@depup/mysql2 3.21.1-depup.0 → 3.23.1-depup.0

package/README.md

@@ -13,10 +13,16 @@ npm install @depup/mysql2
 
 | Field | Value |
 |-------|-------|
-| Original | [mysql2](https://www.npmjs.com/package/mysql2) @ 3.21.1 |
-| Processed | 2026-04-10 |
+| Original | [mysql2](https://www.npmjs.com/package/mysql2) @ 3.23.1 |
+| Processed | 2026-07-21 |
 | Smoke test | passed |
-| Deps updated | 0 |
+| Deps updated | 1 |
+
+## Dependency Changes
+
+| Dependency | From | To |
+|------------|------|-----|
+| iconv-lite | ^0.7.2 | ^0.7.3 |
 
 ---
 

package/changes.json

@@ -1,5 +1,10 @@
 {
-  "bumped": {},
-  "timestamp": "2026-04-10T05:04:40.941Z",
-  "totalUpdated": 0
+  "bumped": {
+    "iconv-lite": {
+      "from": "^0.7.2",
+      "to": "^0.7.3"
+    }
+  },
+  "timestamp": "2026-07-21T17:25:03.071Z",
+  "totalUpdated": 1
 }

package/lib/base/connection.js

@@ -87,6 +87,8 @@ class BaseConnection extends EventEmitter {
       },
     });
     this.serverCapabilityFlags = 0;
+    this._isMariaDB = false;
+    this._mariadbExtendedMetadata = false;
     this.authorized = false;
     this.sequenceId = 0;
     this.compressedSequenceId = 0;
@@ -186,7 +188,7 @@ class BaseConnection extends EventEmitter {
         });
       }
     }
-    // in case there was no initial handshake but we need to read sting, assume it utf-8
+    // in case there was no initial handshake but we need to read string, assume it utf-8
     // most common example: "Too many connections" error ( packet is sent immediately on connection attempt, we don't know server encoding yet)
     // will be overwritten with actual encoding value as soon as server handshake packet is received
     this.serverEncoding = 'utf8';
@@ -285,7 +287,7 @@ class BaseConnection extends EventEmitter {
         bubbleErrorToConnection = true;
       }
     }
-    // notify connection if some comands in the queue did not have callbacks
+    // notify connection if some commands in the queue did not have callbacks
     // or if this is pool connection ( so it can be removed from pool )
     if (bubbleErrorToConnection || this._pool) {
       this.emit('error', err);
@@ -928,6 +930,10 @@ class BaseConnection extends EventEmitter {
     return this.addCommand(new Commands.Ping(cb));
   }
 
+  reset(cb) {
+    return this.addCommand(new Commands.ResetConnection(cb));
+  }
+
   _registerSlave(opts, cb) {
     return this.addCommand(new Commands.RegisterSlave(opts, cb));
   }

package/lib/base/pool.js

@@ -127,7 +127,37 @@ class BasePool extends EventEmitter {
         cb = this._connectionQueue.shift();
         process.nextTick(this.getConnection.bind(this, cb));
       }
-    } else if (this._connectionQueue.length) {
+      return;
+    }
+
+    // Reset connection state if configured
+    if (this.config.resetOnRelease && connection.reset) {
+      connection.reset((err) => {
+        if (err) {
+          // If reset fails, remove connection from pool
+          connection._pool = null;
+          spliceConnection(this._allConnections, connection);
+          connection.destroy();
+
+          // Try to create a new connection for waiting callbacks
+          if (this._connectionQueue.length) {
+            cb = this._connectionQueue.shift();
+            process.nextTick(this.getConnection.bind(this, cb));
+          }
+          return;
+        }
+
+        // Reset successful, continue with normal release flow
+        this._handleSuccessfulRelease(connection);
+      });
+    } else {
+      this._handleSuccessfulRelease(connection);
+    }
+  }
+
+  _handleSuccessfulRelease(connection) {
+    let cb;
+    if (this._connectionQueue.length) {
       cb = this._connectionQueue.shift();
       process.nextTick(() => {
         connection._released = false;
@@ -155,6 +185,10 @@ class BasePool extends EventEmitter {
         }
       };
     }
+    while (this._connectionQueue.length > 0) {
+      const queuedCallback = this._connectionQueue.shift();
+      process.nextTick(() => queuedCallback(new Error('Pool is closed.')));
+    }
     let calledBack = false;
     let closedConnections = 0;
     let connection;

package/lib/commands/auth_switch.js

@@ -72,6 +72,28 @@ function authSwitchRequest(packet, connection, command) {
     return;
   }
 
+  if (pluginName === 'mysql_clear_password') {
+    const hasCustomPlugin =
+      connection.config.authPlugins &&
+      Object.prototype.hasOwnProperty.call(
+        connection.config.authPlugins,
+        'mysql_clear_password'
+      );
+    if (!hasCustomPlugin && !connection.config.enableCleartextPlugin) {
+      const err = new Error(
+        'Server requested authentication using mysql_clear_password, ' +
+          'which sends the password in plaintext over the network and is ' +
+          'disabled by default. To enable it, set the `enableCleartextPlugin` ' +
+          'option to `true` in your connection configuration, or provide a ' +
+          'custom `mysql_clear_password` auth plugin via the `authPlugins` ' +
+          'option. Only use this over a secure connection (TLS/SSL).'
+      );
+      err.code = 'MYSQL_CLEAR_PASSWORD_NOT_ENABLED';
+      err.fatal = true;
+      throw err;
+    }
+  }
+
   const authPlugin = getAuthPlugin(pluginName, connection);
   if (!authPlugin) {
     throw new Error(

package/lib/commands/client_handshake.js

@@ -1,5 +1,5 @@
 // This file was modified by Oracle on June 17, 2021.
-// Handshake errors are now maked as fatal and the corresponding events are
+// Handshake errors are now marked as fatal and the corresponding events are
 // emitted in the command instance itself.
 // Modifications copyright (c) 2021, Oracle and/or its affiliates.
 
@@ -13,6 +13,7 @@
 const Command = require('./command.js');
 const Packets = require('../packets/index.js');
 const ClientConstants = require('../constants/client.js');
+const MariaDBClientConstants = require('../constants/mariadb_client.js');
 const CharsetToEncoding = require('../constants/charset_encodings.js');
 const auth41 = require('../auth_41.js');
 const { getAuthPlugin } = require('./auth_switch.js');
@@ -35,6 +36,7 @@ class ClientHandshake extends Command {
     super();
     this.handshake = null;
     this.clientFlags = clientFlags;
+    this.mariadbExtendedClientFlags = 0;
     this.authenticationFactor = 0;
   }
 
@@ -45,7 +47,8 @@ class ClientHandshake extends Command {
   sendSSLRequest(connection) {
     const sslRequest = new Packets.SSLRequest(
       this.clientFlags,
-      connection.config.charsetNumber
+      connection.config.charsetNumber,
+      this.mariadbExtendedClientFlags
     );
     connection.writePacket(sslRequest.toPacket());
   }
@@ -105,7 +108,9 @@ class ClientHandshake extends Command {
     const canUseDirectAuth =
       !hasCustomAuthPlugin &&
       !hasLegacyAuthSwitchHandler &&
-      this.canUseAuthMethodDirectly(serverAuthMethod, isSecureConnection);
+      this.canUseAuthMethodDirectly(serverAuthMethod, isSecureConnection) &&
+      (serverAuthMethod !== 'mysql_clear_password' ||
+        connection.config.enableCleartextPlugin);
 
     const clientAuthMethod = canUseDirectAuth
       ? serverAuthMethod
@@ -128,6 +133,7 @@ class ClientHandshake extends Command {
 
     const handshakeResponse = new Packets.HandshakeResponse({
       flags: this.clientFlags,
+      mariadbExtendedClientFlags: this.mariadbExtendedClientFlags,
       user: this.user,
       database: this.database,
       password: this.password,
@@ -263,6 +269,26 @@ class ClientHandshake extends Command {
     connection.serverCapabilityFlags = this.handshake.capabilityFlags;
     connection.serverEncoding = CharsetToEncoding[this.handshake.characterSet];
     connection.connectionId = this.handshake.connectionId;
+    // MariaDB needs a few protocol deviations, e.g. it rejects the JSON
+    // parameter type in COM_STMT_EXECUTE
+    connection._isMariaDB = /mariadb/i.test(this.handshake.serverVersion);
+    // If a MariaDB server offers extended column metadata, request it so
+    // MariaDB-specific column types (UUID, INET4, INET6, VECTOR and the JSON
+    // alias) can be identified. The server only reads the extended client
+    // capability bytes when the client leaves CLIENT_MYSQL (LONG_PASSWORD)
+    // unset, mirroring the server side of the negotiation.
+    if (
+      this.handshake.mariadbExtendedCapabilityFlags &
+      MariaDBClientConstants.MARIADB_CLIENT_EXTENDED_METADATA
+    ) {
+      this.clientFlags &= ~ClientConstants.LONG_PASSWORD;
+      this.mariadbExtendedClientFlags |=
+        MariaDBClientConstants.MARIADB_CLIENT_EXTENDED_METADATA;
+    }
+    connection._mariadbExtendedMetadata = Boolean(
+      this.mariadbExtendedClientFlags &
+      MariaDBClientConstants.MARIADB_CLIENT_EXTENDED_METADATA
+    );
     const serverSSLSupport =
       this.handshake.capabilityFlags & ClientConstants.SSL;
     // multi factor authentication is enabled with the
@@ -339,8 +365,9 @@ class ClientHandshake extends Command {
         }
         return ClientHandshake.prototype.handshakeResult;
       } catch (err) {
-        // Authentication errors are fatal
-        err.code = 'AUTH_SWITCH_PLUGIN_ERROR';
+        if (!err.code) {
+          err.code = 'AUTH_SWITCH_PLUGIN_ERROR';
+        }
         err.fatal = true;
 
         if (this.onResult) {

package/lib/commands/execute.js

@@ -51,7 +51,8 @@ class Execute extends Command {
       connection.config.charsetNumber,
       connection.config.timezone,
       this._executeOptions.attributes,
-      clientFlags
+      clientFlags,
+      connection._isMariaDB
     );
     //For reasons why this try-catch is here, please see
     // https://github.com/sidorares/node-mysql2/pull/689
@@ -72,12 +73,13 @@ class Execute extends Command {
     // disabling for now, but would be great to find reliable way to parse fields only once
     // fields reported by prepare can be empty at all or just incorrect - see #169
     //
-    // perfomance optimisation: if we already have this field parsed in statement header, use one from header
+    // performance optimisation: if we already have this field parsed in statement header, use one from header
     // const field = this.statement.columns.length == this._fieldCount ?
     //  this.statement.columns[this._receivedFieldsCount] : new Packets.ColumnDefinition(packet);
     const field = new Packets.ColumnDefinition(
       packet,
-      connection.clientEncoding
+      connection.clientEncoding,
+      connection._mariadbExtendedMetadata
     );
     this._receivedFieldsCount++;
     this._fields[this._resultIndex].push(field);

package/lib/commands/index.js

@@ -10,6 +10,7 @@ const Ping = require('./ping.js');
 const RegisterSlave = require('./register_slave.js');
 const BinlogDump = require('./binlog_dump.js');
 const ChangeUser = require('./change_user.js');
+const ResetConnection = require('./reset_connection.js');
 const Quit = require('./quit.js');
 
 module.exports = {
@@ -23,5 +24,6 @@ module.exports = {
   RegisterSlave,
   BinlogDump,
   ChangeUser,
+  ResetConnection,
   Quit,
 };

package/lib/commands/ping.js

@@ -5,7 +5,7 @@ const CommandCode = require('../constants/commands');
 const Packet = require('../packets/packet');
 
 // TODO: time statistics?
-// usefull for queue size and network latency monitoring
+// useful for queue size and network latency monitoring
 // store created,sent,reply timestamps
 class Ping extends Command {
   constructor(callback) {

package/lib/commands/prepare.js

@@ -87,7 +87,11 @@ class Prepare extends Command {
       }
       return this.prepareDone(connection);
     }
-    const def = new Packets.ColumnDefinition(packet, connection.clientEncoding);
+    const def = new Packets.ColumnDefinition(
+      packet,
+      connection.clientEncoding,
+      connection._mariadbExtendedMetadata
+    );
     this.parameterDefinitions.push(def);
     if (this.parameterDefinitions.length === this.parameterCount) {
       return Prepare.prototype.parametersEOF;
@@ -99,7 +103,11 @@ class Prepare extends Command {
     if (packet.isEOF()) {
       return this.prepareDone(connection);
     }
-    const def = new Packets.ColumnDefinition(packet, connection.clientEncoding);
+    const def = new Packets.ColumnDefinition(
+      packet,
+      connection.clientEncoding,
+      connection._mariadbExtendedMetadata
+    );
     this.fields.push(def);
     if (this.fields.length === this.fieldCount) {
       return Prepare.prototype.fieldsEOF;

package/lib/commands/query.js

@@ -199,7 +199,8 @@ class Query extends Command {
     if (this._fields[this._resultIndex].length !== this._fieldCount) {
       const field = new Packets.ColumnDefinition(
         packet,
-        connection.clientEncoding
+        connection.clientEncoding,
+        connection._mariadbExtendedMetadata
       );
       this._fields[this._resultIndex].push(field);
       if (connection.config.debug) {

package/lib/commands/reset_connection.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const Command = require('./command');
+const Packets = require('../packets/index.js');
+
+class ResetConnection extends Command {
+  constructor(callback) {
+    super();
+    this.onResult = callback;
+  }
+
+  start(packet, connection) {
+    const req = new Packets.ResetConnection();
+    connection.writePacket(req.toPacket());
+    return ResetConnection.prototype.resetConnectionResponse;
+  }
+
+  resetConnectionResponse(packet, connection) {
+    if (connection._statements) {
+      connection._statements.clear();
+    }
+    if (this.onResult) {
+      process.nextTick(this.onResult.bind(this, null));
+    }
+    return null;
+  }
+}
+
+module.exports = ResetConnection;

package/lib/compressed_protocol.js

@@ -40,7 +40,7 @@ function handleCompressedPacket(packet) {
 
   if (deflatedLength !== 0) {
     connection.inflateQueue.push((task) => {
-      zlib.inflate(body, (err, data) => {
+      zlib.inflate(body, { maxOutputLength: deflatedLength }, (err, data) => {
         if (err) {
           connection._handleNetworkError(err);
           return;

package/lib/connection_config.js

@@ -60,12 +60,14 @@ const validOptions = {
   uri: 1,
   user: 1,
   disableEval: 1,
+  enableCleartextPlugin: 1,
   // These options are used for Pool
   connectionLimit: 1,
   maxIdle: 1,
   idleTimeout: 1,
   Promise: 1,
   queueLimit: 1,
+  resetOnRelease: 1,
   waitForConnections: 1,
   jsonStrings: 1,
   gracefulEnd: 1,
@@ -152,6 +154,7 @@ class ConnectionConfig {
       options.nestTables === undefined ? undefined : options.nestTables;
     this.typeCast = options.typeCast === undefined ? true : options.typeCast;
     this.disableEval = Boolean(options.disableEval);
+    this.enableCleartextPlugin = Boolean(options.enableCleartextPlugin);
     if (this.timezone[0] === ' ') {
       // "+" is a url encoded char for space so it
       // gets translated to space when giving a

package/lib/constants/charset_encodings.js

@@ -3,7 +3,7 @@
 // see tools/generate-charset-mapping.js
 // basicalliy result of "SHOW COLLATION" query
 
-module.exports = [
+const encodings = [
   'utf8',
   'big5',
   'latin2',
@@ -315,3 +315,27 @@ module.exports = [
   'utf8',
   'utf8',
 ];
+
+// MariaDB NO PAD collations mirror their PAD SPACE counterparts:
+// collation id = PAD SPACE collation id + 1024
+const padSpaceLength = encodings.length;
+for (let id = 1025; id < 1024 + padSpaceLength; id++) {
+  encodings[id] = encodings[id - 1024];
+}
+
+// MariaDB UCA-14.0.0 (uca1400) collations use fixed 256-id blocks
+// per character set, each covering the PAD SPACE and NO PAD variants
+const uca1400Blocks = [
+  [2048, 'cesu8'], // utf8mb3
+  [2304, 'utf8'], // utf8mb4
+  [2560, 'ucs2'], // ucs2
+  [2816, 'utf16'], // utf16
+  [3072, 'utf32'], // utf32
+];
+for (const [start, encoding] of uca1400Blocks) {
+  for (let id = start; id < start + 256; id++) {
+    encodings[id] = encoding;
+  }
+}
+
+module.exports = encodings;

package/lib/constants/commands.js

@@ -32,5 +32,6 @@ module.exports = {
   STMT_FETCH: 0x1c,
   DAEMON: 0x1d, // deprecated
   BINLOG_DUMP_GTID: 0x1e,
+  RESET_CONNECTION: 0x1f, // introduced in 5.7.3
   UNKNOWN: 0xff, // bad!
 };

package/lib/constants/mariadb_client.js

@@ -0,0 +1,19 @@
+'use strict';
+
+// MariaDB-specific extended capability flags.
+//
+// MariaDB servers (10.2+) do not set the CLIENT_MYSQL (LONG_PASSWORD)
+// capability and instead use 4 reserved bytes of the initial handshake packet
+// to advertise these flags. Clients answer with their own extended
+// capabilities in the last 4 reserved bytes of the handshake response
+// (the server only reads them when the client leaves CLIENT_MYSQL unset).
+//
+// The flags below are the lower 32 bits shifted down, i.e.
+// MARIADB_CLIENT_PROGRESS is documented as 1 << 32.
+// https://mariadb.com/docs/server/reference/clientserver-protocol/1-connecting/connection
+exports.MARIADB_CLIENT_PROGRESS = 0x00000001;
+exports.MARIADB_CLIENT_COM_MULTI = 0x00000002; /* deprecated */
+exports.MARIADB_CLIENT_STMT_BULK_OPERATIONS = 0x00000004;
+exports.MARIADB_CLIENT_EXTENDED_METADATA = 0x00000008;
+exports.MARIADB_CLIENT_CACHE_METADATA = 0x00000010;
+exports.MARIADB_CLIENT_BULK_UNIT_RESULTS = 0x00000020;

package/lib/packets/binary_row.js

@@ -12,7 +12,7 @@ class BinaryRow {
 
   static toPacket(columns, encoding) {
     // throw new Error('Not implemented');
-    const sequenceId = 0; // TODO remove, this is calculated now in connecton
+    const sequenceId = 0; // TODO remove, this is calculated now in connection
     let length = 0;
     columns.forEach((val) => {
       if (val === null || typeof val === 'undefined') {
@@ -82,7 +82,7 @@ binaryReader[2] = Packet.prototype.readInt16; // short
 binaryReader[3] = Packet.prototype.readInt32; // long
 binaryReader[4] = Packet.prototype.readFloat; // float
 binaryReader[5] = Packet.prototype.readDouble; // double
-binaryReader[6] = Packet.prototype.assertInvalid; // null, should be skipped vie null bitmap
+binaryReader[6] = Packet.prototype.assertInvalid; // null, should be skipped via null bitmap
 binaryReader[7] = Packet.prototype.readTimestamp; // timestamp, http://dev.mysql.com/doc/internals/en/prepared-statements.html#packet-ProtocolBinary::MYSQL_TYPE_TIMESTAMP
 binaryReader[8] = Packet.prototype.readInt64; // long long
 binaryReader[9] = Packet.prototype.readInt32; // int24

package/lib/packets/binlog_query_statusvars.js

@@ -31,7 +31,7 @@ module.exports = function parseStatusVars(buffer) {
         offset += 4;
         break;
       case keys.SQL_MODE:
-        // value is 8 bytes, but all dcumented flags are in first 4 bytes
+        // value is 8 bytes, but all documented flags are in first 4 bytes
         result.sqlMode = buffer.readUInt32LE(offset);
         offset += 8;
         break;

package/lib/packets/column_definition.js

@@ -19,7 +19,7 @@ const fields = ['catalog', 'schema', 'table', 'orgTable', 'name', 'orgName'];
 // see https://github.com/sidorares/node-mysql2/pull/137
 //
 class ColumnDefinition {
-  constructor(packet, clientEncoding) {
+  constructor(packet, clientEncoding, mariadbExtendedMetadata) {
     this._buf = packet.buffer;
     this._clientEncoding = clientEncoding;
     this._catalogLength = packet.readLengthCodedNumber();
@@ -41,6 +41,14 @@ class ColumnDefinition {
     this._orgNameLength = packet.readLengthCodedNumber();
     this._orgNameStart = packet.offset;
     packet.offset += this._orgNameLength;
+    // MariaDB-specific column types (UUID, INET4, INET6, VECTOR and the JSON
+    // alias) are sent as standard string/blob types on the wire; the real
+    // type is only visible here, in the extended metadata block negotiated
+    // via the MARIADB_CLIENT_EXTENDED_METADATA capability (parsed out of
+    // line and with prototype defaults to keep this hot constructor small)
+    if (mariadbExtendedMetadata) {
+      this._parseMariadbExtendedMetadata(packet);
+    }
     packet.skip(1); //  length of the following fields (always 0x0c)
     this.characterSet = packet.readInt16();
     this.encoding = CharsetToEncoding[this.characterSet];
@@ -57,6 +65,27 @@ class ColumnDefinition {
     this.decimals = packet.readInt8();
   }
 
+  _parseMariadbExtendedMetadata(packet) {
+    // length-encoded block of { int<1> id, string<lenenc> value } pairs
+    const extendedMetadataLength = packet.readLengthCodedNumber() || 0;
+    const extendedMetadataEnd = Math.min(
+      packet.offset + extendedMetadataLength,
+      packet.end
+    );
+    while (packet.offset < extendedMetadataEnd) {
+      const id = packet.readInt8();
+      const value = packet.readLengthCodedString('ascii');
+      if (id === 0) {
+        this.extendedTypeName = value; // e.g. 'uuid', 'inet4', 'inet6', 'point'
+      } else if (id === 1) {
+        this.extendedFormat = value; // e.g. 'json'
+      }
+    }
+    // a malformed entry could read past the block; resynchronise so the
+    // fixed column definition fields that follow parse from the right offset
+    packet.offset = extendedMetadataEnd;
+  }
+
   inspect() {
     return {
       catalog: this.catalog,
@@ -288,4 +317,9 @@ addString('table');
 addString('orgTable');
 addString('orgName');
 
+// MariaDB extended metadata defaults; instances only carry own values when
+// the server actually tagged the column
+ColumnDefinition.prototype.extendedTypeName = undefined;
+ColumnDefinition.prototype.extendedFormat = undefined;
+
 module.exports = ColumnDefinition;

package/lib/packets/encode_parameter.js

@@ -11,7 +11,7 @@ function isJSON(value) {
   );
 }
 
-function toParameter(value, encoding, timezone) {
+function toParameter(value, encoding, timezone, jsonAsString) {
   let type = Types.VAR_STRING;
   let length;
   let writer = function (value) {
@@ -46,8 +46,18 @@ function toParameter(value, encoding, timezone) {
           };
         } else if (isJSON(value)) {
           value = JSON.stringify(value);
-          type = Types.JSON;
+          // MariaDB rejects the JSON parameter type with "Incorrect
+          // arguments to mysqld_stmt_execute"; it expects JSON values
+          // as plain strings
+          if (!jsonAsString) {
+            type = Types.JSON;
+          }
         } else if (Buffer.isBuffer(value)) {
+          // send buffers as BLOB so servers treat the value as binary data
+          // rather than a string in the connection charset (MariaDB converts
+          // string parameters when storing into binary columns such as
+          // VECTOR, corrupting the value)
+          type = Types.BLOB;
           length = Packet.lengthCodedNumberLength(value.length) + value.length;
           writer = Packet.prototype.writeLengthCodedBuffer;
         }

package/lib/packets/execute.js

@@ -15,7 +15,8 @@ class Execute {
     charsetNumber,
     timezone,
     attributes,
-    clientFlags
+    clientFlags,
+    jsonAsString
   ) {
     this.id = id;
     this.parameters = parameters;
@@ -23,6 +24,7 @@ class Execute {
     this.timezone = timezone;
     this.attributes = attributes;
     this.clientFlags = clientFlags || 0;
+    this.jsonAsString = jsonAsString || false;
   }
 
   static fromPacket(packet, encoding) {
@@ -34,6 +36,7 @@ class Execute {
     while (i < packet.end - 1) {
       if (
         (packet.buffer[i + 1] === Types.VAR_STRING ||
+          packet.buffer[i + 1] === Types.BLOB ||
           packet.buffer[i + 1] === Types.NULL ||
           packet.buffer[i + 1] === Types.DOUBLE ||
           packet.buffer[i + 1] === Types.TINY ||
@@ -54,6 +57,7 @@ class Execute {
     for (let i = packet.offset + 1; i < packet.end - 1; i++) {
       if (
         (packet.buffer[i] === Types.VAR_STRING ||
+          packet.buffer[i] === Types.BLOB ||
           packet.buffer[i] === Types.NULL ||
           packet.buffer[i] === Types.DOUBLE ||
           packet.buffer[i] === Types.TINY ||
@@ -72,6 +76,8 @@ class Execute {
     for (let i = 0; i < types.length; i++) {
       if (types[i] === Types.VAR_STRING) {
         values.push(packet.readLengthCodedString(encoding));
+      } else if (types[i] === Types.BLOB) {
+        values.push(packet.readLengthCodedBuffer());
       } else if (types[i] === Types.DOUBLE) {
         values.push(packet.readDouble());
       } else if (types[i] === Types.TINY) {
@@ -119,7 +125,7 @@ class Execute {
       const bindParams =
         numParams > 0
           ? this.parameters.map((v) =>
-              toParameter(v, this.encoding, this.timezone)
+              toParameter(v, this.encoding, this.timezone, this.jsonAsString)
             )
           : [];
       const attrParams = attrNames.map((name) =>

package/lib/packets/handshake.js

@@ -16,6 +16,7 @@ class Handshake {
     this.characterSet = args.characterSet;
     this.statusFlags = args.statusFlags;
     this.authPluginName = args.authPluginName;
+    this.mariadbExtendedCapabilityFlags = args.mariadbExtendedCapabilityFlags;
   }
 
   setScrambleData(cb) {
@@ -79,9 +80,20 @@ class Handshake {
         args.authPluginDataLength = 0;
         packet.skip(1);
       }
-      packet.skip(10);
+      packet.skip(6);
+      if (args.capabilityFlags & ClientConstants.LONG_PASSWORD) {
+        // CLIENT_MYSQL (LONG_PASSWORD) set: a MySQL server, the remaining
+        // 4 reserved bytes are filler
+        packet.skip(4);
+        args.mariadbExtendedCapabilityFlags = 0;
+      } else {
+        // MariaDB servers (10.2+) leave CLIENT_MYSQL unset and use these
+        // 4 bytes to advertise MariaDB-specific capabilities
+        args.mariadbExtendedCapabilityFlags = packet.readInt32();
+      }
     } else {
       args.capabilityFlags = capabilityFlagsBuffer.readUInt16LE(0);
+      args.mariadbExtendedCapabilityFlags = 0;
     }
 
     const isSecureConnection =