@sap/cds-dk 10.0.3 → 10.0.5

package/node_modules/@cap-js/sqlite/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@cap-js/sqlite",
+  "version": "3.0.2",
+  "description": "CDS database service for SQLite",
+  "homepage": "https://github.com/cap-js/cds-dbs/tree/main/sqlite#cds-database-service-for-sqlite",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cap-js/cds-dbs.git"
+  },
+  "bugs": {
+    "url": "https://github.com/cap-js/cds-dbs/issues"
+  },
+  "keywords": [
+    "CAP",
+    "CDS",
+    "SQLite"
+  ],
+  "author": "SAP SE (https://www.sap.com)",
+  "main": "index.js",
+  "files": [
+    "cds-plugin.js",
+    "lib",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "test": "cds-test"
+  },
+  "dependencies": {
+    "@cap-js/db-service": "^3.0.1"
+  },
+  "peerDependencies": {
+    "@sap/cds": "^10",
+    "sql.js": "^1.13.0",
+    "better-sqlite3": "^12.0.0"
+  },
+  "peerDependenciesMeta": {
+    "sql.js": {
+      "optional": true
+    },
+    "better-sqlite3": {
+      "optional": true
+    }
+  },
+  "cds": {
+    "requires": {
+      "kinds": {
+        "sql": {
+          "[development]": {
+            "kind": "sqlite",
+            "credentials": {
+              "url": ":memory:"
+            }
+          }
+        },
+        "sqlite": {
+          "impl": "@cap-js/sqlite",
+          "pool": {
+            "evictionRunIntervalMillis": 0,
+            "min": 1,
+            "max": 1
+          }
+        }
+      },
+      "db": "sql"
+    }
+  },
+  "license": "Apache-2.0"
+}

package/node_modules/@sap/cds-compiler/CHANGELOG.md

@@ -15,6 +15,20 @@ might use a deprecated flag only for a limited period of time.
 
 
 
+## Version 7.0.2 - 2026-07-14
+
+### Bug Fixes
+
+- **compiler:**
+  + Avoid dump for a new association in a projection with backlink comparison while reporting a missing backlink target element.
+  + Soften incompatibility concerning backlink comparisons: missing target elements which are referred to in the foreign keys or ON-condition of the backlink
+    association now only lead to a warning.
+  + Soften incompatibility concerning structure values for annotations: a structure property like `list` won't be rejected; we avoid an ambiguity with an
+    _expression_ `(1, 2, 3)` by putting `'=': true` next to `list: …` in the CSN, like in compiler v6. A `xpr` expression is rendered without a sibling `=`,
+    though.
+
+
+
 ## Version 7.0.1 - 2026-06-18
 
 ### ⚠ BREAKING CHANGES

package/node_modules/@sap/cds-compiler/bin/cdsse.js

@@ -201,7 +201,7 @@ function offset( buf, alsoSuffix ) { // for line and column
       return false;
   }
   let cursor = pos + column - 1;
-  // eslint-disable-next-line sonarjs/slow-regex
+  // eslint-disable-next-line sonarjs/super-linear-regex
   const prefix = /[a-z_0-9$]*$/i.exec( buf.substring( pos, cursor ) ).index + pos;
   const col = column + prefix - cursor;
   if (alsoSuffix)

package/node_modules/@sap/cds-compiler/bin/cdsv2m.js

@@ -39,7 +39,7 @@ function ria() {
   // 'Choose via $(ANNO) one of $(SORTED_ARTS) as redirection target for $(TARGET) in … $(ART) otherwise'
   // NOTE: regex match on message text not for productive code!
   for (const msgObj of msgs) {
-    // eslint-disable-next-line sonarjs/slow-regex
+    // eslint-disable-next-line sonarjs/super-linear-regex
     const matches = msgObj.message.match( /["“][^"”]+["”]/ug );
     matches.slice( 1, -2 ).forEach( (name) => {
       annotates[name.slice( 1, -1 )] = true;

package/node_modules/@sap/cds-compiler/doc/IncompatibleChanges_v7.md

@@ -173,7 +173,7 @@ In cds-compiler v7, we make `name-deprecated-$self` a non-configurable error.
 Before cds-compiler v7:  
 The CSN representation of an expression-like annotation value is an object with
 properties `=` and one of `ref`, `xpr`, `val`, `func`, `SELECT`, `list`.
-In `=` we capture the (space-normalized, comments removed) string representation of the expression,
+In `=` we capture the (space-normalized, comments removed) string CDL representation of the expression,
 the other one holds the parsed expression as a token stream.
 
 When the annotation is propagated ...
@@ -222,25 +222,32 @@ Resulting CSN:
 ```
 
 In cds-compiler v7:  
-* For anno-xpr that are a simple ref (simple: can be path, but no filter, no parameters), keep current behavior:
-  - Keep both `=` and `ref`.
+* For anno-xpr that are a simple ref (simple: can be path, but no filter, no parameters)
+  in the compiler and runtime CSN:
+  - In `=`, render the `.`-concatenated `ref` items without CDL escaping
+    (like for unchecked references, but unlike compiler v6);
+    e.g. for a reference, written as `(![in])` in CDL, use `{ '=': 'in', ref: ['in'] }` in CSN.
   - When rewriting is necessary, also adapt the `=`.
+* For expression which are a simple enum symbols, with or without surrounding parentheses:
+  - Just render the `#`, omit the `=` property.
+* For expressions which are represented in CSN by a simple `xpr`:
+  - Do not render a `=` property anymore, just render the `xpr`.
 * For all other expressions:
-  - Remove the `=`
-    + both in original and in propagated annotations
-    + no matter whether rewriting is necessary or not
-
-With the removal of `=`, any object with a `ref` or `xpr` or `val` inside an array
-is regarded as an expression value. This could introduce ambiguities. Outside arrays
-there is no danger of ambiguity due to flattening.
-To avoid such ambiguities in CDL, the parser in v7 throws an error for "ambiguous" sources like
+  - Use `=` property with value `true`, do not use the CDL source as value,
+    both in original and in propagated annotations.
+
+With the removal of `=`, any object in a CSN with just a `xpr`
+is regarded as an expression value. With that, a structure inside an array
+with just a `xpr` property could not be represented without ambiguity.
+
+Therefore, the parser in v7 reports an error for such invalid structure values:
 ```cds
 @A_xpr: [(2*foo)]
 @A_str: [{xpr: [{val: 2}, '*', {ref: ['foo']}]}]
 entity E { foo : Integer; }
 ```
-For: ref, xpr, val, func, SELECT, list.
-
+The compiler also reports an error for structures inside arrays containing a `=` property and
+a primary expression property (`ref`, `xpr`, `list`, `val`, `#`, `func`, `SELECT` and `SET`).
 
 ### Default for structures
 

package/node_modules/@sap/cds-compiler/lib/base/builtins.js

@@ -107,7 +107,10 @@ const exprProperties = [
  * Return whether JSON object `val` is a representation for an annotation expression
  */
 function isAnnotationExpression( val ) {
-  return val && primaryExprProperties.some( prop => val[prop] !== undefined );
+  return val && (val['=']
+    ? primaryExprProperties.some( prop => val[prop] !== undefined )
+    : val.xpr !== undefined && Object.keys( val ).length === 1 || val['#'] !== undefined
+  );
 }
 
 module.exports = {

package/node_modules/@sap/cds-compiler/lib/base/message-registry.js

@@ -147,6 +147,8 @@ const centralMessages = {
   'ref-invalid-source': { severity: 'Error' },
   'ref-invalid-target': { severity: 'Error' },
   'ref-invalid-backlink': { severity: 'Error', configurableFor: 'before_v8' },
+  'ref-missing-backlink-element': { severity: 'Warning', errorFor: [ 'v8' ] },
+  'ref-deprecated-backlink': { severity: 'Warning', errorFor: [ 'v8' ] },
   'ref-missing-self-counterpart': { severity: 'Error', configurableFor: true },
   'ref-sloppy-target': { severity: 'Error', configurableFor: 'deprecated_before_v8' },
 
@@ -546,8 +548,10 @@ const centralMessageTexts = {
     colon: 'Use a $(NEWCODE), not a $(CODE) between the element names in a reference',
   },
   'syntax-invalid-anno-struct': {
-    std: 'Most CSN processors interpret a structure with property $(PROP) as expression',
-    ref: 'The value of property $(PROP) must be a non-empty string, which most CSN processors interpret as reference',
+    std: 'Objects with properties $(PROP) and $(SIBLINGPROP) are reserved for expressions and can\'t be used as structures',
+    xpr: 'Objects with $(PROP) as only property are reserved for expressions and can\'t be used as structures',
+    '#': 'Objects with a property $(PROP) are reserved for enum values and can\'t be used as structures',
+    ref: 'The value of property $(PROP) in structures must be a non-empty string',
   },
   // 'syntax-ignoring-doc-comment' (Info)
   'syntax-unexpected-reserved-word': '$(CODE) is a reserved word - write $(DELIMITED) instead if you want to use it as name',
@@ -917,6 +921,7 @@ const centralMessageTexts = {
   'rewrite-undefined-key': {
     std: 'Can\'t redirect association $(NAME), as redirection target $(TARGET) does not project element $(ID), which is required to match foreign key of $(NAME)',
     backlink: 'Can\'t project association, as the current entity does not project element $(ID), which is required to match foreign key of the backlink association',
+    // TODO: delete text variant 'backlink' again
   },
   'type-unexpected-typeof': {
     std: 'Unexpected $(KEYWORD) for the type reference here',
@@ -1180,6 +1185,14 @@ const centralMessageTexts = {
     include: 'The open backlink target $(TARGET) of the aspect is unrelated to the current entity',
     backlink: 'Can\'t use $(ART) as backlink association, because its ON-condition contains a backlink comparison',
   },
+  'ref-deprecated-backlink': {
+    std: 'The target $(TARGET) of the backlink association is just distantly related to the current entity; do not use a comparison with $(ID)',
+    inferred: 'The target $(TARGET) of the backlink association $(NAME) is just distantly related to the current entity; provide an ON-condition not using a comparison with $(ID)',
+  },
+  'ref-missing-backlink-element': {
+    std: 'Element $(ID) must also be projected when projecting this association containing a backlink comparison',
+    def: 'Element $(ID) must be projected when defining this association containing a backlink comparison',
+  },
   'extend-columns': {
     std: 'Artifact $(ART) can\'t be extended with columns, only simple views/projections without JOINs and UNIONs can',
     join: 'Artifact $(ART) can\'t be extended with columns, because it contains a JOIN',

package/node_modules/@sap/cds-compiler/lib/checks/defaultValues.js

@@ -23,7 +23,6 @@ function validateDefaultValues( member, memberName, prop, path ) {
       // TODO: This check only counts the number of leading signs, not inbetween (e.g. 1 - - 1).
       //       The message also needs to be improved.
       if (i > 1)
-        // eslint-disable-next-line cds-compiler/message-no-quotes
         this.error(null, path, {}, 'Illegal number of unary \'+\'/\'-\' operators');
     }
   }

package/node_modules/@sap/cds-compiler/lib/compiler/resolve.js

@@ -1229,7 +1229,8 @@ function resolve( model ) {
   function checkBacklinkPartner( assoc ) {
     checkBareDollarSelf( assoc );
     // console.log('CBP:',assoc.kind,assoc._main?.name?.id,assoc.name.id,!!assoc.$backlink)
-    const target = assoc.$backlink?._origin?.target?._artifact;
+    const origin = assoc.$backlink?._origin;
+    const target = origin?.target?._artifact;
     if (!target)
       return;
     const main = assoc._main;
@@ -1254,10 +1255,10 @@ function resolve( model ) {
       // TODO: we should do the "simple projection ancestor" probably only if no
       // include is involved in the redirection chain
       if (redirectionChain( null, main, ancestor, true )) {
-        warning( 'ref-dubious-backlink', [ assoc.$backlink.location, assoc ],
-                 { target },
-                 // eslint-disable-next-line @stylistic/max-len
-                 'The target $(TARGET) of the backlink association has just a distant relationship to the current entity' );
+        const msg = (assoc.on.$inferred ? 'inferred' : 'std');
+        message( 'ref-deprecated-backlink', [ assoc.$backlink.location, assoc ],
+                 // eslint-disable-next-line @stylistic/object-curly-newline
+                 { '#': msg, target, id: '$self', name: origin.name.id } );
         return;
       }
     }

package/node_modules/@sap/cds-compiler/lib/compiler/tweak-assocs.js

@@ -450,13 +450,24 @@ function tweakAssocs( model ) {
           if (projectedKey.index > 0)
             targetElement.path.splice(0, projectedKey.index);
         }
+        else if (elem._outer?.$backlink === elem) {
+          const undef = targetElement.path[0];
+          setArtifactLink( undef, null );
+          setArtifactLink( targetElement, null );
+          const outer = elem._outer;
+          message( 'ref-missing-backlink-element',
+                   [ (outer.value || outer.name).location, outer ],
+                   { '#': (outer.value ? 'std' : 'def'), id: undef.id } );
+        // TODO: more info if element was already missing in "intermediate" projection
+        // TODO: collect all missing elements?
+        }
         else {
           setArtifactLink( targetElement.path[0], null );
           setArtifactLink( targetElement, null );
 
           const culprit = !elem.target.$inferred && elem.target ||
-          elem.value?.path?.[elem.value.path.length - 1] ||
-          elem;
+            elem.value?.path?.[elem.value.path.length - 1] ||
+            elem;
           // TODO: probably better to collect the non-projected foreign keys
           // and have one message for all
           error( 'rewrite-undefined-key', [ weakLocation( culprit.location ), elem ], {
@@ -825,8 +836,16 @@ function tweakAssocs( model ) {
       if (!item)
         return;     // just $self
       // console.log('REB:',assoc.name?.id,expr.path.map(i=>i.id))
-      if (item.id === assoc.name.id)
-        rewritePath( expr, item, assoc, assoc, null );
+      if (item.id === assoc.name.id &&
+          rewritePath( expr, item, assoc, assoc, null )) {
+        const undef = expr.path.find( i => !i._artifact );
+        const outer = assoc._outer;
+        message( 'ref-missing-backlink-element',
+                 [ (outer.value || outer.name).location, outer ],
+                 { '#': (outer.value ? 'std' : 'def'), id: undef.id } );
+        // TODO: more info if element was already missing in "intermediate" projection
+        // TODO: collect all missing elements?
+      }
     }
     else if (assoc._main.query) { // from ON cond of mixin element in query
       // here also $calc
@@ -877,7 +896,7 @@ function tweakAssocs( model ) {
           element: 'This element is not originally referred to in the ON-condition of association $(MEMBER) of $(ART)',
         } );
       }
-      rewritePath( expr, item, assoc, elem, null );
+      rewritePath( expr, item, assoc, elem, null ); // TODO: really no error?
     }
   }
 
@@ -1044,6 +1063,8 @@ function tweakAssocs( model ) {
    * Rewrite the reference `ref` with first elem/mixin ref item `item` for user
    * `assoc` (the query element).  `elem` is usually the first (or preferred)
    * query element for item.
+   *
+   * If `location` is falsy, do not issue an error.
    */
   function rewritePath( ref, item, assoc, elem, location ) {
     const { path } = ref;
@@ -1092,7 +1113,7 @@ function tweakAssocs( model ) {
         if (state && state !== true)
           continue;
         if (!state && !location)
-          return true;
+          return true;          // no rewrite possible
         break;
       }
     }

package/node_modules/@sap/cds-compiler/lib/edm/annotations/edmJson.js

@@ -978,6 +978,11 @@ function xpr2edmJson( carrier, anno, location, options, messageFunctions, generi
       return xpr;
     }
 
+    // "'=': true" has no meaning as an OData operator here and must be removed
+    // before transform runs, otherwise transform['='] misinterprets it as $Eq.
+    if (xpr['='] === true)
+      delete xpr['='];
+
     if (xpr.list)
       xpr.list.forEach( preTransformExpression );
 

package/node_modules/@sap/cds-compiler/lib/json/from-csn.js

@@ -117,7 +117,7 @@
 
 const { dictAdd } = require('../compiler/dictionaries');
 const { quotedLiteralPatterns } = require('../compiler/builtins');
-const { exprProperties, primaryExprProperties } = require('../base/builtins');
+const { exprProperties, isAnnotationExpression } = require('../base/builtins');
 const { CompilerAssertion } = require('../base/error');
 const { Location } = require('../base/location');
 const { XsnSource } = require('../compiler/xsn-model');
@@ -1490,10 +1490,10 @@ function annoValue( val, spec ) {
     }
     return retval;
   }
-  else if (primaryExprProperties.some( prop => val[prop] !== undefined )) {
+  else if (isAnnotationExpression( val )) {
     const s = schema['@'].schema['-expr'];
     const r = object( val, s );
-    r.$tokenTexts = true;       // property `=` might not be present
+    r.$tokenTexts = true;
     return r;
   }
   else if (val['...'] !== undefined && Object.keys( val ).length === 1) {

package/node_modules/@sap/cds-compiler/lib/json/to-csn.js

@@ -1149,10 +1149,11 @@ function annoValue( node ) {
   if (!node.$tokenTexts)
     return value( node );
   const csn = expression( node ); // expressions in annotation values
-  return (!csn?.ref || gensrcFlavor || universalCsn ||
-          csn.cast || csn.param || csn.ref.some( id => typeof id !== 'string' ))
-    ? csn
-    : Object.assign({ '=': csn.ref.join( '.' ) }, csn );
+  if (!csn || csn['#'] || csn.xpr && Object.keys( csn ).length === 1)
+    return csn;                 // '#' and 'xpr' without sibling '='
+  const asTrue = !csn?.ref || gensrcFlavor || universalCsn ||
+    csn.cast || csn.param || csn.ref.some( id => typeof id !== 'string' );
+  return Object.assign({ '=': !!asTrue || csn.ref.join( '.' ) }, csn );
 }
 
 function value( node ) {

package/node_modules/@sap/cds-compiler/lib/parsers/AstBuildingParser.js

@@ -1190,15 +1190,26 @@ class AstBuildingParser extends BaseParser {
   }
 
   checkStructProps( dict ) {
+    // see also isAnnotationExpression()
+    if (!dict['=']) {
+      const prop = dict['#'] && '#' ||
+        dict.xpr && Object.keys( dict ).length === 1 && 'xpr';
+      if (!prop)
+        return;
+      this.error( 'syntax-invalid-anno-struct', dict[prop].name.location,
+                  { '#': prop, prop } );
+      return;
+    }
     const prop = primaryExprProperties.find( p => dict[p] !== undefined );
     if (prop) {
       this.error( 'syntax-invalid-anno-struct', dict[prop].name.location,
-                  { '#': 'std', prop } );
+                  { '#': 'std', prop, siblingprop: '=' } );
     }
-    else if (dict['='] && (dict['='].literal !== 'string' || !dict['='].val)) {
+    else if (dict['='].literal !== 'string' || !dict['='].val) {
       this.error( 'syntax-invalid-anno-struct', dict['='].location,
                   { '#': 'ref', prop: '=' } );
     }
+    // TODO: also check '...' ?
   }
 
   // TODO: remove the check from the parser; move it to shared.js
@@ -1635,7 +1646,7 @@ function addOneForDefinition( count, ext ) {
 
 // Significant digits (before exponent) without leading and trailing zeros
 function relevantDigits( val ) {
-  // eslint-disable-next-line sonarjs/slow-regex
+  // eslint-disable-next-line sonarjs/super-linear-regex
   val = val.replace( /e.+$/i, '' ); // this regex has no newlines -> is not slow
 
   const init = /^[-+0.]+/g;     // global flag to have lastIndex

package/node_modules/@sap/cds-compiler/lib/tool-lib/enrichCsn.js

@@ -143,7 +143,7 @@ function enrichCsn( csn, options = {} ) {
     }
     else {
       const record = !isAnnotationExpression( obj ) && assignment;
-      // is record without primary expression property
+      // is record without primary expression property and usually '='
       for (const name of Object.getOwnPropertyNames( obj ) ) {
         const trans = record || transformers[name] || transformers[name.charAt(0)] || standard;
         trans( obj, name, obj[name] );

package/node_modules/@sap/cds-compiler/lib/transform/db/cdsPersistence.js

@@ -51,11 +51,12 @@ function getAssocToSkippedIgnorer( csn, options, messageFunctions, csnUtils ) {
    *
    * @param {CSN.Artifact} artifact
    * @param {string} artifactName
+   * @param {string} _prop
+   * @param {CSN.Path} _path
    */
   function ignoreAssociationToSkippedTarget( artifact, artifactName, _prop, _path ) {
-    if (isPersistedOnDatabase(artifact)) {
+    if (isPersistedOnDatabase(artifact))
       forEachMemberRecursively(artifact, ignore, [ 'definitions', artifactName ]);
-    }
   }
 
   /**

package/node_modules/@sap/cds-compiler/lib/transform/db/views.js

@@ -130,6 +130,7 @@ function getViewTransformer( csn, options, _messageFunctions ) {
    * @param {CSN.Element} elem
    * @param {string} elemName
    * @param {CSN.Path} elementsPath Path pointing to elements
+   * @param {CSN.Path} _queryPath
    */
   function handleAssociationElement( query, elements, columnMap, publishedMixins, elem, elemName, elementsPath, _queryPath ) {
     const isNotMixinByItself = checkIsNotMixinByItself(query, columnMap, elemName);
@@ -391,9 +392,8 @@ function getColumnMap( query, csnUtils ) {
 function ensureColumnNames( query, csnUtils, _options ) {
   const select = query.SELECT || query.projection;
   for (const col of select?.columns || []) {
-    if (col !== '*' && !columnAlias(col)) {
+    if (col !== '*' && !columnAlias(col))
       setProp(col, 'as', csnUtils.getColumnName(col));
-    }
   }
 }
 

package/node_modules/@sap/cds-compiler/lib/transform/transformUtils.js

@@ -218,9 +218,8 @@ function getTransformers(model, options, msgFunctions, pathDelimiter = '_') {
       if (flattenedNames.length === 1) {
         // Single element: propagate default if leaf doesn't have one
         const singleElem = result[flattenedNames[0]];
-        if (singleElem.default?.val === undefined) {
+        if (singleElem.default?.val === undefined)
           singleElem.default = elem.default; // Copy entire default object {val, location}
-        }
       }
       else if (flattenedNames.length > 1) {
         // Multi-element structure: warn that default is ignored

package/node_modules/@sap/cds-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "7.0.1",
+  "version": "7.0.2",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",

package/node_modules/iconv-lite/encodings/sbcs-data.js

@@ -109,6 +109,8 @@ module.exports = {
 
   hebrew: "iso88598",
   hebrew8: "iso88598",
+  iso88598i: "iso88598",
+  iso88598e: "iso88598",
 
   turkish: "iso88599",
   turkish8: "iso88599",

package/node_modules/iconv-lite/encodings/utf32.js

@@ -31,7 +31,9 @@ function Utf32Encoder (options, codec) {
 
 Utf32Encoder.prototype.write = function (str) {
   var src = Buffer.from(str, "ucs2")
-  var dst = Buffer.alloc(src.length * 2)
+  // src.length * 2 covers this chunk's code units (4 bytes each); the extra 4 bytes leave room for a
+  // high surrogate held over from a previous chunk, which is flushed ahead of this chunk's units.
+  var dst = Buffer.alloc(src.length * 2 + 4)
   var write32 = this.isLE ? dst.writeUInt32LE : dst.writeUInt32BE
   var offset = 0
 
@@ -113,9 +115,9 @@ Utf32Decoder.prototype.write = function (src) {
       // NOTE: codepoint is a signed int32 and can be negative.
       // NOTE: We copied this block from below to help V8 optimize it (it works with array, not buffer).
       if (isLE) {
-        codepoint = overflow[i] | (overflow[i + 1] << 8) | (overflow[i + 2] << 16) | (overflow[i + 3] << 24)
+        codepoint = overflow[0] | (overflow[1] << 8) | (overflow[2] << 16) | (overflow[3] << 24)
       } else {
-        codepoint = overflow[i + 3] | (overflow[i + 2] << 8) | (overflow[i + 1] << 16) | (overflow[i] << 24)
+        codepoint = overflow[3] | (overflow[2] << 8) | (overflow[1] << 16) | (overflow[0] << 24)
       }
       overflow.length = 0
 
@@ -169,7 +171,12 @@ function _writeCodepoint (dst, offset, codepoint, badChar) {
 };
 
 Utf32Decoder.prototype.end = function () {
+  if (this.overflow.length === 0) { return }
+
+  // A leftover, incomplete 4-byte code unit at the end of the input is ill-formed. Substitute a
+  // single U+FFFD (Unicode Standard conformance clause C10) instead of silently dropping the bytes.
   this.overflow.length = 0
+  return String.fromCharCode(this.badChar)
 }
 
 // == UTF-32 Auto codec =============================================================

package/node_modules/iconv-lite/package.json

@@ -1,7 +1,7 @@
 {
   "name": "iconv-lite",
   "description": "Convert character encodings in pure javascript.",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "license": "MIT",
   "keywords": [
     "iconv",
@@ -46,7 +46,7 @@
     "stream": false
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "^0.17.4",
+    "@arethetypeswrong/cli": "^0.18.4",
     "@stylistic/eslint-plugin": "^5.1.0",
     "@stylistic/eslint-plugin-js": "^4.1.0",
     "@types/node": "^24.0.12",

package/node_modules/iconv-lite/types/encodings.d.ts

@@ -276,6 +276,8 @@ export type Encoding =
   | "iso88596"
   | "iso88597"
   | "iso88598"
+  | "iso88598e"
+  | "iso88598i"
   | "iso88599"
   | "isoceltic"
   | "isoir100"

package/node_modules/ws/lib/receiver.js

@@ -77,6 +77,7 @@ class Receiver extends Writable {
 
     this._totalPayloadLength = 0;
     this._messageLength = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     this._errored = false;
@@ -500,6 +501,19 @@ class Receiver extends Writable {
       return;
     }
 
+    if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+      const error = this.createError(
+        RangeError,
+        'Too many message fragments',
+        false,
+        1008,
+        'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+      );
+
+      cb(error);
+      return;
+    }
+
     if (this._compressed) {
       this._state = INFLATING;
       this.decompress(data, cb);
@@ -507,22 +521,6 @@ class Receiver extends Writable {
     }
 
     if (data.length) {
-      if (
-        this._maxFragments > 0 &&
-        this._fragments.length >= this._maxFragments
-      ) {
-        const error = this.createError(
-          RangeError,
-          'Too many message fragments',
-          false,
-          1008,
-          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-        );
-
-        cb(error);
-        return;
-      }
-
       //
       // This message is not compressed so its length is the sum of the payload
       // length of all fragments.
@@ -562,22 +560,6 @@ class Receiver extends Writable {
           return;
         }
 
-        if (
-          this._maxFragments > 0 &&
-          this._fragments.length >= this._maxFragments
-        ) {
-          const error = this.createError(
-            RangeError,
-            'Too many message fragments',
-            false,
-            1008,
-            'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-          );
-
-          cb(error);
-          return;
-        }
-
         this._fragments.push(buf);
       }
 
@@ -604,6 +586,7 @@ class Receiver extends Writable {
     this._totalPayloadLength = 0;
     this._messageLength = 0;
     this._fragmented = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     if (this._opcode === 2) {