Files
UA-.NETStandard/docs/MigrationGuide.md
T
Marc Schier aad8350bc1 Pluggable symmetric cryptography, an awaitable asymmetric path, registrable security policies, and PubSub crypto offboarding (#4206, #4207, #4208, #4210) (#4232)
# Description

Closes the three crypto-offboarding follow-ups split out of #4192. Each
was recorded there as knowingly *not* done, with the reason and what
would justify revisiting it. Those conditions are met, and where one of
them turned out to be unachievable that is written down rather than
worked around.

The safety property throughout: **every seam is opt-in and null-checked,
and in the default software configuration the added code is observably
inert.** No interface dispatch on the per-message path, and the
asynchronous paths complete synchronously — so channel locking order,
buffer ownership and error sequencing are unchanged for a deployment
that configures nothing.

## #4207 — symmetric, key-derivation and RNG provider seams

`ISymmetricCryptoProvider`, `IKeyDerivationProvider` and
`ISecureRandomSource`, added on the terms #4207 set: only once a
concrete requirement arrived (a validated module that must perform
*every* operation, not just the asymmetric ones), behind a fast path,
with `SymmetricChannelCryptoBenchmarks` as the gate.

They are **facets discovered by type test**, not members of
`ICryptoProvider`, so providers written against the shipped interface
still compile. `PlatformCryptoProvider` implements all three, which
answers the "an interface nothing implements" objection recorded in the
issue.

`CryptoProviderFacets` returns `null` both when no registry is
configured *and* when resolution lands on the platform, because the
platform facets are the inline code. Resolution happens once, in
`CalculateSymmetricKeySizes`, and is held for the life of the channel.

`CryptoCompliance.GetUnservedOperationPurposes` closes the failure the
seam would otherwise introduce: a provider bound to `ChannelSymmetric`
without implementing the facet is silently replaced by the platform, so
a deployment could believe its validated module performed the
per-message cryptography while the platform did. Under `FipsOnly` that
now refuses to start.

## #4208 — the asymmetric path is awaitable

`RSA` and `ECDsa` are .NET's contracts and cannot be replaced without
making every ready-made hardware and cloud implementation unusable.
Instead an implementation may **also** declare `IAsyncRsaKey` /
`IAsyncEcdsaKey`, which the stack finds by type test.

Now asynchronous: the secure channel open and renew path, user identity
token signing and decryption, and session activation. A software key
declares neither facet, so those paths complete synchronously and
nothing about their ordering changes.

`ReadAsymmetricMessage` is refactored into shared helpers rather than
duplicated — adding an `await` was not worth two hundred cloned lines of
signature, padding and endpoint-selection logic. `AsymmetricMessage` /
`AsymmetricWriteResult` exist because an asynchronous method cannot have
`out` parameters.

The channel no longer serialises its state on a monitor. A monitor
cannot be held across an `await`, and a plain `SemaphoreSlim` was not an
option at the time: the code relied on re-entrancy in eight places
(`HandleIncomingMessage` holds the lock and calls `ForceChannelFault`,
which takes it again; `ForceReconnect` and `Shutdown` do the same).
`ChannelGate` replaces it at 32 sites and `DataLock` is `[Obsolete]`.
That reliance has since been removed as well — see [Removing the gate's
re-entrancy](#removing-the-gates-re-entrancy) below.

### Defects this surfaced, all fixed and regression-tested

**Detached work started inline.** Writes were started with `_ =
WriteBuffersAsync(...)`. An async method runs its prologue on the
caller's stack, so `LeaveInheritedContext` — which exists to stop
*detached* work inheriting the right to re-enter the gate — was
stripping the **caller's own** entitlement; when the send then completed
synchronously, the completion blocked on a gate that very thread was
holding. The client sent its OpenSecureChannel request and never
processed the response. Writes are now queued.

**A synchronous gate handle held across an `await`.** `Enter()` records
the acquiring thread so an inline completion callback can re-enter —
`ChannelAsyncOperation` invokes its callback both inline and detached.
That record is only sound while the holder is synchronously on that
thread; the token renewal path held it across an await, so a reused pool
thread was recognised as the holder.

**`SignAsync` rejected the policy that signs nothing.** It validated the
certificate before the algorithm, so `SecurityPolicies.None` — which
carries no certificate — threw where the synchronous `Sign` returns
`null`.

**`EnterAsync` lost the holder when contended** *(found in review)*. The
`AsyncLocal` recording ownership was written inside the awaiting method,
and .NET restores the caller's execution context when an async method
completes, so the write was discarded. The caller returned owning the
semaphore while `IsHeldByCurrentContext` reported `false` — and any
nested `Enter()` then blocked forever on a gate its own context held.
Reachable remotely: `HandleIncomingMessageAsync` → error path →
`ForceChannelFault`. The holder is now published from the caller's frame
before the wait, and only its depth is raised in the continuation.

**Queued writes lost their order** *(found in review)*. Sequence numbers
are assigned under the gate, but independently queued work items reach
the transport's FIFO send lock in arbitrary order, so a peer could
reject a chunk with `BadSequenceNumberInvalid`. Writes are now appended
to a chain: still off the caller's stack, but a write cannot start
before its predecessor finishes.

### Four more this surfaced in CI, on paths only the integration suites
reach

Queuing the writes to fix the deadlock above turned out to have moved
three implicit guarantees, and the gate had one more liveness bug. Each
was reproduced locally against a clean baseline before it was changed.

**A faulting channel's error message never reached the peer.** A
listener channel sends a UASC `Error` describing why it faulted and
closes the transport as its next statement. That worked only because the
write started on the caller's stack, so the bytes reached the socket
first; queued, the close discarded them and the client saw
`BadConnectionClosed` instead of the certificate status it was told to
expect. Nine `SecurityCertValidationTests` cases assert exactly that
status. The terminal error is written inline again, on a path that
touches the gate only to disclaim what it inherited and reports nothing
— a channel that is already faulted is owed nothing beyond its buffer.

**The certificate of a rejected sender leaked.** An asynchronous method
cannot have `out` parameters, so the asymmetric read returns a record
instead. That silently dropped an ownership guarantee: an `out`
parameter reaches the caller even when the method goes on to throw, so
the caller's `catch` disposed the sender certificate and reported it to
the audit. A return value does not — nine leaked certificates, one per
rejection case, which the leak detector fails the run on. The parsed
certificate is now handed to the caller before anything that can reject
the message, restoring both the disposal and the audit.

**The gate could strand its own permit.** It released only when the
holder's depth returned to zero, but that depth lives in an `AsyncLocal`
and is therefore shared with every context forked from the owner's — a
timer callback whose timer was created inside the region, for instance.
Such a context entering the gate raised the shared depth, so the owner's
own exit saw a non-zero depth and returned without releasing, and
nothing afterwards could: the nested exit is not the owner. Every later
entry on that channel blocked forever. `Opc.Ua.Features.Tests` hung
after its tests had finished, with a receive loop waiting on the gate
and the server unable to stop. The owner now releases when it leaves;
depth still gates re-entrancy, but liveness no longer depends on a count
another context can move.

**Write completion throttled the writer.** Reporting a completed write
sat inside the ordering chain, and the client channel implements that
callback by entering the gate — so every write queued behind a gate the
receive loop contends for on each incoming chunk. A session with fifty
subscriptions publishing continuously had its publish requests throttled
enough that the client kept topping them up past its own limit, which
`Subscriptions.Classic` asserts against. Completion is now reported off
the chain, which covers only what ordering actually requires.

### Still synchronous, and why

Certificate, certificate request and revocation list signing cannot be
made asynchronous at all: `X509SignatureGenerator.SignData` is invoked
by .NET's own builders. Service faults and the `Reconnect` override are
reached from synchronous call sites (`SendServiceFault` alone has eight)
and are left as they are behind scoped, commented suppressions. All
three are documented rather than left to be rediscovered.

## #4210 — PubSub

This one produced a finding rather than the API the issue asked for, and
the finding is the point:

> **With a standard Security Key Service the key necessarily exists in
process memory.** `GetSecurityKeys` (Part 14 §8.3.2) returns raw key
bytes over the wire, so the "key never leaves the device" property #4192
achieved for client and server **cannot** be achieved for PubSub through
the SKS pull profile. That is a property of the specification, not of
this stack.

A wrapped-key envelope would change what is on the wire and break
interoperability with third-party key services and publishers, so it was
rejected rather than built.

What is achievable is delivered: the per-message AES-CTR and HMAC route
through `ISymmetricCryptoProvider`, so a validated module performs them.
`IPubSubSecurityPolicy` is **not** modified — new members would break
every implementation of it; the provider is supplied through the policy
constructor. `PlatformSymmetricCryptoProvider` gained AES counter mode,
which the seam should have covered anyway since the algorithm enum names
it.

Key lifetime is also tightened: unpacking an SKS response copied key
material into intermediates that `ByteString.Create` then copied again,
leaving plain keys in the heap for the lifetime of the process. Those
are now zeroed.

### Two wiring gaps this depended on, both found in review

The registrations above were **inert**, so this section originally
claimed more than the code did:

- `CryptoProviderConfiguration` was applied nowhere outside tests, so
`AddCryptoProvider(configure)` never reached the registry in a real
host. The registry now applies every registered configuration when it is
first resolved — which also affects #4207's DI story.
- `PubSubSecurityWrapperResolver` selected
`PubSubAes256CtrPolicy.Instance`, the provider-less static singleton,
ignoring the provider-backed bundles registered for it. A `FipsOnly`
deployment therefore certified while the platform did the work. The
resolver now selects from the registered policies; the container and
`PubSubApplicationBuilder` both supply theirs.

A third, smaller one: `CryptoProviderBuilder.Use` published a
**policy-scoped** random source as the process-wide nonce source, so
`.For(purpose, policyUri).Use(hsm)` redirected nonce generation for
every other policy too. Only an unscoped binding does that now.

## #4206 — a provider can contribute a security policy

Added in review: the policy set was fixed at compile time, so a provider
could contribute key custody but not a *profile*. It is now table-driven
and open, and the blockers #4206 listed are gone.

```csharp
using IDisposable registration = SecurityPolicies.Register(
    new SecurityPolicyInfo("urn:vendor:SecurityPolicy#CustomProfile", "CustomProfile")
    {
        PlatformSupport = () => true,
        SupportedCertificateTypes = [ObjectTypeIds.RsaSha256ApplicationCertificateType],
        IsDefault = true
    });

services.AddOpcUa()
    .AddCryptoProvider(crypto => crypto
        .For(CryptoPurpose.ChannelSymmetric, "urn:vendor:SecurityPolicy#CustomProfile").Use(module))
    .AddSecurityPolicy(customPolicy);
```

- **The reflection is gone.** Four lookup tables were built by
reflecting over the fields of `SecurityPolicies` and
`SecurityPolicyInfo`. They are one explicit table now, which removes the
**last reflection in `Security/Constants`** — so this is a trimming and
Native AOT improvement as much as a feature.
- **`SecurityPolicyInfo` is constructible from another assembly** and
carries the metadata the helpers need, so `IsPlatformSupportedName`,
`GetDefaultUris`, `MapSecurityPolicyToCertificateTypes` and
`GetCurveFromCertificateTypeId` read that table instead of each being
hand-written. Adding a policy is one entry rather than five edits.
- **The dead `#if CURVE25519` conditional is deleted** from
`Security/Constants`.
- Registration is copy-on-write, so the read path stays lock-free.
Shadowing a built-in policy requires `replaceExisting: true` and is
reversible by disposing the registration.

`RegisterLightsUpCurvePoliciesFromOutsideCore` is the acceptance test
the issue asked for: it registers `ECC_curve25519` and `ECC_curve448`
from the test project and asserts they become discoverable through the
public API.

**Registering a policy makes it advertised and resolvable; it does not
supply the cryptography behind it.** For those two curve profiles the
in-tree key agreement is still behind a compile symbol no project
defines plus a BouncyCastle dependency, so a deployment lighting them up
provides the operations through a provider. That division is the point:
the policy set says *what* is offered, the provider says *who* performs
it.

## Removing the gate's re-entrancy

Folded in from #4242, which was merged into this branch.

`ChannelGate` was re-entrant, and that forced the design behind most of
the defects above. A holder that awaits releases its thread, so
ownership could not be tracked by thread identity — it had to live in an
`AsyncLocal<Holder?>`. A logical context is *inherited*, so anything
started while the gate was held inherited the right to re-enter and ran
inside the guarded region alongside whatever started it, unless it opted
out by hand via `LeaveInheritedContext()` at each of eight sites,
enforced by review alone. Five of the defects listed above trace to that
mechanism, including both CI hangs.

So the *requirement* was removed rather than the mechanism, and the
`AsyncLocal` then deleted itself. Every path that re-entered now calls a
lock-free `Core` method (`ForceChannelFaultCore`, `ShutdownCore`,
`ForceReconnectCore`, `CompleteConnectCore`), and three regions stopped
running foreign code under the lock: the `RequestReceived` dispatch is
deferred until the gate is released, `OnTransportError` no longer wraps
the `HandleSocketError` virtual, and the callback setters and
`EndpointDescription` publish a single reference with a volatile write
instead of locking — the last is load-bearing, because
`AsyncResultBase.OperationCompleted` invokes the reverse-hello callback
inline while the gate is held.

`ChannelGate` is now a `SemaphoreSlim(1,1)` behind a `Releaser`;
`Holder`, the thread-identity fallback, `LeaveInheritedContext`,
`IsHeldByCurrentContext` and all eight disclaimer calls are gone, with
the call shape at all 32 sites unchanged. `SaveIntermediateChunk`,
`GetSavedChunks` and `DoMessageLimitsExceeded` gained a `gateHeld`
argument, because the client reaches them both with and without the gate
and must pick the matching teardown — without it an oversized
`OpenSecureChannel` response deadlocked the receive loop against itself.

The remaining paths were not found by reading the code, since that is
what missed them originally. A temporary strict mode made every
re-entrant acquisition throw with its stack, the suite was run under it
until clean, and it was deleted with the re-entrancy it measured. It
caught two sites review had missed: the `EndpointDescription` **property
getter** taking the gate, and the `RequestReceived` dispatch to
application code happening inside the guarded region.

Two deliberate residuals are documented for reviewers: `Dispose` no
longer takes the gate (unavoidable — it is reached from `ChannelFaulted`
with the gate held, where the old re-entrant acquisition excluded
nothing anyway), and the deferred request dispatch builds
`SecureChannelContext` just after gate release rather than under it.

## Testing

New: the three seams and their platform implementations, facet discovery
and resolution precedence, `FipsOnly` refusing a provider that cannot
serve what it was bound to, AES counter mode (including a
non-block-aligned round trip and a check that the counter carries, since
one that did not would silently reuse key stream), `ChannelGate`
(exclusion, re-entrancy across an await, re-entrancy on a reused thread,
and the deadlocks above), the asynchronous channel paths, and the PubSub
policy provider.

Each review finding got a test that fails without its fix:

- `ContendedEntryStillRecordsTheHolderAsync` — established contention
deterministically, then re-entered; failed on the pre-fix gate. Removed
with the re-entrancy it covered; `ChannelGateTests` now asserts the
non-re-entrant contract instead.
- `SecureClientAndTcpListenerKeepChunkOrderUnderConcurrentRequestsAsync`
— 60 concurrent multi-chunk `SignAndEncrypt` requests over a real
loopback listener; failed 3 runs out of 3 with the previous dispatch,
passes 3 out of 3 with the chain.
-
`DependencyInjectionRoutesPubSubCryptoThroughTheRegisteredProviderAsync`
— builds a container, registers a counting provider, wraps a message and
asserts the provider actually performed the encryption and the
signature. This is the assertion the PubSub claim above now rests on.
- `PolicyScopedRandomBindingDoesNotEscapeItsPolicy`.

Two further assertions are the ones that would catch a silent defect: a
provider and the platform must produce **byte-identical** output — a
validated module that disagreed could not interoperate — and with a
software key the returned `ValueTask` must report
`IsCompletedSuccessfully`, which is what makes "ordering is unchanged"
checkable rather than merely asserted.

`SymmetricChannelCryptoBenchmarks` gains a provider-registered variant
beside the existing baseline, so the cost of the indirection is measured
rather than assumed.

Verified locally, every suite at or above its recorded baseline: `dotnet
build UA.slnx -c Release` **0 warnings, 0 errors on all six target
frameworks**; Core **4413** (net10.0); Core.Security **617**, with its
certificate-leak detector clean; PubSub **1350** plus PubSub.Diagnostics
**54** and PubSub.Udp **233**; Features **156**; Subscriptions.Classic
**32**; Server integration **4053**; Client integration **2123**;
MigrationAnalyzer **151** and MigrationAnalyzer.Core **13**. Zero
failures in each.

Core moved from 4388 to 4381 when the gate change landed — eight
re-entrancy tests were removed along with the behaviour they covered,
and one deadlock regression test added — and has since grown to 4413
with the registry isolation, provider-output and security-review tests.
`ChannelGateTests` was rewritten around the new contract — exclusion
across both entry modes, an uncontended asynchronous entry not
suspending, re-entry blocking by contract, and the property that used to
be the hazard: work started while the gate is held is excluded without
having to opt out.

Every CI failure this PR produced was reproduced locally, diagnosed
against a clean `origin/master` baseline in a second worktree, and fixed
at the source. Two hangs were found from `--blame-hang-timeout` dumps
read with `dotnet-dump`. One failure that looked like a candidate was
confirmed **not** to be: an intermittent `Opc.Ua.Aot.Tests` connect
failure, pre-existing on `origin/master` (5 of 8 baseline runs failed,
versus 3 of 14 here).

### The publish request overshoot

`Subscriptions.Classic.PublishRequestCountAsync` failed on the Windows
net10.0 leg with **207** outstanding publish requests against a cap of
`max(maxServerPublishRequest, subscriptions)` = 50. It failed in 2 of 6
pipeline builds on this branch, never on `master` in 13 sampled builds,
and never locally in 12 attempts including under deliberate CPU
contention.

The mechanism is a genuine race.
`ClassicSubscriptionEngine.QueueBeginPublish` was a **check-then-act**:
it read `GoodPublishRequestCount`, compared it against
`GetDesiredPublishRequestCount(false)`, and issued a publish if it was
below. It runs on every publish completion, so *n* completions that
overlap each read the same value, each conclude they are below the cap,
and each issue — overshooting by up to *n* per round. The read also
*lags*: a request only becomes visible to `GoodPublishRequestCount` once
`AsyncRequestStarted` has recorded it, which happens after the request
has already been sent.

That code is pre-existing and was untouched by this PR. What this PR
changed is how hard the race is hit: the server used to hold the channel
gate across request processing, which serialised every request on a
channel, so publish completions arrived one at a time. Dispatching
`RequestReceived` outside the gate — an intended improvement, since a
channel should not serialise on application request-processing time —
lets them complete concurrently.

Rather than change the publish pipeline blind, the race was first made
reproducible.
`ConcurrentPublishReEvaluationDoesNotExceedDesiredRequestCount` drives
64 barrier-released completions against a mocked context whose count
lags the send exactly the way the session's does. It issued **64
requests where 5 were desired** — the same defect the CI leg hit, now
deterministic and running in milliseconds.

The engine now tracks the requests it has in flight and reserves a slot
with a compare-exchange before sending, so the decision and the send are
one atomic step. The reservation is released when the request completes,
when the send is declined, or when it throws. The repro test then issues
at most the desired count.

`StartPublishing` is deliberately left **uncapped**. It is the recovery
valve that refills a pipeline whose requests are outstanding but no
longer expected to return, so gating it on the in-flight count would
remove the only path out of a stalled pipeline. An earlier revision of
this fix did gate it, and that is the one change here that could not be
justified on the evidence — it was reverted.

The assertion was **not** loosened, retried away, or marked flaky: it
caught a real throttling regression earlier in this PR and is worth
keeping sharp.

Validated: the repro test red before the fix and green after;
`Subscriptions.Classic` 32/32 **five** consecutive runs on net10.0 and
once on net48; `Opc.Ua.Client.Tests` 2124 on net10.0 across four
consecutive runs and 2127 on net48; `Opc.Ua.Subscriptions.Tests` 604
passed with this fix in place.

### The SSH.NET advisory that turned CI red repo-wide

Partway through this work every build job began failing with `NU1903:
Package 'SSH.NET' 2025.1.0 has a known high severity vulnerability`
([GHSA-q939-rpr3-3284](https://github.com/advisories/GHSA-q939-rpr3-3284),
`<= 2025.1.0` affected, first patched `2026.0.0`).

Nothing in the dependency graph changed — the advisory was published.
Build 17026 failed on it where build 17000, two hours earlier on an
identical graph, had passed every build job. SSH.NET is not referenced
anywhere in the repository; it arrives transitively through
`Testcontainers.Kafka`.

`master` landed the remediation independently while this was being
investigated (a central transitive pin to `2026.0.0`, which
`CentralPackageTransitivePinningEnabled` exists for). This branch
briefly carried its own identical pin, which made the merge commit hold
**two** `PackageVersion` entries for SSH.NET and fail restore with
`NU1506`. The duplicate is removed and `master` is merged, so the pin
now comes from one place only.

The audit was **not** suppressed: `NuGetAudit` stays enabled and
`NU1903` stays an error. Verified after the merge — `dotnet restore
UA.slnx` reports neither NU1903 nor NU1506, and `dotnet build UA.slnx -c
Release` is **0 warnings, 0 errors** with the audit live.

The remaining red check in build 17026 was not from this change either.
`aot-ubuntu-latest` is the intermittent `Opc.Ua.Aot.Tests` failure
already noted above — `ReconnectSessionAsync` timed out at 30s with 135
of 136 passing. It remains below the `origin/master` baseline rate (4 of
15 sampled here against 5 of 8 on the baseline), and the managed
reconnect paths are green throughout: `Opc.Ua.Client.Tests` 2124 across
four consecutive runs and `Opc.Ua.Subscriptions.Tests` 604.


## Documentation

`docs/CryptoProvider.md` gains sections on substituting the symmetric
primitives, using a key served over a network, and PubSub — including
what cannot be claimed and why, the scope rule for a random-source
binding, and how to supply a provider-backed policy outside the
container. `docs/MigrationGuide.md` covers the `[Obsolete]` channel
virtuals and `DataLock`, and the non-re-entrant gate's contract for
channel subclasses. `docs/WhatsNewIn2.0.md` is updated.
`plans/cryptooffboard.md` is deleted now that the work it planned has
landed.

## Note for reviewers

This touches the secure channel handshake, which is the most
security-critical code in the stack. Nine distinct concurrency and
lifetime defects were found and fixed in it during this work — three
during development, two in review, four from CI — so `ChannelGate`, the
write path and the certificate ownership across the new suspension
points deserve the closest reading.

Five of those nine traced to the gate's `AsyncLocal`, which is why the
re-entrancy was subsequently removed and the `AsyncLocal` deleted. The
wrapper/`Core` split and the two documented residuals in that section
are the parts most worth a second reading.

The #4206 work removes the last reflection from `Security/Constants` and
rewrites the policy lookup tables, so
`SecurityConfiguration.SupportedSecurityPolicies` and the endpoint set
it feeds are worth a second look: an earlier revision of it changed that
set and broke six server tests, which is now covered by
`SecurityConfigurationBuildsExpectedSupportedPolicySet`.

## Related Issues

- Fixes #4206
- Fixes #4207
- Fixes #4208
- Fixes #4210
- Follow-up #4250 — this PR makes the security policy set injectable,
but nothing in the stack resolves `ISecurityPolicyRegistry` from DI yet,
so every production path still lands on the `Default` fallback. #4250
tracks threading it through `Session` and `UaSCBinaryChannel`, which is
what makes the injection points already added here load-bearing.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
Copilot-Session: 7a68ca72-83e8-496c-b2f5-3df4c718320b
Copilot-Session: 3f5ab76a-c0ba-4f47-87ac-54d1f4182c6b
2026-08-15 05:23:20 -07:00

32 KiB

Migration Guide

This document is the landing page for migrating your application between versions of the OPC UA .NET Standard Stack. The detailed per-version content lives in the migrate/ sub-folder; this page is the index that points you at the right version folder and keeps the small legacy migration notes inline.

General principles

  1. All API that is replaced with newer API is marked [Obsolete] and code should compile and work albeit of the warnings (which can be suppressed). [Obsolete] API will be cleaned up in the next minor version increment. We therefore recommend upgrading from minor version to minor version and fixing all [Obsolete] warnings as you go along.
  2. API that cannot be supported anymore will be removed in a minor version and migration steps documented in the version sub-folder. We try to keep this to an absolute minimum.
  3. Bugs or issues found in obsoleted API are not supported.
  4. We follow semver, but do not use the major version indicator to denote breaking changes like (1) or (2) as we should if we followed related conventions. We are a small team and cannot afford to maintain previous major versions, therefore we try to keep cases of (2) to a minimum and expect you to upgrade to the next minor version within 6 months of release.

Pro TIP. Point your favourite coding agent at this guide and let it do the migration work for you. The opcua-v20-migration agent skill knows when to load which sub-doc and runs the migration-analyzer codefixer end-to-end.

Per-version migration index

From To Where to read
1.5.378 2.0.x migrate/2.0.x/ — landing page + 13 thematic sub-docs (telemetry, packages, source-generation, types, encoders, node-states, identity, certificates, configuration, sessions-subscriptions, pubsub, alarms-model-change, timeprovider).
1.05.377 1.05.378 § inline below — small enough to keep on this page.
1.04 1.05 § inline below — small enough to keep on this page.

Looking for the broader narrative (non-prescriptive overview of what changed in a release)? See What's New in 2.0.

Migrating code that used the exposed diagnostics locks

IServerInternal, ISession and ISubscription no longer expose their synchronization primitives. The removed members are:

Interface Removed
IServerInternal DiagnosticsLock, DiagnosticsWriteLock
ISession DiagnosticsLock
ISubscription DiagnosticsLock, DiagnosticsWriteLock

A caller could not reason about these locks: it could not see what else took them, in what order, or for how long, and holding one across a call back into the stack could deadlock. Each owner now applies the mutation itself, so the critical section stays inside the object that understands it.

// was
lock (server.DiagnosticsLock)
{
    server.ServerDiagnostics.RejectedSessionCount++;
}

// now
server.UpdateServerDiagnostics(diagnostics => diagnostics.RejectedSessionCount++);

The same shape applies to sessions and subscriptions:

session.UpdateDiagnostics(diagnostics => diagnostics.ClientLastContactTime = now);
subscription.UpdateDiagnostics(diagnostics => diagnostics.NextSequenceNumber = next);

To read a value derived from the session or subscription diagnostics, use the read counterpart, which holds the same lock for the duration of the projection:

uint count = session.ReadDiagnostics(diagnostics => diagnostics.RepublishRequestCount);

Do not let the diagnostics object escape the callback. Once the callback returns the lock is released, so any field read from a captured reference is unsynchronized. Project the values you need inside the callback and return those.

IServerInternal.ServerDiagnostics was removed for the same reason: it handed out the mutable structure that the lock protects. UpdateServerDiagnostics and the diagnostic node manager are the supported paths.

Analyzer UA0029 flags each removed member and names its replacement. It reports rather than auto-fixes: turning a lock statement body into a lambda is not a transformation that can be applied safely without understanding what the body captures and returns.

Why there is no [Obsolete] shim

Every other removal in this guide keeps an [Obsolete] member for a release. These do not, and deliberately so. A lock is only useful if it is the lock the owner takes. A shim would have to hand back either a lock nobody else takes - silently turning a working critical section into no synchronization at all - or the real lock, which is exactly the coupling being removed. A missing member is a compile error the analyzer explains; a shim would be a race that shows up in production. ISession and ISubscription are also implemented by downstream code, and re-adding an interface member would break every implementer.

Migrating code that used ILocalNode.DataLock

ILocalNode.DataLock (implemented by Node) was removed. It returned the node instance itself, so lock (node.DataLock) was lock (node): one lock shared between the stack, the node and every caller, taken in an order none of them could see.

// was
lock (node.DataLock)
{
    value = node.Value;
}

// now - the node guards its own state
value = node.Value;

If the surrounding operation has to stay atomic across several calls, take a lock the calling component owns. Do not reach for one that is reachable from a shared node. Analyzer UA0025 flags the removed member.

Migrating code that used BaseVariableValue.Lock

BaseVariableValue.Lock was removed, and the constructor now takes a System.Threading.Lock instead of an object.

A derived value class - which is what the source generator emits for every structure variable - synchronizes through the protected EnterLock() / ExitLock() pair:

EnterLock();
try
{
    // read or write the value fields
}
finally
{
    ExitLock();
}

A component that has to make its own state atomic with the value passes a lock it already owns to the constructor and takes that one directly. This is how the server keeps its status and its diagnostics mutually exclusive:

private readonly Lock m_diagnosticsLock = new();

// the value is constructed with the lock its owner already holds elsewhere
m_status = new ServerStatusValue(statusNode, status, m_diagnosticsLock);

// so the owner synchronizes against the value without the value handing anything out
lock (m_diagnosticsLock)
{
    ...
}

Analyzer UA0026 flags the removed member. Note that regenerating the model sources with the 2.0 generator produces the EnterLock() / ExitLock() form already, so this only affects hand-written derived value classes and callers.

Migrating code that locked on a NodeState or a NodeBrowser

A NodeState guards its own attributes, children, notifiers and references, and NodeState.CreateBrowser guards the browser it builds. Nothing in the stack takes a lock on a node instance any more, so neither should a caller:

// was — the node manager reached for the node's monitor from outside the node
lock (source)
{
    browser = source.CreateBrowser(context, view, referenceType, includeSubtypes,
        browseDirection, default, null, false);
}

// now
INodeBrowser browser = source.CreateBrowser(context, view, referenceType,
    includeSubtypes, browseDirection, default, null, false);

lock (node) was also the only way to make a check-then-act pair atomic. Use NodeState.AddReferenceIfMissing instead, which does the check and the insert under the node's own lock:

// was
lock (node)
{
    if (!node.ReferenceExists(ReferenceTypeIds.HasNotifier, true, ObjectIds.Server))
    {
        node.AddReference(ReferenceTypeIds.HasNotifier, true, ObjectIds.Server);
    }
}

// now
node.AddReferenceIfMissing(ReferenceTypeIds.HasNotifier, true, ObjectIds.Server);

NodeBrowser.DataLock is gone with it. A browser is single-consumer: it belongs to whoever created it and performs no synchronization of its own. A derived browser that took DataLock inside its Next() override drops the lock statement and keeps the body. Where a browser genuinely outlives one service call — the instance parked in a continuation point for BrowseNext — its owner serializes it, as the stack does for its own continuation points.

A node type that overrides CreateBrowser and builds its own browser instead of delegating to the base implementation must fill it through PopulateBrowserSynchronized rather than calling PopulateBrowser directly, otherwise its browser is assembled from separately locked reads and can observe a node halfway through a change.

Analyzer UA0027 flags NodeBrowser.DataLock. See migrate/2.0.x/node-states.md.

Migrating code that used ApplicationConfiguration.PropertiesLock

ApplicationConfiguration.PropertiesLock was removed. It returned the properties dictionary itself, so lock (configuration.PropertiesLock) was lock (configuration.Properties): the lock was the data it guarded, shared between the configuration and every caller, taken in an order none of them could see.

Properties is now a concurrent dictionary, so each individual operation is already atomic and most callers simply drop the lock:

// was
lock (configuration.PropertiesLock)
{
    configuration.Properties["MyKey"] = value;
}

// now
configuration.Properties["MyKey"] = value;

The one combination that needs more than a single operation is get-or-add, which has its own member:

// was
lock (configuration.PropertiesLock)
{
    if (configuration.Properties.TryGetValue("MyKey", out object? existing))
    {
        return (MyType)existing;
    }
    var created = Build();
    configuration.Properties["MyKey"] = created;
    return created;
}

// now
return configuration.GetOrAddProperty("MyKey", Build);

GetOrAddProperty deliberately does not invoke the factory under a lock, so a caller cannot hold a critical section across a callback. Under contention the factory may run more than once; only one result is published and every caller receives that same instance, so keep the factory free of side effects that would matter if it ran twice.

One behaviour change is worth knowing: enumerating Properties while another thread writes no longer throws InvalidOperationException. It yields a moment-in-time view instead. Code that relied on the exception to detect concurrent modification has to detect it some other way.

Analyzer UA0028 flags the removed member.

Migrating node types that override FindChild or CreateChild

NodeState.FindChild and NodeState.CreateChild take assignInstanceNodeIds as their last parameter, and the four argument FindChild / two argument CreateChild virtuals are gone. The parameter defaults to true, so call sites are unaffected; an override fails to compile (CS0115) until the parameter is added and passed on.

Behaviour note: a node copy — NodeState.Create(context, source) and the Initialize(ISystemContext, NodeState) path behind it — now passes assignInstanceNodeIds: false. It no longer asks ISystemContext.NodeIdFactory for identifiers that the copy overwrites from the source on the very next statement. If your INodeIdFactory counts, reserves or audits every allocation, expect fewer calls than in 1.5.378 for the same address space; the resulting NodeIds are unchanged. Any NodeState subclass you own must thread the argument into its CreateOrReplace<Child> calls to get that benefit.

See Node states § FindChild and CreateChild for the before/after and Custom node types and assignment control for the runtime rules.

Removed members on ISession

ISession.SessionDiagnostics is removed. It handed out the whole mutable SessionDiagnosticsDataType — the structure the session's diagnostics lock protects — so a caller could read a field while the owner was writing it.

Every server-side reader wanted one value out of it, and those two values are now on the interface directly:

// was
string? uri = session.SessionDiagnostics?.ClientDescription?.ApplicationUri;
string name = session.SessionDiagnostics?.SessionName ?? string.Empty;

// now
string? uri = session.ClientApplicationUri;
string name = session.SessionName;

For anything else in the structure, project it inside ReadDiagnostics, which holds the lock for the duration of the projection:

uint reads = session.ReadDiagnostics(diagnostics => diagnostics.ReadCount.TotalCount);

SessionName is read from the field it was always a copy of rather than from the diagnostics, because it is assigned once during construction and a value that cannot change should not cost a lock.

The concrete Session still exposes SessionDiagnostics; only the interface loses it.

ISession.ValidateBeforeActivate — the synchronous overload with out IUserIdentityTokenHandler? and out UserTokenPolicy? parameters — is removed. It had no caller anywhere in the stack, its samples or its tests other than tests written for it, and it had been [Obsolete] since 1.5.378.

Use ValidateBeforeActivateAsync, which returns the same two values as a tuple:

(IUserIdentityTokenHandler identityToken, UserTokenPolicy? userTokenPolicy) =
    await session.ValidateBeforeActivateAsync(
        context, clientSignature, userIdentityToken, userTokenSignature, ct)
    .ConfigureAwait(false);

The synchronous overload could not verify a user token that required decryption, so on a secure endpoint it failed closed and directed callers to the asynchronous path anyway.

The history continuation points moved off ISession onto ISession.ContinuationPoints, and no longer pass object. SaveHistory and RestoreHistory use IHistoryContinuationPoint, which carries the point's own Guid Id and extends IDisposable:

// was
session.SaveHistoryContinuationPoint(state.Id, state);
object? restored = session.RestoreHistoryContinuationPoint(bytes);

// now
session.ContinuationPoints.SaveHistory(state);   // the point carries its Id
IHistoryContinuationPoint? restored = session.ContinuationPoints.RestoreHistory(bytes);

Implement IHistoryContinuationPoint on whatever type you store. The session previously disposed only those points that happened to implement IDisposable and silently leaked the rest; every point is now disposed.

Migrating code that called IServerInternal.Set* mutators

IServerInternal no longer exposes the twelve Set* binding methods or CreateServerObjectAsync. They were startup plumbing: StandardServer calls each exactly once, in one block, to carry a Create* factory result into the datastore. Publishing them on the interface let any holder rewire a running server, which would leave every component that had already resolved a subsystem holding the previous instance.

The supported seam is the factory seam, which already existed for every subsystem here:

Instead of Override Or register in DI
SetRoleManager StandardServer.CreateRoleManager IRoleManager
SetUserManagement StandardServer.CreateUserManagement (new) IUserManagement
SetMonitoredItemQueueFactory StandardServer.CreateMonitoredItemQueueFactory IMonitoredItemQueueFactory
SetSubscriptionStore StandardServer.CreateSubscriptionStore ISubscriptionStore
SetMainNodeManagerFactory StandardServer.CreateMainNodeManagerFactory —
SetNodeManager StandardServer.CreateMasterNodeManager —
SetSessionManager StandardServer.CreateSessionManager / CreateSubscriptionManager ISessionManager, ISubscriptionManager
SetAggregateManager StandardServer.CreateAggregateManagerAsync —
SetModellingRulesManager StandardServer.CreateModellingRulesManagerAsync —
SetConformanceUnitsManager StandardServer.CreateConformanceUnitsManagerAsync —

CreateUserManagement is new in this release, because user management was the one subsystem with no factory seam. Registering an IUserManagement in the container also switches on the username/password authenticator; override CreateUserManagement if you want the Part 18 §5 model without that.

SetIdentityRegistry is removed with no replacement. Nothing ever called it: the supported route has always been ServerIdentityRegistryExtensions.RegisterDefaultAuthenticators, which adds authenticators to the default registry rather than replacing it.

The methods remain on the concrete ServerInternalData, so code that already held that type keeps compiling. Binding is now refused once the server has finished starting — a late Set* throws ServiceResultException with BadInvalidState naming the operation.

Migrating IServerStartupTask implementations to IServerContext

IServerStartupTask.OnServerStartedAsync now receives an IServerContext instead of an IServerInternal. IServerInternal derives from IServerContext, so the host still passes the same object; only the declared parameter type changes and an implementation fails to compile (CS0535) until its signature is updated.

IServerContext is the ambient view of a running server. It carries what is genuinely server-wide and nothing else — it deliberately does not hand out the server's subsystems. A startup task that needs a subsystem takes it as a constructor dependency, which every implementation in this repository already did for its other dependencies.

Rewrite the member reads that no longer resolve:

Was Now
server.Telemetry server.DefaultSystemContext.Telemetry
server.NamespaceUris server.DefaultSystemContext.NamespaceUris
server.ServerUris server.DefaultSystemContext.ServerUris
server.TypeTree server.DefaultSystemContext.TypeTable
server.Factory server.DefaultSystemContext.EncodeableFactory
server.DiagnosticsNodeManager.FindPredefinedNode<T>(id) server.FindPredefinedNode<T>(id)
server.NodeManager.NodeManagers + a type test server.FindNodeManagers<TCapability>()
server.SessionManager, server.SubscriptionManager, server.RequestManager, server.AggregateManager, server.RoleManager, server.IdentityRegistry, … constructor injection

server.MessageContext is unchanged and remains on IServerContext. Do not substitute server.DefaultSystemContext.AsMessageContext() for it: that conversion produces a context with default decoding limits rather than the server's configured MaxStringLength, MaxArrayLength and MaxByteStringLength, which silently widens what your component accepts.

Tests that hand a Mock<IServerInternal> to a startup task keep compiling, because the mock still satisfies IServerContext. Stub the members the task actually reads now — typically DefaultSystemContext and any FindNodeManagers<T>() — or the mock returns null and the task fails at run time rather than at build time.

Removed members on IServerInternal

The following members had no consumer anywhere in the stack, its samples or its tests, and have been removed. Each has a direct replacement:

Removed Use instead
CloseSession(OperationContext, NodeId, bool) CloseSessionAsync(…)
Status CurrentState to read, UpdateServerStatus to write
ServerDiagnostics UpdateServerDiagnostics(Action<…>)
DiagnosticsEnabled IDiagnosticsNodeManager.DiagnosticsEnabled
ModellingRulesManager, ConformanceUnitsManager the concrete ServerInternalData, which owns them

MessageContext, DefaultSystemContext, CurrentState, ServerObject, ReportEventAsync, CloseSessionAsync, DeleteSubscriptionAsync and UpdateServerDiagnostics all moved down to IServerContext, the ambient view of a running server that IServerInternal now derives from. They remain reachable through IServerInternal unchanged, so no call site has to move. CurrentState is read-only on the ambient interface; the server itself still sets it.

Migrating servers that relied on unserved history advertisement

Server startup now reconciles variables that advertise history with the historian providers actually wired into the server. If a variable has Historizing=true or HistoryRead / HistoryWrite access-level bits from a NodeSet but no IHistorianProvider resolves for it, the server clears the advertisement and masks the attribute read callbacks before accepting clients. Variables with a provider keep their NodeSet-declared history surface.

If a client or CTT setup expected HistoryRead solely because the NodeSet declared it, wire a historian instead of relying on the static flag: use builder.UseHistorian() and .Historize(...), register a provider through the server-wide historian registry, or override GetHistorianProvider(NodeState) in the node manager. See Server address-space metadata and Historical Access.

Migrating custom ISessionManager implementations to ShutdownAsync

ISessionManager.Shutdown() is gone, replaced by ShutdownAsync(CancellationToken). SessionManager previously started its session monitor loop with a discarded Task.Factory.StartNew(...), so Shutdown() only signalled the loop and returned: the server could finish tearing down while the monitor was still closing expired sessions and raising keep-alive events against half-disposed state. There is no correct synchronous way to wait for that loop — blocking on it would be sync-over-async — so the synchronous overload was removed rather than kept as a trap. ShutdownAsync cancels the loop and awaits it before disposing the sessions, matching ISubscriptionManager.ShutdownAsync.

Callers await instead of calling:

// before
server.SessionManager.Shutdown();

// after
await server.SessionManager.ShutdownAsync(cancellationToken)
    .ConfigureAwait(false);

Implementers of ISessionManager (for example a manager registered through services.AddSessionManager<T>()) replace Shutdown with ShutdownAsync. If your implementation has no background work, return a completed task:

public ValueTask ShutdownAsync(CancellationToken cancellationToken = default)
{
    CloseAllSessions();
    return default;
}

Deriving from SessionManager requires no change beyond renaming any Shutdown override: ShutdownAsync is virtual and the base implementation already awaits the monitor loop.

Migrating callers of the synchronous MonitoredNode2 notification wrappers

MonitoredNode2.OnReportEvent and MonitoredNode2.OnMonitoredNodeChanged are [Obsolete]; use OnReportEventAsync and OnMonitoredNodeChangedAsync. Nothing in the stack wires the synchronous pair any more — notifiers are attached through NodeState.OnReportEventAsync and NodeState.OnStateChangedAsync — and both wrappers block the calling thread whenever the bounded notification channel is full, or whenever the node has an asynchronous read handler. Blocking there occupies a thread while waiting for a consumer that needs a thread of its own, which starves the thread pool under load.

// before
monitoredNode.OnReportEvent(context, node, e);

// after
await monitoredNode.OnReportEventAsync(context, node, e, cancellationToken)
    .ConfigureAwait(false);

The wrappers still work and are unchanged in behaviour, so this is a warning to act on rather than a break.

Migrating callers of the SecurityPolicies lookup and cryptography statics

The static lookup and cryptography methods on SecurityPolicies have moved to ISecurityPolicyRegistry. They read the set of registered security policies, so they are members of the registry that owns that set rather than free functions on a constants class.

Moved: GetUri, GetDisplayName, GetDisplayNames, IsValidSecurityPolicyUri, GetDefaultUris, GetDefaultEccUris, GetDefaultDeprecatedUris, Encrypt and Decrypt.

The policy URI constants are unaffected. SecurityPolicies.None, SecurityPolicies.Basic256Sha256 and the rest stay exactly where they are, which is the overwhelming majority of references to this type.

Resolve an ISecurityPolicyRegistry where a container is in scope, so the policies that application registered are the ones used:

// before
string uri = SecurityPolicies.GetUri("Basic256Sha256");

// after - the application's own policy set
public sealed class MyService(ISecurityPolicyRegistry policies)
{
    public string? Uri => policies.GetUri("Basic256Sha256");
}

Where there is no container — configuration loading, for instance — use the fallback, which carries the built-in policies:

string? uri = SecurityPolicies.Default.GetUri("Basic256Sha256");

Encrypt and Decrypt additionally lose their ILogger argument. The registry is created with an ITelemetryContext and reports through the logger it made from it:

// before
EncryptedData data = SecurityPolicies.Encrypt(certificate, uri, plainText, logger);

// after
EncryptedData data = policies.Encrypt(certificate, uri, plainText);

Registering a policy through the container no longer changes what other code in the same process sees. AddSecurityPolicy applies the policy to the registry that container owns, so two applications hosted together keep separate policy sets. Use AddSecurityPolicyRegistry() to resolve a registry without contributing a policy of your own.

The OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer package restores the removed members as [Obsolete] extension members that forward to SecurityPolicies.Default, so a 1.05.378 application compiles with a warning rather than an error. The ILogger argument on the Encrypt and Decrypt shims is accepted and ignored.

Migrating channel subclasses that guarded state with DataLock

UaSCBinaryChannel.DataLock has been removed. The channel no longer serialises any of its own state on it, so taking it excluded nothing.

A monitor cannot be held across an await, and the secure channel open path has to be able to await once a private key may be served over a network — see Crypto provider. The channel now uses an internal gate that can be entered from a synchronous or an asynchronous path. Unlike a monitor the gate is not re-entrant: every channel path that used to take the lock while already holding it now calls a lock-free Core variant instead.

That has one consequence for subclasses. The channel calls HandleSocketError, NotifyMonitors and CompleteReverseHello from paths that may already hold the gate, so an override of any of them must not call back into a channel method that takes it — ForceChannelFault and SendResponse in particular. Such an override would have silently nested before and will now block.

For the same reason SaveIntermediateChunk, GetSavedChunks and DoMessageLimitsExceeded take an additional gateHeld argument. It says whether the calling frame already holds the gate, so that an override which tears the channel down can pick the locking or the lock-free path:

// before
protected override void DoMessageLimitsExceeded()
{
    base.DoMessageLimitsExceeded();
    Shutdown(new ServiceResult(StatusCodes.BadResponseTooLarge));
}

// after
protected override void DoMessageLimitsExceeded(bool gateHeld)
{
    base.DoMessageLimitsExceeded(gateHeld);

    if (gateHeld)
    {
        ShutdownCore(new ServiceResult(StatusCodes.BadResponseTooLarge));
        return;
    }

    Shutdown(new ServiceResult(StatusCodes.BadResponseTooLarge));
}

There is no drop-in replacement to offer across an assembly boundary, because the gate has to be entered asynchronously on the open path and its correctness depends on rules that only hold inside the channel implementation. A subclass outside this stack that guarded its own state with DataLock should introduce its own synchronisation:

// before
lock (DataLock)
{
    m_myState = value;
}

// after
private readonly System.Threading.Lock m_myLock = new();

using (m_myLock.EnterScope())
{
    m_myState = value;
}

A subclass that took DataLock in order to be mutually exclusive with the channel's state transitions was already relying on an implementation detail, and can no longer do so.

Migrating channel subclasses that override HandleIncomingMessage

UaSCBinaryChannel.HandleIncomingMessage and OnChunkReceived have been removed, as has the protected WriteAsymmetricMessage overload that returned the signature through an out parameter. The receive loop calls HandleIncomingMessageAsync and OnChunkReceivedAsync, so that the secure channel open path can await a private key served over a network — see Crypto provider.

A synchronous override cannot be kept working underneath the asynchronous path without defeating the point of it, so an existing override must be moved. The signature gains a CancellationToken and returns ValueTask<bool>:

// before
protected override bool HandleIncomingMessage(
    uint messageType, ArraySegment<byte> messageChunk)
{
    ...
}

// after
protected override async ValueTask<bool> HandleIncomingMessageAsync(
    uint messageType, ArraySegment<byte> messageChunk, CancellationToken ct)
{
    ...
}

An override that has nothing to await can return a completed value without going asynchronous at all:

protected override ValueTask<bool> HandleIncomingMessageAsync(
    uint messageType, ArraySegment<byte> messageChunk, CancellationToken ct)
{
    return new ValueTask<bool>(HandleSynchronously(messageType, messageChunk));
}

The buffer-ownership contract is unchanged: return true when the implementor takes ownership of the chunk, and it will not be returned to the buffer manager for you.

ReadAsymmetricMessageAsync and WriteAsymmetricMessageAsync return AsymmetricMessage and AsymmetricWriteResult rather than using out parameters, which an asynchronous method cannot have. Use WriteAsymmetricMessageAsync in place of the removed synchronous overload.

Migrating from 1.05.377 to 1.05.378

Asynchronous as default

The server now supports AsyncNodeManagers; see Server Async (TAP) Support. The client APIs are async by default and all synchronous and APM-based API has been deprecated. To migrate, update your code to use the Async version of every API where possible. Not recommended but for expedience you can call the Async version synchronously with GetAwaiter().GetResult().

Observability

Observability is now plumbed through ITelemetryContext. The legacy static Utils.SetLogger / Utils.Trace* model has been removed in 2.0. See migrate/2.0.x/telemetry.md for OLD vs NEW snippets, the per-type constructor matrix, and the full inventory of removed / [Obsolete] Utils APIs.

Configuration-level trace apply APIs were removed as well: TraceConfiguration.ApplySettings() and ApplicationConfigurationBuilder trace setters (SetOutputFilePath, SetDeleteOnLoad, SetTraceMasks). Configure logging through ITelemetryContext instead.

Migrating from 1.04 to 1.05

A few features are still missing to fully comply with 1.05, but certification for v1.04 is still possible with the 1.05 release.

Support

For additional migration support: