@sap/cds-dk 10.1.1 → 10.2.0

package/node_modules/handlebars/lib/handlebars/helpers/each.js

@@ -7,6 +7,26 @@ import {
 } from '../utils';
 import Exception from '../exception';
 
+/**
+ * Close an unfinished iterator after the block body threw, like for...of does,
+ * so that generators can run their cleanup code.
+ *
+ * Errors thrown while closing, including by a `return` getter, are ignored:
+ * the block's error is the cause and is the one the caller must see.
+ *
+ * @param {Iterator} iterator the iterator that was being consumed
+ */
+function closeIterator(iterator) {
+  try {
+    let close = iterator.return;
+    if (isFunction(close)) {
+      close.call(iterator);
+    }
+  } catch (closeError) {
+    // NOP
+  }
+}
+
 export default function(instance) {
   instance.registerHelper('each', function(context, options) {
     if (!options) {
@@ -33,7 +53,7 @@ export default function(instance) {
       data = createFrame(options.data);
     }
 
-    function execIteration(field, index, last) {
+    function execIteration(field, index, last, value) {
       if (data) {
         data.key = field;
         data.index = index;
@@ -47,12 +67,9 @@ export default function(instance) {
 
       ret =
         ret +
-        fn(context[field], {
+        fn(value, {
           data: data,
-          blockParams: blockParams(
-            [context[field], field],
-            [contextPath + field, null]
-          )
+          blockParams: blockParams([value, field], [contextPath + field, null])
         });
     }
 
@@ -60,18 +77,24 @@ export default function(instance) {
       if (isArray(context)) {
         for (let j = context.length; i < j; i++) {
           if (i in context) {
-            execIteration(i, i, i === context.length - 1);
+            execIteration(i, i, i === context.length - 1, context[i]);
           }
         }
       } else if (typeof Symbol === 'function' && context[Symbol.iterator]) {
-        const newContext = [];
         const iterator = context[Symbol.iterator]();
-        for (let it = iterator.next(); !it.done; it = iterator.next()) {
-          newContext.push(it.value);
-        }
-        context = newContext;
-        for (let j = context.length; i < j; i++) {
-          execIteration(i, i, i === context.length - 1);
+        let current = iterator.next();
+        while (!current.done) {
+          let next = iterator.next();
+          try {
+            execIteration(i, i, next.done, current.value);
+          } catch (e) {
+            if (!next.done) {
+              closeIterator(iterator);
+            }
+            throw e;
+          }
+          current = next;
+          i++;
         }
       } else {
         let priorKey;
@@ -81,13 +104,13 @@ export default function(instance) {
           // the last iteration without have to scan the object twice and create
           // an itermediate keys array.
           if (priorKey !== undefined) {
-            execIteration(priorKey, i - 1);
+            execIteration(priorKey, i - 1, false, context[priorKey]);
           }
           priorKey = key;
           i++;
         });
         if (priorKey !== undefined) {
-          execIteration(priorKey, i - 1, true);
+          execIteration(priorKey, i - 1, true, context[priorKey]);
         }
       }
     }

package/node_modules/handlebars/lib/handlebars/internal/proto-access.js

@@ -39,6 +39,28 @@ export function resultIsAllowed(result, protoAccessControl, propertyName) {
   }
 }
 
+/**
+ * Detect a prototype object's own "constructor" back-reference, e.g.
+ * `Function.prototype.constructor === Function`. Because "constructor" is an
+ * "own" property of such objects, it would otherwise bypass the prototype-access
+ * checks and expose dangerous constructors (allowing arbitrary code execution).
+ *
+ * Only functions can be constructors, so other values are never treated as one
+ * and their `prototype` is never read.
+ *
+ * @param {*} parent the object the property is being read from
+ * @param {string} propertyName the property being looked up
+ * @param {*} result the already-resolved value of `parent[propertyName]`
+ * @returns {boolean} true if the lookup resolves `parent`'s own constructor
+ */
+export function isPrototypeConstructor(parent, propertyName, result) {
+  return (
+    propertyName === 'constructor' &&
+    typeof result === 'function' &&
+    parent === result.prototype
+  );
+}
+
 function checkWhiteList(protoAccessControlForType, propertyName) {
   if (protoAccessControlForType.whitelist[propertyName] !== undefined) {
     return protoAccessControlForType.whitelist[propertyName] === true;

package/node_modules/handlebars/lib/handlebars/runtime.js

@@ -10,7 +10,8 @@ import { moveHelperToHooks } from './helpers';
 import { wrapHelper } from './internal/wrapHelper';
 import {
   createProtoAccessControl,
-  resultIsAllowed
+  resultIsAllowed,
+  isPrototypeConstructor
 } from './internal/proto-access';
 
 export function checkRevision(compilerInfo) {
@@ -79,7 +80,27 @@ export function template(templateSpec, env) {
 
     let result = env.VM.invokePartial.call(this, partial, context, options);
 
+    // An empty result normally means the partial is template source that still
+    // has to be compiled. A function partial has already been invoked, so an
+    // empty result from it is a bug in that partial.
+    if (result == null && Utils.isFunction(partial)) {
+      throw new Exception(
+        'The partial ' +
+          options.name +
+          ' returned no output: partials must return a string'
+      );
+    }
+
     if (result == null && env.compile) {
+      // Only template source registered as a partial may be compiled here.
+      // Anything else (e.g. an AST-shaped object) must not become code.
+      if (typeof partial !== 'string') {
+        throw new Exception(
+          'The partial ' +
+            options.name +
+            ' could not be compiled: partials must be strings or functions returning strings'
+        );
+      }
       options.partials[options.name] = env.compile(
         partial,
         templateSpec.compilerOptions,
@@ -124,7 +145,15 @@ export function template(templateSpec, env) {
       if (result == null) {
         return result;
       }
-      if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
+      // Own properties are trusted context data and returned as-is, except for
+      // a prototype's own "constructor" back-reference (e.g.
+      // Function.prototype.constructor === Function): that must still pass the
+      // prototype-access deny list, otherwise the Function constructor becomes
+      // reachable and arbitrary code can be executed.
+      if (
+        Object.prototype.hasOwnProperty.call(parent, propertyName) &&
+        !isPrototypeConstructor(parent, propertyName, result)
+      ) {
         return result;
       }
 
@@ -353,8 +382,11 @@ export function resolvePartial(partial, context, options) {
     } else {
       partial = lookupOwnProperty(options.partials, options.name);
     }
-  } else if (!partial.call && !options.name) {
-    // This is a dynamic partial that returned a string
+  } else if (typeof partial !== 'function' && !options.name) {
+    // This is a dynamic partial that returned a name rather than a compiled
+    // partial. Only functions are accepted as partials here; any other value
+    // (including an object with a "call" property) is treated as a name, so
+    // that context data can never be compiled as a template.
     options.name = partial;
     partial = lookupOwnProperty(options.partials, partial);
   }

package/node_modules/handlebars/lib/handlebars/utils.js

@@ -69,8 +69,9 @@ export function indexOf(array, value) {
 
 export function escapeExpression(string) {
   if (typeof string !== 'string') {
-    // don't escape SafeStrings, since they're already safe
-    if (string && string.toHTML) {
+    // don't escape SafeStrings, since they're already safe. Other values with a
+    // "toHTML" key, e.g. from JSON context data, are escaped like any object.
+    if (string && typeof string.toHTML === 'function') {
       return string.toHTML();
     } else if (string == null) {
       return '';

package/node_modules/handlebars/lib/precompiler.js

@@ -3,6 +3,7 @@
 import Async from 'neo-async';
 import fs from 'fs';
 import * as Handlebars from './handlebars';
+import { safeJsonLiteral } from './handlebars/compiler/code-gen';
 import { basename } from 'path';
 import { SourceMapConsumer, SourceNode } from 'source-map';
 
@@ -320,10 +321,12 @@ function arrayCast(value) {
 /*
  * Safely quotes a value for embedding in generated JavaScript strings
  *
- * Uses JSON.stringify which handles all special characters.
+ * Uses JSON.stringify which handles all special characters, and also escapes
+ * line separators and the sequences that could end or change the parsing of an
+ * enclosing <script> element.
  */
 function quoteForJavaScript(value) {
-  return JSON.stringify(String(value));
+  return safeJsonLiteral(String(value));
 }
 
 /**
@@ -338,10 +341,14 @@ function isValidNamespace(namespace) {
 
 /**
  * Strips line terminators from source map URLs to prevent injection of new
- * JavaScript lines via the sourceMappingURL comment
+ * JavaScript lines via the sourceMappingURL comment, and percent-encodes "<"
+ * so that the comment cannot end or change the parsing of an enclosing
+ * <script> element.
  */
 function sanitizeSourceMapComment(value) {
-  return String(value).replace(/[\r\n\u2028\u2029]/g, '');
+  return String(value)
+    .replace(/[\r\n\u2028\u2029]/g, '')
+    .replace(/</g, '%3C');
 }
 
 /**
@@ -372,7 +379,9 @@ function minify(output, sourceMapFile) {
   return require('uglify-js').minify(output.code, {
     sourceMap: {
       content: output.map,
-      url: sourceMapFile
+      // uglify writes its own sourceMappingURL comment, so the URL has to be
+      // sanitized here as well.
+      url: sourceMapFile && sanitizeSourceMapComment(sourceMapFile)
     }
   });
 }

package/node_modules/handlebars/package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.7.9",
+  "version": "4.7.10",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "https://handlebarsjs.com/",
   "keywords": [
@@ -21,7 +21,7 @@
     "node": ">=0.4.7"
   },
   "dependencies": {
-    "minimist": "^1.2.5",
+    "minimist": "^1.2.8",
     "neo-async": "^2.6.2",
     "source-map": "^0.6.1",
     "wordwrap": "^1.0.0"

package/node_modules/handlebars/release-notes.md

@@ -2,7 +2,26 @@
 
 ## Development
 
-[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...master)
+[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.10...master)
+
+## v4.7.10 - October 5th, 2026
+- security: Sanitize the source map URL when minifying - f37c599
+- security: Iterate lazily in #each and strip whitespace in linear time - 812c226
+- security: Escape `<!--` and `<script` in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
+- security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
+- security: Only compile partials that are template strings - c28ee7a
+- security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
+- security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
+- Clarify that --root does not restrict filesystem access - 0fcf25c
+- Bump minimist to ^1.2.8 - ea8ed82
+- Fix Ruby component publishing documentation - d069c1c
+- Fix Composer component definition - 6714e07
+
+Compatibility notes:
+- `{{#each}}` iterates iterables such as `Map`, `Set` and generators lazily, like `for...of`, instead of
+  copying them into an array first. Values added to the iterable while the block renders are now visited too.
+
+[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10)
 
 ## v4.7.9 - March 26th, 2026
 - fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

package/node_modules/handlebars/types/index.d.ts

@@ -73,7 +73,15 @@ declare namespace Handlebars {
   export function log(level: number, obj: any): void;
   export function parse(input: string, options?: ParseOptions): hbs.AST.Program;
   export function parseWithoutProcessing(input: string, options?: ParseOptions): hbs.AST.Program;
+  /**
+   * @param input A template source string, or an AST built by your application.
+   *   An AST is compiled to JavaScript, so never pass one from untrusted input.
+   */
   export function compile<T = any>(input: any, options?: CompileOptions): HandlebarsTemplateDelegate<T>;
+  /**
+   * @param input A template source string, or an AST built by your application.
+   *   An AST is compiled to JavaScript, so never pass one from untrusted input.
+   */
   export function precompile(input: any, options?: PrecompileOptions): TemplateSpecification;
   export function template<T = any>(precompilation: TemplateSpecification): HandlebarsTemplateDelegate<T>;
 

package/node_modules/hdb/cfg/VERSION

@@ -1 +1 @@
-2.29.6
+2.30.1

package/node_modules/hdb/lib/Client.js

@@ -247,7 +247,7 @@ Client.prototype.execute = function execute(command, options, cb) {
 };
 
 Client.prototype.setClientInfo = function setClientInfo(key, val) {
-  if(key == null || val == null || String(key).length == 0 || String(val).length == 0) {
+  if (key == null || String(key).length === 0) {
     var err = new Error('Invalid arguments for Client.setClientInfo()');
     if (this.listeners('error').length) {
       this.emit('error', err);
@@ -255,10 +255,14 @@ Client.prototype.setClientInfo = function setClientInfo(key, val) {
       throw(err);
     }
   } else {
-    this._connection._setClientInfo(String(key), String(val));
+    this._connection._setClientInfo(String(key), val);
   }
 };
 
+Client.prototype.isValid = function isValid(options, cb) {
+  this._connection.isValid(options, cb);
+};
+
 Client.prototype._execute = function _execute(command, options, cb) {
   var result = this._createResult(this._connection, options);
   this._connection.executeDirect({

package/node_modules/hdb/lib/protocol/ClientInfo.js

@@ -34,6 +34,14 @@ ClientInfo.prototype.setProperty = function setProperty(key, value) {
   this._properties[key] = value;
 };
 
+ClientInfo.prototype.removeProperty = function removeProperty(key) {
+  if (!(key in this._properties)) {
+    return;
+  }
+  this._updatedProperties[key] = true;
+  delete this._properties[key];
+};
+
 ClientInfo.prototype.getProperty = function getProperty(key) {
   return this._properties[key];
 };
@@ -66,25 +74,30 @@ ClientInfo.prototype.shouldSend = function shouldSend(messageType) {
   }
 };
 
-ClientInfo.prototype.getUpdatedProperties = function getUpdatedProperties() {
-  var self = this;
-  var res = Object.keys(this._updatedProperties).reduce(function (p, c) {
-    p.push(c, self._properties[c]);
-    return p;
-  }, []);
+ClientInfo.prototype._buildUpdatedFields = function _buildUpdatedFields(nullValueSupported) {
+  const self = this;
+  const nullEntries = [];
+  const nonNullEntries = [];
+  Object.keys(this._updatedProperties).forEach(function (c) {
+    if (!(c in self._properties)) {
+      nullEntries.push(c, nullValueSupported ? null : '');
+    } else {
+      nonNullEntries.push(c, self._properties[c]);
+    }
+  });
+  return nullEntries.concat(nonNullEntries);
+};
+
+ClientInfo.prototype.getUpdatedProperties = function getUpdatedProperties(nullValueSupported) {
+  const fields = this._buildUpdatedFields(nullValueSupported);
   this._updatedProperties = {};
-  return res;
+  return fields;
 };
 
-ClientInfo.prototype.getUpdatedPropertiesSize = function getUpdatedPropertiesSize(useCesu8) {
-  const hasUpdatedProperties = Object.keys(this._updatedProperties).length > 0;
-  if (!hasUpdatedProperties) {
+ClientInfo.prototype.getUpdatedPropertiesSize = function getUpdatedPropertiesSize(useCesu8, nullValueSupported) {
+  if (Object.keys(this._updatedProperties).length === 0) {
     return 0;
   }
-  const self = this;
-  const fields = Object.keys(this._updatedProperties).reduce(function (p, c) {
-    p.push(c, self._properties[c]);
-    return p;
-  }, []);
+  const fields = this._buildUpdatedFields(nullValueSupported);
   return common.PART_HEADER_LENGTH + util.alignLength(TextList.getByteLength(fields, useCesu8), 8);
 };

package/node_modules/hdb/lib/protocol/Connection.js

@@ -285,7 +285,7 @@ Connection.prototype.send = function send(message, receive) {
     message.unshift(PartKind.STATEMENT_CONTEXT, this._statementContext.getOptions());
   }
   if (this._clientInfo.shouldSend(message.type)) {
-    message.add(PartKind.CLIENT_INFO, this._clientInfo.getUpdatedProperties());
+    message.add(PartKind.CLIENT_INFO, this._clientInfo.getUpdatedProperties(this.connectOptions.clientInfoNullValueSupported));
   }
 
   debug('send', message);
@@ -331,7 +331,7 @@ Connection.prototype.getAvailableSize = function getAvailableSize(forLobs = fals
   if (this._statementContext) {
     availableSize -= this._statementContext.size;
   }
-  availableSize -= this._clientInfo.getUpdatedPropertiesSize(this.useCesu8);
+  availableSize -= this._clientInfo.getUpdatedPropertiesSize(this.useCesu8, this.connectOptions.clientInfoNullValueSupported);
   return availableSize;
 };
 
@@ -494,6 +494,10 @@ Connection.prototype.connect = function connect(options, cb) {
     {name : common.ClientContextOption.CLIENT_APPLICATION_PROGRAM,
      value : this._clientInfo.getApplication()}
   ]);
+  this.connectOptions.setOptions([
+    {name : common.ConnectOption.FLAG_SET1,
+     value : common.ConnectOptionFlagSet1.SUPPORT_CLIENT_PING}
+  ]);
 
   const compressionFlags = compressor.determineCompressionFlags(options['compress']);
   if(compressionFlags) {
@@ -697,7 +701,30 @@ Connection.prototype.setRedirectType = function setRedirectType(type) {
 };
 
 Connection.prototype._setClientInfo = function _setClientInfo(key, val) {
-  this._clientInfo.setProperty(key, val);
+  if (val == null) {
+    this._clientInfo.removeProperty(key);
+  } else {
+    this._clientInfo.setProperty(key, String(val));
+  }
+};
+
+Connection.prototype.isValid = function isValid(options, cb) {
+  if (!this._queue ||
+      this.readyState !== 'connected') {
+    return cb(false);
+  }
+  if (this.connectOptions && ((this.connectOptions["flagSet1"] & common.ConnectOptionFlagSet1.SUPPORT_CLIENT_PING) != 0)) {
+      this.enqueue(request.isValid(options), function (err, reply) {
+        return cb(err ? false : true);
+      });
+  } else {
+      options = util.extend({
+        command: "SELECT 1 FROM DUMMY WHERE 1=0"
+      }, options);
+      this.executeDirect(options, function (err, reply) {
+        return cb(err ? false : true);
+      });
+  }
 };
 
 function ConnectionState() {

package/node_modules/hdb/lib/protocol/Writer.js

@@ -194,7 +194,7 @@ Writer.prototype.finializeParameters = function finializeParameters(
     // store lob length in header
     var length = header.readInt32LE(2);
     // readable events might not emit for every chunk so we handle all
-    // avaliable chunks immediately
+    // available chunks immediately
     while (chunk !== null) {
       if (chunk.length > bytesRemainingForLOBs) {
         cleanup();
@@ -334,7 +334,7 @@ Writer.prototype.finalizeWriteLobRequest = function finalizeWriteLobRequest(
     // store lob length in header
     var length = header.readInt32LE(17);
     // readable events might not emit for every chunk so we handle all
-    // avaliable chunks immediately
+    // available chunks immediately
     while (chunk !== null) {
       if (chunk.length > bytesRemaining) {
         cleanup();

package/node_modules/hdb/lib/protocol/common/ConnectOption.js

@@ -30,9 +30,11 @@ module.exports = {
   ROW_SLOT_IMAGE_PARAMETER: 20,
   IGNORE_UNKNOWN_PARTS: 21,
   DATA_FORMAT_VERSION2: 23,
+  CLIENT_INFO_NULL_VALUE_SUPPORTED: 28,
   OS_USER: 32,
   FULL_VERSION_STRING: 44,
   COMPRESSION_LEVEL_AND_FLAGS: 49,
+  FLAG_SET1: 53,
   REDIRECTION_TYPE: 57,
   REDIRECTED_HOST: 58,
   REDIRECTED_PORT: 59,

package/node_modules/hdb/lib/protocol/common/ConnectOptionFlagSet1.js

@@ -0,0 +1,18 @@
+// Copyright 2026 SAP AG.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http: //www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+// either express or implied. See the License for the specific
+// language governing permissions and limitations under the License.
+'use strict';
+
+module.exports = {
+  SUPPORT_CLIENT_PING: 0x02000000,
+};

package/node_modules/hdb/lib/protocol/common/ConnectOptionType.js

@@ -33,8 +33,10 @@ ConnectOptionType[ConnectOption.USE_TRANSACTION_FLAGS_ONLY] = TypeCode.BOOLEAN;
 ConnectOptionType[ConnectOption.ROW_AND_COLUMN_OPTIMIZED_FORMAT] = TypeCode.BOOLEAN;
 ConnectOptionType[ConnectOption.IGNORE_UNKNOWN_PARTS] = TypeCode.BOOLEAN;
 ConnectOptionType[ConnectOption.DATA_FORMAT_VERSION2] = TypeCode.INT;
+ConnectOptionType[ConnectOption.CLIENT_INFO_NULL_VALUE_SUPPORTED] = TypeCode.BOOLEAN;
 ConnectOptionType[ConnectOption.OS_USER] = TypeCode.STRING;
 ConnectOptionType[ConnectOption.FULL_VERSION_STRING] = TypeCode.STRING;
+ConnectOptionType[ConnectOption.FLAG_SET1] = TypeCode.INT;
 ConnectOptionType[ConnectOption.REDIRECTION_TYPE] = TypeCode.INT;
 ConnectOptionType[ConnectOption.REDIRECTED_HOST] = TypeCode.STRING;
 ConnectOptionType[ConnectOption.REDIRECTED_PORT] = TypeCode.INT;

package/node_modules/hdb/lib/protocol/common/Constants.js

@@ -28,5 +28,6 @@ module.exports = {
   DATA_LENGTH_2BYTE_LENGTH_INDICATOR: 246,
   DATA_LENGTH_4BYTE_LENGTH_INDICATOR: 247,
   DEFAULT_SPATIAL_TYPES: 0,
+  TEXT_NULL_LENGTH_INDICATOR: 255,
 };
 

package/node_modules/hdb/lib/protocol/common/MessageType.js

@@ -37,5 +37,6 @@ module.exports = {
   FETCH_NEXT_ITAB: 79,
   INSERT_NEXT_ITAB: 80,
   BATCH_PREPARE: 81,
-  DB_CONNECT_INFO: 82
-};
+  DB_CONNECT_INFO: 82,
+  CLIENT_PING: 94
+};

package/node_modules/hdb/lib/protocol/common/PartKind.js

@@ -66,5 +66,6 @@ module.exports = {
   BATCH_EXECUTE: 63,
   */
   TRANSACTION_FLAGS: 64,
-  DB_CONNECT_INFO: 67
+  DB_CONNECT_INFO: 67,
+  CLIENT_PING: 82
 };

package/node_modules/hdb/lib/protocol/common/index.js

@@ -20,6 +20,7 @@ exports.CommandOption = require('./CommandOption');
 exports.CommitOption = require('./CommitOption');
 exports.DbConnectInfoOption = require('./DbConnectInfoOption');
 exports.ConnectOption = require('./ConnectOption');
+exports.ConnectOptionFlagSet1 = require('./ConnectOptionFlagSet1');
 exports.ConnectOptionType = require('./ConnectOptionType');
 exports.ClientContextOption = require('./ClientContextOption');
 exports.DataFormatVersion = require('./DataFormatVersion');

package/node_modules/hdb/lib/protocol/data/TextList.js

@@ -20,6 +20,8 @@ exports.write = write;
 exports.getByteLength = getByteLength;
 exports.getArgumentCount = getArgumentCount;
 
+var NULL_LENGTH_INDICATOR = common.TEXT_NULL_LENGTH_INDICATOR;
+
 function write(part, fields) {
   /* jshint validthis:true */
   var offset = 0;
@@ -32,21 +34,24 @@ function write(part, fields) {
   var field, fieldLength, data;
   for (var i = 0; i < fields.length; i++) {
     field = fields[i];
-    data = util.convert.encode(field, part.useCesu8);
-
-    fieldLength = data.length;
-    if (fieldLength <= common.DATA_LENGTH_MAX1BYTE_LENGTH) {
-      buffer[offset] = fieldLength;
+    if (field === null) {
+      buffer[offset] = NULL_LENGTH_INDICATOR;
       offset += 1;
     } else {
-      buffer[offset] = common.DATA_LENGTH_2BYTE_LENGTH_INDICATOR;
-      offset += 1;
-      buffer.writeUInt16LE(fieldLength, offset);
-      offset += 2;
+      data = util.convert.encode(field, part.useCesu8);
+      fieldLength = data.length;
+      if (fieldLength <= common.DATA_LENGTH_MAX1BYTE_LENGTH) {
+        buffer[offset] = fieldLength;
+        offset += 1;
+      } else {
+        buffer[offset] = common.DATA_LENGTH_2BYTE_LENGTH_INDICATOR;
+        offset += 1;
+        buffer.writeUInt16LE(fieldLength, offset);
+        offset += 2;
+      }
+      data.copy(buffer, offset);
+      offset += fieldLength;
     }
-
-    data.copy(buffer, offset);
-    offset += fieldLength;
   }
   part.argumentCount = getArgumentCount(fields);
   part.buffer = buffer;
@@ -57,11 +62,15 @@ function getByteLength(fields, useCesu8) {
   var byteLength = 0;
   var fieldLength;
   for (var i = 0; i < fields.length; i++) {
-    fieldLength = getByteLengthOfField(fields[i], useCesu8);
-    if (fieldLength <= common.DATA_LENGTH_MAX1BYTE_LENGTH) {
-      byteLength += fieldLength + 1;
+    if (fields[i] === null) {
+      byteLength += 1;
     } else {
-      byteLength += fieldLength + 3;
+      fieldLength = getByteLengthOfField(fields[i], useCesu8);
+      if (fieldLength <= common.DATA_LENGTH_MAX1BYTE_LENGTH) {
+        byteLength += fieldLength + 1;
+      } else {
+        byteLength += fieldLength + 3;
+      }
     }
   }
   return byteLength;
@@ -79,4 +88,3 @@ function getByteLengthOfField(field, useCesu8) {
   return Buffer.byteLength(field);
 }
 
-

package/node_modules/hdb/lib/protocol/data/index.js

@@ -66,6 +66,7 @@ rw[PartKind.RESULT_SET_METADATA] = ResultSetMetadata;
 rw[PartKind.CLIENT_INFO] = TextList;
 rw[PartKind.TRANSACTION_FLAGS] = TransactionFlags;
 rw[PartKind.DB_CONNECT_INFO] = Options;
+rw[PartKind.CLIENT_PING] = Options;
 
 for (var name in PartKind) {
   /* jshint forin: false */