error — is gone: under this node the message cannot retarget the node at all.

    Available on Read, Write, Browse, Call (ObjectId and MethodId independently), Explore, File Operation, Monitor, Monitor Event and History Read — the last two gained it in this release, so every node that takes an address now answers the same question the same way.

  • Notations are shown as their own syntax — abc, ns=, na=, nsu=, /, /a: — so the button and the field agree, replacing four stacked icon pairs that never resolved at small sizes. The last notation you pick is remembered for the next field; new fields start on ns=.

  • Templated addresses are a declared source. A value such as ns=1;s={{msg.payload.name}} used to read the message while claiming to come from the node.

  • msg. mode keeps every shape. A message path pointing at an array or an object tree drives a multi-node read or an array/structure subscription exactly as a payload would — including on the Monitor node.

    See Where does the NodeId come from? and The node browser.

🐛 Bug Fixes​

  • Valid addresses were being rejected. The guard that catches "this is a data value, not a NodeId" was narrower than the resolver itself, so four legal forms raised a hard error: browse paths starting with ., the root-anchored form, the nsa= prefix, and bare well-known names such as Server or ObjectsFolder. This affected the Monitor node in every mode, including a NodeId configured in the node itself.
  • A node no longer stays yellow for ever. When a message overrode a configured NodeId, the status turned yellow permanently and lost its real colour — a sampling... Monitor never showed green again.
  • The Call node reports both fields. With ObjectId and MethodId overridden, only the first was ever logged.
  • New nodes are explicit from birth. A node dragged onto the canvas used to start in the legacy mode and immediately warn about behaviour it had no history of. Existing flows are untouched.
  • Help and documentation links on the OPC UA nodes are corrected, and the missing help widgets are restored.
  • The licence panel survives a blocked payment provider and still offers the quote path, with the correct URL and a negotiated locale.

🛠️ Under the hood​

  • Platform bump to node-opcua 2.180.0.
  • A generated software bill of materials, shared with the node-opcua GDS tooling.

⚠️ Upgrade notes​

  • Browse and verify now appear only under this node. They act on an address the node owns, so they are absent under the message, under a template, and while the source is unanswered. On a flow saved before 3.40 they appear as soon as you pick a source.
  • Flows saved before 3.40 keep their historical per-node precedence until you choose a source. Nothing changes on deploy.

[3.39.0]​

🎉 New Features​

  • Embedded OPC UA Server — role-based security, on by default. The embedded server ships with a spec-conformant identity and role layer (OPC 10000-18): well-known roles, per-role identity mapping, user management with a configurable password policy, a must-change-password flow for seeded credentials, and an encrypted-at-rest user store — credentials never live in the flow.
  • Registration without internet access. Machines with no outbound connection can register offline: the onboarding wizard renders a QR code with your details pre-filled, and opens it automatically when an online attempt cannot reach the service.
  • Recovering from an expired or stuck licence is no longer a dead end — the configuration panel offers a renew/change action and can rebuild its licensing runtime in place, so a repaired environment does not need a Node-RED restart.

🐛 Bug Fixes​

  • Nodes no longer flash red on deploy — a node status is cleared cleanly on close instead of being left in a transient error state.
  • The Certificates page no longer renders blank on some installations.
  • Firefox: toggle checkboxes in the configuration panel render correctly.
  • Monitor: namespace context is passed to the subscription, so monitored items using namespace aliases or browse paths resolve correctly.

🛠️ Under the hood​

  • Platform bump to node-opcua 2.175.2, bringing reconnection fixes (publishing resumes after a Republish returns BadMessageNotAvailable, as seen with CoDeSys), stricter event-filter validation, a hardened transport handshake, and all outstanding upstream security advisories resolved.

Node.js: minimum 20.20.0; Node 22 LTS strongly recommended.

[3.38.0]​

🎉 New Features​

  • FlowFuse-aware experience. On FlowFuse instances the configuration panel now shows only what applies to that environment, and hides actions an immutable container cannot honour.

🐛 Bug Fixes​

  • Configuration panel reachable behind sub-paths and reverse proxies — it derives its API base from the page it is served from, instead of assuming the editor sits at the server root.

[3.36.0]​

🎉 New Features​

  • Self-healing monitored items (Monitor node). Monitoring now survives variables that are not there yet, and servers that come back in stages:
    • a node that does not exist yet is tracked as pending and retried until it appears, rather than becoming a dead monitored item — for single nodes, arrays and structures, at scale;
    • after every reconnection the node re-validates its entire monitored set and re-monitors only what came back missing (a PLC still warming up after a reboot). This closes a long-standing gap where a staged restart could leave some tags silently frozen until a redeploy;
    • Retry unknown nodes (default on) and Retry interval (default 5 s) are configurable.
  • Mark values bad on disconnect (Monitor, default off) — re-emit the last value of each item tagged BadServerNotConnected, so downstream flows can tell the data is stale instead of trusting a frozen value.
  • Array monitoring output gains msg.statusCodes and msg.nodeIds — parallel arrays in input order, so per-item status and the resolved nodeId are visible.
  • Output type and Trigger are first-class options on the Monitor node, and are correctly saved.

🎨 Changed​

  • Duration fields accept units. Sampling Interval, Retry Interval and the subscription Publishing Interval take a value plus a unit (ms / s / m / h). Values are still stored in milliseconds, so existing flows are unaffected.

🐛 Bug Fixes​

  • Migrated nodes get correct defaults — opening a Monitor or Endpoint node saved before these options existed no longer shows blank combos or a 0 retry interval.

[3.35.0]​

🎉 New Features​

  • Embedded OPC UA Server (preview). Host an OPC UA server directly from your flow, including PubSub alongside the classic client-server endpoint. In the Evaluation tier it runs with [Evaluation] branding, stops after 2 hours, and is capped to a small number of nodes.

🎨 Changed​

  • Minimum Node.js is now 20.20.0 (was 16.x); Node 22 LTS is recommended, and the toolchain warns on anything older. This lifts the hard Node-22-only constraint of the 3.34.x line.

🐛 Bug Fixes​

  • Installing on a fresh Node-RED instance no longer fails with a missing-module error — the dependency closure is resolved at install time instead of relying on host hoisting.

[3.34.0]​

🎉 New Features​

  • First version of the embedded OPC UA Server node, as an experiment. Iterated further in 3.35.0.

⚠️ Known limitation​

  • Requires Node.js 22 or above. The 3.34.x line will not start on Node 20 or earlier; this is fixed in 3.35.0. Note that 3.34.1 is the first working publish of the Sterfive distribution to npmjs.org — from that version you can install directly with npm install @opcua/for-node-red.

[3.32.0]​

🐛 Bug Fixes​

  • Certificates and configuration survive a Docker container rebuild. On the official nodered/node-red image the PKI, and other persistent state, used to be written outside the only volume the image mounts. Every rebuild silently wiped the trust store, the rejected list and the client own certificate. Everything now lands under the /data-backed folder.

    Migration: existing installs with a populated PKI at the old location see a one-time startup warning pointing at the new one. Copy the contents across — nothing is moved automatically, because certificate material is sensitive. See Setting up a Custom Certificate.

[3.31.0]​

🐛 Bug Fixes​

  • Self-signed certificates are written where the OPC UA client actually reads them, so creating one from the Certificate Manager takes effect immediately.
  • Clearer activation failures — when a key is rejected, the reason is shown instead of a generic error.

[3.30.0]​

🎉 New Features​

  • Certificate enrollment is editable. The enrollment form exposes the DNS names, IP addresses and application URI that go into the request, pre-filled from your PKI rather than from hard-coded values, and the certificate information panel shows them back to you.
  • One application URI across the board — the same identity is used consistently by every OPC UA subsystem, so a certificate issued for it is accepted everywhere.

🐛 Bug Fixes​

  • Two memory leaks fixed: an event-listener leak in the Monitor node, and a re-fetch loop in the certificate-pull screen that could grow without bound.
  • Confirmation dialogs in the configuration panel are inline rather than browser pop-ups, and the upload button no longer wraps awkwardly.

[3.28.0]​

🎉 New Features​

  • You are told when the product cannot reach the network. Operating in the offline grace period now shows a prominent warning, instead of failing quietly later.

[3.27.0]​

🎨 Changed​

  • Output ports are consistent across every Client node. The experimental secondary output has been removed, and all errors now flow through the standard Node-RED error mechanism.

    Migration: wire a standard Catch node beneath your client nodes to intercept errors.

🐛 Bug Fixes​

  • Fixed timeouts caused by concurrency and certificate-store races during connection setup.

[3.26.0]​

🐛 Bug Fixes​

  • All persistent state now survives Docker container rebuilds (Sterfive): On the official nodered/node-red image the PKI used to land at /usr/src/node-red/.config/opcua-for-node-red-nodejs/PKI, outside the only volume the image mounts (/data). The Cryptlex licence activation dat, the activation key, the telemetry queue, the licence v2 config, and the application instance-id had similar problems. Every container rebuild silently wiped all of them — trust store, rejected list, client's own certificate, AND the licence activation. The fix moves the OEM bootstrap from module-top-level into Node-RED's documented nodeInit(RED) lifecycle hook, captures RED.settings.userDir before any persistent path is resolved, and then auto-sets STERFIVE_CONTAINER_CONFIG_FOLDER so both getConfigFolder() (PKI, instance-id, activation key, telemetry, licence v2) and licence-check's resolveDataDir() (Cryptlex dat) land under the same /data-backed root. A startup-time strict-fail guard makes any future regression of this ordering crash loud with a pointer at the offending early caller, instead of silently regressing to the wrong path. Migration: existing installs with a populated PKI at the legacy env-paths location see a one-time startup warning pointing at the new location; copy the contents over (no automatic move — cert material is sensitive) or set STERFIVE_CONTAINER_CONFIG_FOLDER to the legacy parent to keep the previous behaviour. FlowFuse is unchanged — its existing FF_INSTANCE_ID branch keeps PKI at ${cwd}/opcua-for-flow-fuse/PKI exactly as before. See Setting up a Custom Certificate. Note: an earlier 3.30.x attempt at this fix was effectively a no-op because the bootstrap hook ran too late; this release ships the proper Node-RED-lifecycle-aware version.

  • Certificate Manager — Own tab now refreshes after creation: Fixed an issue on fresh installations (notably brand-new Docker containers) where clicking Create Self-Signed Certificate in the Certificates → Own tab showed the success toast but left the panel on the empty "No own certificate found" state. The certificate was being written to the wrong filename internally, so the OPC UA client and the UI disagreed on the active cert. Both Create and Renew now write to the same file the OPC UA stack actually loads at connection time. Users who hit this issue can safely delete a stray own/certs/self_signed_certificate.pem file from their PKI folder if present.

🎉 New Features​

  • Certificate Manager Integration: Introduced a visual Certificate Manager tab directly inside the endpoint configuration panel. This powerful interface wraps the @sterfive/opcua-certificate-manager API into the Node-RED environment for real-time certificate issuance, trusting, and re-generation.
  • Streamlined Trial Registration: Added a "Welcome Registration" flow that allows users to rapidly register and acquire a short-term Trial ID straight from the UI. This drastically reduces the time-to-value for new trial evaluators.
  • FlowFuse Capability: Improved compatibility with FlowFuse deployments, specifically fixing PKI API registrations and licensing verification within containers.

🛠️ Breaking Changes & Architectural Fixes​

  • Streamlined Output & Error Handling Architecture
    • We have centralized node helpers and standardized error streams across major nodes (OpcUa-Client2-Read, OpcUa-Client2-Call etc.).
    • Secondary Output Wire Removal: The experimental secondary output pins have been formalized out. All error streams and unhandled exceptions are now natively piped into the standard Node-RED error mechanisms.
    • Migration: Use the standard Node-RED Catch node wired directly beneath your client nodes to intercept errors efficiently and cleanly.

[3.25.0]​

🎉 New Features​

  • Certificate pull reports progress while it retries, and can be cancelled.

[3.24.0]​

🎉 New Features​

  • X509 User Identity: Upgraded the core OPC UA client components (to node-opcua 5.20+), which introduces full support for X509 User Identity when connecting to secure servers.
  • Telemetry & PKI Configuration: Enhanced folder configuration capabilities for PKI and telemetry data.
  • UI Polish: Replaced crude alerts with native, proper modal dialogs when interacting with Certificate details in the config panel.

[3.23.0] & [3.22.0]​

🛠️ Core Improvements​

  • Advanced White-labeling: Substantial under-the-hood refactoring to support configurable API namespaces and global RED instances. This lays the groundwork for OEM partners wanting to white-label the extension.
  • License Limitations: Refactored the core logic determining offline vs. online license constraints, providing a more robust enforcement model.

[3.21.0]​

🎉 New Features​

  • Extensive Reverse Proxy & Subpath Support: Natively brought in support for RED.settings.httpNodeRoot. The module APIs consistently respect Nginx and custom subpaths context, crucial for enterprise Kubernetes and Docker deployments.
  • Frictionless Purchasing: Overhauled the Support and Licensing overlay to feature a direct "Buy Online" workflow, heavily minimizing the steps required to acquire or upgrade a professional license.
  • Licensing UI Revamp: The license expiration overlay and the support tab were beautifully redesigned to cleanly expose your product information and telemetry APIs.