oracledb 7.0.0 → 7.0.1

package/README.md

@@ -1,10 +1,10 @@
-# node-oracledb version 7.0.0 <img src="https://img.shields.io/npm/v/oracledb.svg" alt="oracledb"/>  <img src="https://img.shields.io/npm/dm/oracledb.svg" alt="oracledb"/>
+# node-oracledb version 7.0.1 <img src="https://img.shields.io/npm/v/oracledb.svg" alt="oracledb"/>  <img src="https://img.shields.io/npm/dm/oracledb.svg" alt="oracledb"/>
 
 The node-oracledb add-on for Node.js powers high performance Oracle Database
 applications.  Applications can be written in TypeScript, or directly in
 JavaScript.
 
-Use node-oracledb 7.0.0 to connect Node.js 14.17, or later, to Oracle
+Use node-oracledb 7.0.1 to connect Node.js 14.17, or later, to Oracle
 Database.  Older versions of node-oracledb may work with older versions of
 Node.js.
 

package/build/Release/oracledb-7.0.1-darwin-arm64.node-buildinfo.txt

@@ -0,0 +1 @@
+oracledb-7.0.1-darwin-arm64.node v24.11.1 6a91ac655ae2460fb19c2227f62d85e02b98cd54 a8d9752420b96d37d5a76c8a5d371abdb95c6cba Thu, 09 Jul 2026 10:04:02 GMT

package/build/Release/oracledb-7.0.1-js-buildinfo.txt

@@ -0,0 +1 @@
+6a91ac655ae2460fb19c2227f62d85e02b98cd54

package/build/Release/oracledb-7.0.1-linux-arm64.node-buildinfo.txt

@@ -0,0 +1 @@
+oracledb-7.0.1-linux-arm64.node v22.22.2 6a91ac655ae2460fb19c2227f62d85e02b98cd54 a8d9752420b96d37d5a76c8a5d371abdb95c6cba Thu, 09 Jul 2026 12:01:11 GMT

package/build/Release/oracledb-7.0.1-linux-x64.node-buildinfo.txt

@@ -0,0 +1 @@
+oracledb-7.0.1-linux-x64.node v22.19.0 6a91ac655ae2460fb19c2227f62d85e02b98cd54 a8d9752420b96d37d5a76c8a5d371abdb95c6cba Thu, 09 Jul 2026 11:59:00 GMT

package/build/Release/oracledb-7.0.1-win32-x64.node-buildinfo.txt

@@ -0,0 +1 @@
+oracledb-7.0.1-win32-x64.node v22.17.1 6a91ac655ae2460fb19c2227f62d85e02b98cd54 a8d9752420b96d37d5a76c8a5d371abdb95c6cba Thu, 09 Jul 2026 11:58:36 GMT

package/lib/aqDeqOptions.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2019, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -56,7 +56,7 @@ class AqDeqOptions {
   }
 
   set consumerName(value) {
-    errors.assertPropValue(typeof value === 'string', "consumerName");
+    errors.assertPropLength(value, "string", 128, "consumerName");
     this._impl.setConsumerName(value);
   }
 
@@ -70,7 +70,7 @@ class AqDeqOptions {
   }
 
   set correlation(value) {
-    errors.assertPropValue(typeof value === 'string', "correlation");
+    errors.assertPropLength(value, "string", 128, "correlation");
     this._impl.setCorrelation(value);
   }
 
@@ -148,7 +148,7 @@ class AqDeqOptions {
   }
 
   set transformation(value) {
-    errors.assertPropValue(typeof value === 'string', "transformation");
+    errors.assertPropLength(value, "string", 128, "transformation");
     this._impl.setTransformation(value);
   }
 

package/lib/aqEnqOptions.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2022, Oracle and/or its affiliates.
+// Copyright (c) 2019, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -57,7 +57,7 @@ class AqEnqOptions {
   }
 
   set transformation(value) {
-    errors.assertPropValue(typeof value === 'string', "transformation");
+    errors.assertPropLength(value, "string", 128, "transformation");
     this._impl.setTransformation(value);
   }
 

package/lib/aqQueue.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2019, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -104,15 +104,15 @@ class AqQueue {
 
     // validate options, if applicable
     if (message.correlation !== undefined) {
-      errors.assertParamPropValue(typeof message.correlation === 'string', 1,
+      errors.assertPropLength(message.correlation, "string", 128,
         "correlation");
     }
     if (message.delay !== undefined) {
       errors.assertParamPropValue(Number.isInteger(message.delay), 1, "delay");
     }
     if (message.exceptionQueue !== undefined) {
-      errors.assertParamPropValue(typeof message.exceptionQueue === 'string',
-        1, "exceptionQueue");
+      errors.assertPropLength(message.exceptionQueue, "string", 128,
+        "exceptionQueue");
     }
     if (message.expiration !== undefined) {
       errors.assertParamPropValue(Number.isInteger(message.expiration), 1,
@@ -123,8 +123,13 @@ class AqQueue {
         "priority");
     }
     if (message.recipients !== undefined) {
-      errors.assertParamPropValue(nodbUtil.isArrayOfStrings(message.recipients),
-        1, "recipients");
+      // Check recipients length and type
+      errors.assertPropLength(message.recipients, "array", 1024, "recipients");
+      // Check value and length of each recipient
+      message.recipients.forEach((recipient, index) => {
+        errors.assertPropLength(recipient, "string", 128,
+          `recipient at index ${index}`);
+      });
     }
 
     return message;

package/lib/connection.js

@@ -83,9 +83,8 @@ function _determineDbObjTypeConverter(metadata, options) {
       }
       if ([types.DB_TYPE_CLOB, types.DB_TYPE_NCLOB, types.DB_TYPE_BLOB,
         types.DB_TYPE_BFILE].includes(metadata.type)) {
-        // converters for LOB's are not supported.
-        return errors.throwErr(errors.ERR_NOT_IMPLEMENTED,
-          'DbObjConverter for LOBs');
+        // converters for LOBs are not supported.
+        return errors.throwNotImplemented('DbObjConverter for LOBs');
       }
       metadata.converter = result.converter;
     }
@@ -2116,13 +2115,6 @@ class Connection extends EventEmitter {
       errors.throwErr(errors.ERR_APP_CONTEXT_EMPTY_NAMESPACE);
     }
 
-    // Passing null/undefined/[] currently leaves existing entries intact in
-    // thick mode and triggers an error in thin mode.
-    // It does not clear the context; use clearAppContext() explicitly
-    // when you need to remove keys.
-    if (keyValues === null || keyValues === undefined) {
-      keyValues = [];
-    }
     errors.assertParamValue(Array.isArray(keyValues), 2);
 
     for (const entry of keyValues) {

package/lib/endUserSecurityContext.js

@@ -44,12 +44,11 @@ Represents the credential set an application associates with an end user.
 
 Required properties
 - databaseAccessToken: non-empty string accepted by the database driver.
-- endUserToken or endUserName: at least one must be supplied as a string.
-- key: required whenever endUserName is supplied; otherwise optional.
+- endUserToken or endUserName: exactly one must be supplied as a string.
 
 Optional properties
 - key: look-up identifier the database maps to stored context attributes; may be
-  omitted only when identifying users via endUserToken.
+  supplied only with endUserName.
 - dataRoles: data roles enabled/disabled by the application logic, rather
   than a database security policy.
 - attributes: Attributes are contained in JSON objects conforming
@@ -72,29 +71,28 @@ class EndUserSecurityContext {
       dataRoles,
       attributes
     } = options;
+    const hasEndUserToken = endUserToken !== undefined && endUserToken !== null;
+    const hasEndUserName = endUserName !== undefined && endUserName !== null;
+    const hasKey = key !== undefined && key !== null;
 
     // The database access token is always required, and the end user must be
-    // identified either by token or by name.
+    // identified either by token or by name, but not both.
     errors.assertParamValue(hasNonEmptyText(databaseAccessToken), 1);
     errors.assertParamValue(
-      (endUserToken !== undefined && endUserToken !== null) ||
-      (endUserName !== undefined && endUserName !== null),
-      1
-    );
+      (hasEndUserToken && !hasEndUserName && !hasKey) ||
+      (!hasEndUserToken && hasEndUserName), 1);
 
     // When supplied, token/name/key values must contain non-whitespace text.
-    if (endUserToken !== undefined && endUserToken !== null) {
+    if (hasEndUserToken) {
       errors.assertParamValue(hasNonEmptyText(endUserToken), 1);
     }
 
-    // Name-based contexts require a key so the database can locate the stored
-    // end user context attributes.
-    if (endUserName !== undefined && endUserName !== null) {
+    if (hasEndUserName) {
       errors.assertParamValue(hasNonEmptyText(endUserName), 1);
-      errors.assertParamValue(key !== undefined && key !== null, 1);
     }
 
-    if (key !== undefined && key !== null) {
+    if (hasKey) {
+      errors.assertParamValue(hasEndUserName, 1);
       errors.assertParamValue(hasNonEmptyText(key), 1);
     }
 
@@ -159,7 +157,6 @@ class EndUserSecurityContext {
         payloadLength
       );
     }
-    this.clearEncodedPayload();
     this._payloadStore.set(encodedPayload, { returnBuffer: true });
     encodedPayload.fill(0);
   }
@@ -167,10 +164,6 @@ class EndUserSecurityContext {
   getDeobfuscatedValue() {
     return this._payloadStore.get({ returnBuffer: true });
   }
-
-  clearEncodedPayload() {
-    this._payloadStore.clear();
-  }
 }
 
 module.exports = EndUserSecurityContext;

package/lib/errors.js

@@ -198,6 +198,7 @@ const ERR_INVALID_END_USER_SECURITY_CONTEXT_LENGTH = 189;
 const ERR_END_USER_SECURITY_CONTEXT_REQUIRES_TCPS = 190;
 const ERR_UNSUPPORTED_DEEP_DATA_SECURITY_FEATURE = 191;
 const ERR_CHAR_CS_NOT_SUPPORTED = 192;
+const ERR_INVALID_PROPERTY_LENGTH = 193;
 
 // Oracle Net layer errors start from 500
 const ERR_CONNECTION_CLOSED = 500;
@@ -603,6 +604,8 @@ messages.set(ERR_UNSUPPORTED_DEEP_DATA_SECURITY_FEATURE,   // NJS-191
   'database version does not support the Oracle Deep Data Security feature');
 messages.set(ERR_CHAR_CS_NOT_SUPPORTED,                 // NJS-192
   'Character set id %d is not supported by node-oracledb in Thin mode');
+messages.set(ERR_INVALID_PROPERTY_LENGTH,               // NJS-193
+  'The length of the parameter %s exceeds the maximum allowed length of %d');
 
 // Oracle Net layer errors
 
@@ -793,6 +796,21 @@ function assertParamValue(condition, parameterNum) {
   assert(condition, ERR_INVALID_PARAMETER_VALUE, parameterNum);
 }
 
+//-----------------------------------------------------------------------------
+// assertPropLength()
+//
+// Asserts that the property value is of specified type and doesn't exceed
+// maximum specified length
+//-----------------------------------------------------------------------------
+function assertPropLength(value, propType, propMaxLength, propName) {
+  if (propType !== 'array')
+    assertPropValue(typeof value === propType, propName);
+  else
+    assertPropValue(Array.isArray(value), propName);
+  assert(value.length <= propMaxLength, ERR_INVALID_PROPERTY_LENGTH, propName,
+    propMaxLength);
+}
+
 //-----------------------------------------------------------------------------
 // assertPropValue()
 //
@@ -816,6 +834,9 @@ function getErr(errorNum) {
     errorNum = ERR_INVALID_ERR_NUM;
     baseText = messages.get(errorNum);
   }
+  if (errorNum === ERR_INVALID_PACKET && args.length > 1) {
+    baseText += '. Cause: %s';
+  }
   const errorNumStr = errorNum.toString().padStart(3, '0');
   const code = `${ERR_PREFIX}-${errorNumStr}`;
   args[0] = `${code}: ${baseText}`;
@@ -1117,6 +1138,7 @@ module.exports = {
   assertParamPropUnsignedIntNonZero,
   assertParamPropValue,
   assertParamValue,
+  assertPropLength,
   assertPropValue,
   getErr,
   throwErr,

package/lib/impl/parserHelpers.js

@@ -81,8 +81,8 @@ const CONNECT_OVERRIDES = [
 
   // SECURITY parameters
   { opt: 'walletLocation', section: ['DESCRIPTION', 'SECURITY', 'MY_WALLET_DIRECTORY'] },
-  { opt: 'sslServerCertDn', section: ['DESCRIPTION', 'SECURITY', 'SSL_SERVER_CERT_DN'] },
-  { opt: 'sslServerDnMatch', section: ['DESCRIPTION', 'SECURITY', 'SSL_SERVER_DN_MATCH'] },
+  { opt: 'sslServerCertDN', section: ['DESCRIPTION', 'SECURITY', 'SSL_SERVER_CERT_DN'] },
+  { opt: 'sslServerDNMatch', section: ['DESCRIPTION', 'SECURITY', 'SSL_SERVER_DN_MATCH'] },
 
   // ADDRESS parameters
   { opt: 'httpsProxy', section: ['DESCRIPTION', 'ADDRESS', 'HTTPS_PROXY'], perAddress: true },
@@ -297,6 +297,10 @@ async function applyConnectStringOverrides(options) {
     if (raw === undefined) {
       continue;
     }
+    // Treat walletLocation=SYSTEM as "use system certs" -> do not inject into descriptor
+    if (def.opt === 'walletLocation' && typeof raw === 'string' && raw.trim().toUpperCase() === 'SYSTEM') {
+      continue;
+    }
     const formatter = def.fmt || (v => v);
     const value = formatter(raw);
     configured.push({ def, value });

package/lib/thin/connection.js

@@ -1901,16 +1901,10 @@ class ThinConnectionImpl extends ConnectionImpl {
       errors.throwErr(errors.ERR_UNSUPPORTED_DEEP_DATA_SECURITY_FEATURE);
     }
 
-    if (this.securityContext && this.securityContext !== context) {
-      this.securityContext.clearEncodedPayload();
-    }
     this.securityContext = context;
   }
 
   clearEndUserSecurityContext() {
-    if (this.securityContext) {
-      this.securityContext.clearEncodedPayload();
-    }
     this.securityContext = null;
   }
 

package/lib/thin/dbObject.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2023, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2023, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -305,7 +305,7 @@ class ThinDbObjectImpl extends DbObjectImpl {
           }
           break;
         default:
-          errors.throwErr(errors.ERR_NOT_IMPLEMENTED, type);
+          errors.throwNotImplemented(type);
       }
     }
   }
@@ -418,7 +418,7 @@ class ThinDbObjectImpl extends DbObjectImpl {
         }
         return obj;
       default:
-        errors.throwErr(errors.ERR_NOT_IMPLEMENTED, type);
+        errors.throwNotImplemented(type);
     }
   }
 

package/lib/thin/pool.js

@@ -41,7 +41,7 @@ class ThinPoolImpl extends PoolImpl {
 
   _init(params) {
     if (!params.homogeneous) {
-      errors.throwErr(errors.ERR_NOT_IMPLEMENTED, 'Heterogeneous Pooling');
+      errors.throwNotImplemented('Heterogeneous Pooling');
     }
     if (!params.connectString) {
       errors.throwErr(errors.ERR_EMPTY_CONNECT_STRING);

package/lib/thin/protocol/messages/aqArray.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2025, Oracle and/or its affiliates.
+// Copyright (c) 2025, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -78,7 +78,7 @@ class AqArrayMessage extends AqBaseMessage {
       }
       temp16 = buf.readUB2();               // extensions len
       if (temp16 > 0) {
-        errors.throwErr(errors.ERR_NOT_IMPLEMENTED);
+        errors.throwNotImplemented('AQ extensions');
       }
       buf.skipUB2();                        // output ack
     }

package/lib/thin/protocol/messages/aqBase.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2025, Oracle and/or its affiliates.
+// Copyright (c) 2025, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -134,7 +134,7 @@ class AqBaseMessage extends BaseMessage {
     this._processExtensions(buf, propsImpl);
     const temp32 = buf.readUB4();           // user properties
     if (temp32 > 0) {
-      errors.throwErr(errors.ERR_NOT_IMPLEMENTED);
+      errors.throwNotImplemented('AQ User Properties');
     }
     buf.skipUB4();                          // csn
     buf.skipUB4();                          // dsn

package/lib/thin/protocol/messages/base.js

@@ -539,7 +539,7 @@ class Message {
     if (
       this.connection._actionModified ||
       this.connection._clientIdentifierModified ||
-      this.connection._dbopModified ||
+      this.connection._dbOpModified ||
       this.connection._clientInfoModified ||
       this.connection._moduleModified
     ) {

package/lib/thin/protocol/messages/withData.js

@@ -426,7 +426,6 @@ class MessageWithData extends Message {
   }
 
   processReturnParameter(buf) {
-    let keywordNum = 0;
     let keyTextValue;
     let numParams = buf.readUB2();              // al8o4l (ignored)
 
@@ -447,7 +446,7 @@ class MessageWithData extends Message {
       if (numBytes > 0) {
         buf.skipBytesChunked();
       }
-      keywordNum = buf.readUB2();               // keyword num
+      const keywordNum = buf.readUB2();         // keyword num
       if (keywordNum === constants.TNS_KEYWORD_NUM_CURRENT_SCHEMA) {
         this.connection.currentSchema = keyTextValue;
       } else if (keywordNum === constants.TNS_KEYWORD_NUM_EDITION) {
@@ -755,7 +754,7 @@ class MessageWithData extends Message {
       buf.writeDbObject(value);
     } else {
       const message = `Binding data of type ${variable.type}`;
-      errors.throwErr(errors.ERR_NOT_IMPLEMENTED, message);
+      errors.throwNotImplemented(message);
     }
   }
 

package/lib/thin/sqlnet/ezConnectResolver.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -295,7 +295,7 @@ class EZConnectResolver {
         securityInfo.push(`(SSL_SERVER_DN_MATCH=${serverDNMatch})`);
       if (serverCertDN != null)
         securityInfo.push(`(SSL_SERVER_CERT_DN=${serverCertDN})`);
-      if (walletDir != null)
+      if (walletDir != null && walletDir.toUpperCase() !== 'SYSTEM')
         securityInfo.push(`(MY_WALLET_DIRECTORY=${walletDir})`);
     }
     if (securityInfo.length === 0)

package/lib/thin/sqlnet/navNodes.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -326,7 +326,9 @@ class Description {
             || tmpnv.atom.toLowerCase() == "on"
             || tmpnv.atom.toLowerCase() == "true");
           } else if ((tmpnv.name.toUpperCase() == "WALLET_LOCATION") || (tmpnv.name.toUpperCase() == "MY_WALLET_DIRECTORY")) {
-            this.params.walletLocation = tmpnv.atom;
+            if (!(typeof tmpnv.atom === 'string' && tmpnv.atom.trim().toUpperCase() === 'SYSTEM')) {
+              this.params.walletLocation = tmpnv.atom;
+            }
           }
         }
       }

package/lib/thin/sqlnet/networkSession.js

@@ -157,14 +157,23 @@ class NetworkSession {
    * Make the transport level connection
    */
   async transportConnect(address) {
-    if (address.protocol.toUpperCase() == 'TCP' && address.httpsProxy) {
-      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS, 'https proxy requires protocol as', 'tcps ');
+    const protocol = address?.protocol ? address.protocol.toUpperCase() : undefined;
+    const effectiveHttpsProxy = address?.httpsProxy || this.sAtts?.nt?.httpsProxy;
+
+    // Enforce TCPS whenever an HTTPS proxy would be used (either at the address
+    // level or via the session-global proxy fallback in NTTCP).
+    if (protocol === 'TCP' && effectiveHttpsProxy) {
+      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS,
+        'https proxy requires protocol as', 'tcps ');
     }
-    if (address.protocol && (address.protocol.toUpperCase() == 'TCP' || address.protocol.toUpperCase() == 'TCPS')) {
+
+    if (protocol === 'TCP' || protocol === 'TCPS') {
       this.ntAdapter = new NTTCP(this.sAtts.nt);
     } else {
-      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS, address.protocol + " protocol not supported");
+      errors.throwErr(errors.ERR_INVALID_CONNECT_STRING_PARAMETERS,
+        address.protocol + " protocol not supported");
     }
+
     await this.ntAdapter.connect(address);
     this.ntAdapter.startRead();
     this.sAtts.ntCha = this.ntAdapter.cha;
@@ -390,7 +399,7 @@ class NetworkSession {
           } catch (err) {
             if (err.code == 'ERR_BUFFER_TOO_LARGE') {
               errors.throwErr(errors.ERR_INVALID_PACKET,
-                `: decompressed packet exceeds SDU ${maxPayload}`);
+                `Decompressed packet exceeds SDU ${maxPayload}`);
             }
             errors.throwErr(errors.ERR_DATA_COMPRESSION, err.message);
           }
@@ -580,7 +589,7 @@ class NetworkSession {
     if (this.isBreak) {
       return;
     }
-    let bytesCopied = 0;
+    let bytesCopied;
 
     this.sndDatapkt.dataLen = this.sndDatapkt.offset;
     if (this.sndDatapkt.dataLen < this.sndDatapkt.bufLen || !this.sndDatapkt.bufLen) {
@@ -724,10 +733,8 @@ class NetworkSession {
    * returns 0 if healthy connection
    */
   recvInbandNotif() {
-    let error = 0;
     if (this.controlPkt.errno) {     /* Control pkt already read */
-      error = this.controlPkt.errno;
-      return (error);
+      return this.controlPkt.errno;
     } else if (!this.getOption(constants.HEALTHCHECK)) {
       return errors.ERR_CONNECTION_CLOSED;
     } else {
@@ -736,8 +743,7 @@ class NetworkSession {
 
         if (packet.type == constants.NSPTCNL) {
           this.controlPkt.fromPacket(packet);
-          error = this.controlPkt.errno;
-          return (error);
+          return this.controlPkt.errno;
         } else {
           this.ntAdapter.packets.unshift(packet); /* Push packet back */
           return (0);

package/lib/thin/sqlnet/packet.js

@@ -32,6 +32,20 @@ const errors = require("../../errors.js");
 const MAX_CDATA_LEN = 230;
 const NSPCNL = 74;
 
+
+function validateAcceptDataUnits(sdu, tdu, largeSDU) {
+  const maxSdu = largeSDU ? constants.NSPABSSDULN : constants.NSPMXSDULN;
+  if (sdu < constants.NSPMNSDULN || sdu > maxSdu) {
+    const reason = `Negotiated SDU ${sdu} is outside the valid range ` +
+      `${constants.NSPMNSDULN} to ${maxSdu}`;
+    errors.throwErr(errors.ERR_INVALID_PACKET, reason);
+  }
+  if (tdu < constants.NSPMNTDULN || tdu > constants.NSPMXTDULN) {
+    const reason = `Negotiated TDU ${tdu} is outside the valid range ` +
+      `${constants.NSPMNTDULN} to ${constants.NSPMXTDULN}`;
+    errors.throwErr(errors.ERR_INVALID_PACKET, reason);
+  }
+}
 /**
  * Connect Packet (NSPTCN)
  * @param {Buffer} connectData Outgoing Connect Data
@@ -246,13 +260,16 @@ function AcceptPacket(packet, sAtts) {
   /* Set negotiated values */
   sAtts.version = packet.buf.readUInt16BE(constants.NSPACVSN);
   sAtts.options = packet.buf.readUInt16BE(constants.NSPACOPT);
-  sAtts.sdu = packet.buf.readUInt16BE(constants.NSPACSDU);
-  sAtts.tdu = packet.buf.readUInt16BE(constants.NSPACTDU);
+
+  let negotiatedSDU = packet.buf.readUInt16BE(constants.NSPACSDU);
+  let negotiatedTDU = packet.buf.readUInt16BE(constants.NSPACTDU);
+
+  sAtts.largeSDU = false;
 
   if (sAtts.version >= 315) {
     /* Large SDU Support */
-    sAtts.sdu = packet.buf.readUInt32BE(constants.NSPACLSD);
-    sAtts.tdu = packet.buf.readUInt32BE(constants.NSPACLTD);
+    negotiatedSDU = packet.buf.readUInt32BE(constants.NSPACLSD);
+    negotiatedTDU = packet.buf.readUInt32BE(constants.NSPACLTD);
     sAtts.largeSDU = true;
     this.cflag = packet.buf.readUInt8(constants.NSPACCFL); // 00001000
     if ((this.cflag & constants.NSPACCFON) != 0) { // compression ON
@@ -264,6 +281,9 @@ function AcceptPacket(packet, sAtts) {
       sAtts.networkCompressionEnabled = false;
     }
   }
+  validateAcceptDataUnits(negotiatedSDU, negotiatedTDU, sAtts.largeSDU);
+  sAtts.sdu = negotiatedSDU;
+  sAtts.tdu = negotiatedTDU;
 
   /* Accept flags */
   this.flag0 = packet.buf.readUInt8(constants.NSPACFL0);

package/lib/thin/sqlnet/sessionAtts.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2022, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2022, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -88,7 +88,7 @@ class SessionAtts {
         this.networkCompressionThreshold = parseInt(params.networkCompressionThreshold);
       }
 
-      if (typeof params.walletLocation === 'string') {
+      if (typeof params.walletLocation === 'string' && params.walletLocation.trim().toUpperCase() !== 'SYSTEM') {
         this.nt.walletFile = path.join(params.walletLocation, constants.PEM_WALLET_FILE_NAME);
       }
       if (typeof params.walletPassword === 'string') {

package/lib/version.js

@@ -31,6 +31,6 @@
 module.exports = {
   VERSION_MAJOR: 7,
   VERSION_MINOR: 0,
-  VERSION_PATCH: 0,
+  VERSION_PATCH: 1,
   VERSION_SUFFIX: ''
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oracledb",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "A Node.js module for Oracle Database access from JavaScript and TypeScript",
   "license": "(Apache-2.0 OR UPL-1.0)",
   "homepage": "http://oracle.github.io/node-oracledb/",

package/build/Release/oracledb-7.0.0-darwin-arm64.node-buildinfo.txt

@@ -1 +0,0 @@
-oracledb-7.0.0-darwin-arm64.node v22.21.1 a0e6dd3908c245d3028bf517073d8a3cdd951289 e840c29ef17fa01d5eef018822af925154a5dd92 Fri, 15 May 2026 13:04:26 GMT

package/build/Release/oracledb-7.0.0-js-buildinfo.txt

@@ -1 +0,0 @@
-a0e6dd3908c245d3028bf517073d8a3cdd951289

package/build/Release/oracledb-7.0.0-linux-arm64.node-buildinfo.txt

@@ -1 +0,0 @@
-oracledb-7.0.0-linux-arm64.node v22.22.2 a0e6dd3908c245d3028bf517073d8a3cdd951289 e840c29ef17fa01d5eef018822af925154a5dd92 Fri, 15 May 2026 13:48:55 GMT

package/build/Release/oracledb-7.0.0-linux-x64.node-buildinfo.txt

@@ -1 +0,0 @@
-oracledb-7.0.0-linux-x64.node v22.19.0 a0e6dd3908c245d3028bf517073d8a3cdd951289 e840c29ef17fa01d5eef018822af925154a5dd92 Fri, 15 May 2026 13:45:53 GMT

package/build/Release/oracledb-7.0.0-win32-x64.node-buildinfo.txt

@@ -1 +0,0 @@
-oracledb-7.0.0-win32-x64.node v22.17.1 a0e6dd3908c245d3028bf517073d8a3cdd951289 e840c29ef17fa01d5eef018822af925154a5dd92 Fri, 15 May 2026 13:49:56 GMT

package/eslint.config.js

@@ -1,39 +0,0 @@
-/** @type {import('eslint').Linter.Config} */
-const js = require('@eslint/js');
-module.exports = [
-  js.configs.recommended,
-  {
-    languageOptions: {
-      ecmaVersion: 'latest',
-      sourceType: 'commonjs',
-      globals: {
-        ...require('globals').node,
-        ...require('globals').es2020,
-        ...require('globals').es2024,
-        ...require('globals').mocha
-      }
-    },
-    rules: {
-      'require-await': 'error',
-      'brace-style': 'error',
-      'computed-property-spacing': ['error', 'never'],
-      'comma-spacing': ['error', { before: false, after: true }],
-      'no-trailing-spaces': 'error',
-      'prefer-const': 'error',
-      'space-before-function-paren': ['error', { anonymous: 'never', named: 'never', asyncArrow: 'always' }],
-      'key-spacing': ['error', { mode: 'strict' }],
-      'space-in-parens': 'error',
-      'space-infix-ops': 'error',
-      'space-unary-ops': [2, { words: true, nonwords: false }],
-      'space-before-blocks': 'error',
-      'no-tabs': 'error',
-      'keyword-spacing': 'error',
-      'eol-last': 'error',
-      'indent': [2, 2, { SwitchCase: 1 }],
-      'quotes': [0, 'double'],
-      'linebreak-style': [2, 'unix'],
-      'semi': [2, 'always'],
-      'no-console': [0]
-    }
-  }
-];