oracledb - npm Package Compare versions

Comparing version 3.0.1 to 3.1.0

CHANGELOG.md

 # Change Log
 
+## node-oracledb v3.1.0 (22 Jan 2019)
+
+- Support tagging of pooled connections when releasing them to the
+  connection pool.  When using Oracle Client libraries 12.2 or later,
+  Oracle's multi-property tagging is used, and a PL/SQL "session"
+  state fix-up procedure can be called when a requested connection tag
+  does not match the actual tag.  This removes the need to reset
+  connection session state after every `pool.getConnection()` call.
+
+- Support a Node.js callback function for connection pools.  It is
+  called when a connection is newly created and has never been
+  acquired from the pool before, or when a requested connection tag
+  does not match the actual tag.
+
+- Support explicit dropping of connections from connection pools.
+
+- Support passing parameters in `oracledb.getConnection()` (such as
+  `poolAlias`, `tag` and proxy authentication credentials) for use
+  with the pool cache.
+
+- Support the combination of a user proxy and external authentication
+  with standalone connections (ODPI-C change).
+
+- Defer initialization of the Oracle Client libraries until the first
+  use of `oracledb.getConnection()`, `oracledb.createPool()`,
+  `oracledb.oracleClientVersion`, or
+  `oracledb.oracleClientVersionString`.
+
+  If the Oracle Client cannot be loaded, `getConnection()` and
+  `createPool()` will return an error via the callback.  Accessing
+  `oracledb.oracleClientVersion` or
+  `oracledb.oracleClientVersionString` with throw an error.
+
+  This change allows `require('oracledb')` to always succeed, allowing
+  node-oracledb constants and other attributes to be accessed even if
+  the Oracle Client is not installed.
+
+  This makes it easier to include node-oracledb in multi-database
+  applications where not all users will be accessing Oracle Database.
+
+  It allows code generation tools to access node-oracledb constants
+  without needing Oracle Client installed (see
+  [#983](https://github.com/oracle/node-oracledb/issues/983)).
+
+  Applications now have more scope to alter Oracle environment
+  variables referenced by the Oracle Client layer. Note it is still
+  recommended that the environment be set before Node.js is executed
+  due to potential for confusion or unexpected behavior due to
+  order-of-execution issues.
+
+- Support fetching XMLTYPE columns in queries.  They will return as
+  String limited to the VARCHAR2 length.
+
+- Updated install processes by bundling all pre-built binaries into
+  the https://www.npmjs.com/package/oracledb package, removing the
+  need for a separate binary package download from GitHub.  At runtime
+  an appropriate binary is loaded by `require()`, if it exists,
+  allowing one `node_modules/oracledb` install to be usable in
+  different environments.
+
+  Source code is no longer included in the npm package.  It is still
+  available from GitHub and oss.oracle.com.
+
+  The steps for self-hosting a node-oracledb package have changed, see
+  [INSTALL](https://github.com/oracle/node-oracledb/blob/master/INSTALL.md#selfhost).
+
+- Fixed a crash with high frequency notifications from CQN
+  ([#1009](https://github.com/oracle/node-oracledb/issues/1009)).
+
+- Fixed `poolPingInterval` with Oracle client libraries 12.2 or later
+  (ODPI-C change).
+
+- Fixed an issue with `poolPingInterval` that could cause usable
+  pooled connections to be unnecessarily dropped by
+  `connection.close()`.  (ODPI-C change).
+
+- Fixed a memory leak under certain cirumstances when pooled
+  connections are released back to the pool. (ODPI-C change)
+
+- Display correct error message for SODA `createIndex()` when no
+  parameter is passed.
+
+- Fixed some SODA stability issues (node-oracledb and ODPI-C changes).
+
+- Improved the statement error white list to avoid unnecessarily
+  dropping statements from the statement cache (ODPI-C change).
+
+- Made internal changes to fix V8 deprecation compilation warnings
+  with Node.js 10.12, and fixed other static analysis warnings.
+
 ## node-oracledb v3.0.1 (15 Nov 2018)
 
-- Improve validatation for SODA `createDocument()` arguments.
+- Improve validation for SODA `createDocument()` arguments.
 
@@ -82,5 +172,5 @@ - Stated compatibility is now for Node.js 6, 8, 10, and 11.
 
-- Added support for Oracle Database Continuous Query Notifications,
-  allowing JavaScript methods to be called when database changes are
-  committed.
+- Added support for Oracle Database Continuous Query Notifications
+  (CQN), allowing JavaScript methods to be called when database
+  changes are committed.
 
@@ -186,4 +276,4 @@ - Added support to `fetchAsString` and `fetchInfo` for fetching RAW
 
-- Fixed regression with querystream() in Node 4 & 6.
-  https://github.com/oracle/node-oracledb/issues/847
+- Fixed regression with `queryStream()` in Node 4 & 6
+  ([#847](https://github.com/oracle/node-oracledb/issues/847)).
 
@@ -381,3 +471,3 @@ ## node-oracledb v2.1.0 (15 Feb 2018)
 
-- Relaxed the restriction preventing `oracledb.connnectionClass` being
+- Relaxed the restriction preventing `oracledb.connectionClass` being
   used with dedicated connections; it previously gave ORA-56609.  Now
@@ -498,3 +588,3 @@ DRCP can now be used with dedicated connections but the
 
-- Relaxed the restriction preventing `oracledb.connnectionClass` being
+- Relaxed the restriction preventing `oracledb.connectionClass` being
   used with dedicated connections; it previously gave ORA-56609.  Now
@@ -501,0 +591,0 @@ DRCP can now be used with dedicated connections but the

lib/connection.js

@@ -276,9 +276,23 @@ /* Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved. */
 // class, which is defined in the C layer.
-function close(closeCb) {
+function close(a1, a2) {
   var self = this;
+  var options = {};
+  var closeCb;
 
-  nodbUtil.assert(arguments.length === 1, 'NJS-009');
-  nodbUtil.assert(typeof closeCb === 'function', 'NJS-006', 1);
+  nodbUtil.assert(arguments.length >= 1 && arguments.length <= 2, 'NJS-009');
 
-  self._close(function(err) {
+  switch (arguments.length) {
+    case 1:
+      nodbUtil.assert(typeof a1 === 'function', 'NJS-006', 1);
+      closeCb = a1;
+      break;
+    case 2:
+      nodbUtil.assert(nodbUtil.isObject(a1), 'NJS-006', 1);
+      nodbUtil.assert(typeof a2 === 'function', 'NJS-006', 2);
+      options = a1;
+      closeCb = a2;
+      break;
+  }
+
+  self._close(options, function(err) {
     if (!err) {
@@ -285,0 +299,0 @@ self.emit('_after_close');

lib/oracledb.js

@@ -1,2 +0,2 @@
-/* Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved. */
+/* Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved. */
 
@@ -33,38 +33,25 @@ /******************************************************************************
 var defaultPoolAlias = 'default';
-var binaryReleasePath = '../build/Release/oracledb.node';
-var binaryDebugPath = '../build/Debug/oracledb.node';
 
-// Load the node-oracledb binary add-on that was built when 'npm
-// install' invoked node-gyp.
-// The Debug version of node-oracledb will only exist if 'npm install
-// --debug oracledb' was used.  Typically only the maintainers of
-// node-oracledb do this.
-try {
-  oracledbCLib =  require(binaryReleasePath);
-} catch (err) {
-  var nodeInfo = process.versions.node + ' (' + process.platform + ', ' + process.arch +')\n';
-  var fullReleasePath = require('path').resolve(__dirname, binaryReleasePath);
-  if (err.code === 'MODULE_NOT_FOUND') {
-    try {
-      oracledbCLib = require(binaryDebugPath);
-    } catch (err) {
+//  Load the Oracledb binary
+
+var binaryLocations = [
+  '../' + nodbUtil.RELEASE_DIR + '/' + nodbUtil.BINARY_FILE,  // pre-built binary
+  '../' + nodbUtil.RELEASE_DIR + '/' + 'oracledb.node',       // binary built from source
+  '../build/Debug/oracledb.node'                              // debug binary
+];
+
+for (var i = 0; i < binaryLocations.length; i++) {
+  try {
+    oracledbCLib = require(binaryLocations[i]);
+    break;
+  } catch(err) {
+    if (err.code !== 'MODULE_NOT_FOUND' || i == binaryLocations.length - 1) {
+      var nodeInfo;
       if (err.code === 'MODULE_NOT_FOUND') {
-        // Neither Release or Debug binary was found but assume users wanted Release binary
-        nodeInfo += 'Cannot find module ' + fullReleasePath + '\n' + getInfo();
-        throw new Error(nodbUtil.getErrorMessage('NJS-045', nodeInfo));
+        // none of the three binaries could be found
+        nodeInfo = `\n  Looked for ${binaryLocations.map(x => require('path').resolve(__dirname, x)).join(', ')}\n  ${nodbUtil.getInstallURL()}\n`;
       } else {
-        nodeInfo += 'Cannot load ' + binaryDebugPath + '\n';
-        nodeInfo += 'Node.js require() error was: \n  ' + err.message + '\n' + getInfo();
-        throw new Error(nodbUtil.getErrorMessage('NJS-045', nodeInfo));
+        nodeInfo = `\n  Node.js require('oracledb') error was:\n  ${err.message}\n  ${nodbUtil.getInstallHelp()}\n`;
       }
-    }
-  } else {
-    if (err.message.startsWith('DPI-1047:')) {
-      // Release add-on binary loaded OK, but ODPI-C can't load Oracle client
-      nodeInfo += 'Node.js require() error was: \n  ' + err.message + '\n';
-      nodeInfo += 'Node.js require() mapped to ' + fullReleasePath + '\n' + getInfo();
       throw new Error(nodbUtil.getErrorMessage('NJS-045', nodeInfo));
-    } else {
-      nodeInfo += 'Cannot load ' + fullReleasePath + '\n' + err.message + '\n' + getInfo();
-      throw new Error(nodbUtil.getErrorMessage('NJS-045', nodeInfo));
     }
@@ -74,2 +61,4 @@ }
 
+// Oracledb functions and classes
+
 oracledbCLib.Oracledb.prototype.newLob = function(iLob) {
@@ -79,59 +68,2 @@ return new Lob(iLob, null, oracledbInst);
 
-
-// Return a string with installation usage tips that may be helpful
-function getInfo() {
-  var arch, url, mesg = '';
-  mesg = 'Node-oracledb installation instructions: ';
-  mesg += 'https://oracle.github.io/node-oracledb/INSTALL.html\n';
-  if (process.platform === 'linux') {
-    if (process.arch === 'x64') {
-      url = 'http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html\n';
-      arch = '64-bit';
-    } else if (process.arch === 'x32') {
-      url = 'http://www.oracle.com/technetwork/topics/linuxsoft-082809.html\n';
-      arch = '32-bit';
-    } else {
-      url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
-      arch = process.arch;
-    }
-    mesg += 'You must have ' + arch + ' Oracle client libraries in LD_LIBRARY_PATH, or configured with ldconfig.\n';
-    mesg += 'If you do not have Oracle Database on this computer, then install the Instant Client Basic or Basic Light package from \n';
-    mesg += url;
-  } else if (process.platform === 'darwin') {
-    if (process.arch === 'x64') {
-      url = 'http://www.oracle.com/technetwork/topics/intel-macsoft-096467.html';
-      arch = '64-bit';
-    } else if (process.arch === 'x32') {
-      url = 'http://www.oracle.com/technetwork/topics/intel-macsoft-096467.html';
-      arch = '32-bit';
-    } else {
-      url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
-      arch = process.arch;
-    }
-    mesg += 'You must have the ' + arch + ' Oracle Instant Client Basic or Basic Light package in ~/lib or /usr/local/lib\n';
-    mesg += 'They can be downloaded from ' + url;
-  } else if (process.platform === 'win32') {
-    if (process.arch === 'x64') {
-      url = 'http://www.oracle.com/technetwork/topics/winx64soft-089540.html\n';
-      arch = '64-bit';
-    } else if (process.arch === 'x32') {
-      url = 'http://www.oracle.com/technetwork/topics/winsoft-085727.html\n';
-      arch = '32-bit';
-    } else {
-      url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
-      arch = process.arch;
-    }
-    mesg += 'You must have ' + arch + ' Oracle client libraries in your PATH environment variable.\n';
-    mesg += 'If you do not have Oracle Database on this computer, then install the Instant Client Basic or Basic Light package from\n';
-    mesg += url;
-    mesg += 'A Microsoft Visual Studio Redistributable suitable for your Oracle client library version must be available.\n';
-  } else {
-    url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
-    mesg += 'You must have ' + process.arch + ' Oracle client libraries in your operating system library search path.\n';
-    mesg += 'If you do not have Oracle Database on this computer, then install an Instant Client Basic or Basic Light package from: \n';
-    mesg += url;
-  }
-  return mesg;
-}
-
 // This createPool function is used the override the createPool method of the
@@ -142,2 +74,3 @@ // Oracledb class, which is defined in the C layer. The override allows us to do
   var self = this;
+  var sessionCallback;
   var poolAlias;
@@ -177,2 +110,14 @@
 
+  // Retain local callback for fixing up tags on connections acquired from the
+  // pool, if applicable; this value can either be a function which will be
+  // called when a connection is acquired from the pool which doesn't have the
+  // requested tag or will be a string defining a PL/SQL procedure which will
+  // be called by the database when a connection acquired from the pool doesn't
+  // have the requested tag
+  sessionCallback = poolAttrs.sessionCallback;
+  if (typeof poolAttrs.sessionCallback === 'function') {
+    poolAttrs = Object.assign({}, poolAttrs);
+    delete poolAttrs.sessionCallback;
+  }
+
   // Need to prevent another call in the same stack from succeeding, otherwise
@@ -192,2 +137,5 @@ // two pools could be created with the same poolAlias and the second one that
 
+      if (err.message.match(/DPI-1047/)) {
+        err.message += "\n" + nodbUtil.getInstallHelp();
+      }
       createPoolCb(err);
@@ -205,2 +153,3 @@
 
+    poolAttrs.sessionCallback = sessionCallback;
     pool.extend(poolInst, poolAttrs, poolAlias, self);
@@ -251,3 +200,3 @@
   var poolAlias;
-  var connAttrs;
+  var connAttrs = {};
   var getConnectionCb;
@@ -296,3 +245,3 @@
 
-    pool.getConnection(getConnectionCb);
+    pool.getConnection(connAttrs, getConnectionCb);
   } else {
@@ -306,2 +255,5 @@ // Allow user to use connectionString as an alias for connectString.
       if (err) {
+        if (err.message.match(/DPI-1047/)) {
+          err.message += "\n" + nodbUtil.getInstallHelp();
+        }
         getConnectionCb(err);
@@ -308,0 +260,0 @@ return;

lib/pool.js

@@ -37,3 +37,3 @@ /* Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved. */
 
-  self._getConnection(config, function(err, connInst) {
+  self._getConnection(config, function(err, connInst, newSession) {
     if (err) {
@@ -67,3 +67,24 @@ // Decrementing _connectionsOut if we didn't actually get a connection
 
-    getConnectionCb(null, connInst);
+    // Invoke tag fixup callback method if one has been specified and
+    // the actual tag on the connection doesn't match the one
+    // requested, or the connection is freshly created.
+    let requestedTag = config.tag || "";
+    if (typeof self.sessionCallback === 'function' &&
+        (newSession || connInst.tag != requestedTag)) {
+      self.sessionCallback(connInst, requestedTag,
+        function(err) {
+          if (err) {
+            connInst.close({drop: true}, function() {
+              getConnectionCb(err);
+            });
+            return;
+          }
+          getConnectionCb(null, connInst);
+        }
+      );
+
+    // otherwise, simply invoke the user's callback immediately
+    } else {
+      getConnectionCb(null, connInst);
+    }
   });
@@ -331,2 +352,5 @@ }
   console.log('...poolPingInterval:', self.poolPingInterval);
+  console.log('...sessionCallback:',
+    typeof self.sessionCallback === 'function' ? self.sessionCallback.name :
+      (typeof self.sessionCallback === 'string' ? '"' + self.sessionCallback + '"' : self.sessionCallback));
   console.log('...stmtCacheSize:', self.stmtCacheSize);
@@ -471,2 +495,12 @@ console.log('Pool status:');
         value: oracledb.POOL_STATUS_OPEN
+      },
+      sessionCallback: {  // session callback
+        enumerable: true,
+        get: function() {
+          return poolAttrs.sessionCallback;
+        },
+        set: function() {
+          throw new Error(nodbUtil.getErrorMessage('NJS-014',
+            'sessionCallback'));
+        }
       }
@@ -473,0 +507,0 @@ }

lib/sodaCollection.js

@@ -95,3 +95,3 @@ /* Copyright (c) 2018, Oracle and/or its affiliates.  All rights reserved */
 
-  nodbUtil.assert(arguments.length === 2, 'NUS-009', 1);
+  nodbUtil.assert(arguments.length === 2, 'NJS-009', 1);
   nodbUtil.assert(nodbUtil.isObject(spec), 'NJS-006', 1);
@@ -98,0 +98,0 @@ nodbUtil.assert(typeof cb === 'function', 'NJS-006', 2);

lib/util.js

@@ -1,2 +0,2 @@
-/* Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved. */
+/* Copyright (c) 2016, 2019, Oracle and/or its affiliates. All rights reserved. */
 
@@ -24,2 +24,14 @@ /******************************************************************************
 
+// Directory containing the node-oracledb add-on binary
+const RELEASE_DIR = 'build/Release';
+module.exports.RELEASE_DIR = RELEASE_DIR;
+
+// The default node-oracledb add-on binary filename for this Node.js
+const BINARY_FILE = 'oracledb-abi' + process.versions.modules + '-' + process.platform + '-' + process.arch + '.node';
+module.exports.BINARY_FILE = BINARY_FILE;
+
+// Staging directory used by maintainers building the npm package
+const STAGING_DIR = 'package/Staging';
+module.exports.STAGING_DIR = STAGING_DIR;
+
 var EventEmitter = require('events').EventEmitter;
@@ -31,4 +43,3 @@ var eventEmitterKeys = Object.keys(EventEmitter.prototype);
 
-// errorMessages is a temporary duplication of error messages defined in the C
-// layer that will be removed once a function to fetch from the C layer is added.
+// errorMessages is for NJS error messages used in the JavaScript layer
 var errorMessages = {
@@ -46,9 +57,75 @@ 'NJS-002': 'NJS-002: invalid pool',
   'NJS-043': 'NJS-043: ResultSet already converted to QueryStream',
-  'NJS-045': 'NJS-045: cannot load the oracledb add-on binary for Node.js %s',
+  'NJS-045': 'NJS-045: cannot load a node-oracledb binary for Node.js ' + process.versions.node + ' (' + process.platform + ' ' + process.arch + ') %s',
   'NJS-046': 'NJS-046: poolAlias "%s" already exists in the connection pool cache',
   'NJS-047': 'NJS-047: poolAlias "%s" not found in the connection pool cache',
+  'NJS-054': 'NJS-054: binary build/Release/oracledb.node was not installed',
   'NJS-064': 'NJS-064: connection pool is closing',
-  'NJS-065': 'NJS-065: connection pool was closed'
+  'NJS-065': 'NJS-065: connection pool was closed',
+  'NJS-067': 'NJS-067: a pre-built node-oracledb binary was not found for Node.js %s'
 };
 
+// getInstallURL returns a string with installation URL
+function getInstallURL() {
+  return('Node-oracledb installation instructions: https://oracle.github.io/node-oracledb/INSTALL.html');
+}
+
+module.exports.getInstallURL = getInstallURL;
+
+// getInstallHelp returns a string with installation usage tips that may be helpful
+function getInstallHelp() {
+  var arch, url;
+  var mesg = getInstallURL() + '\n';
+  if (process.platform === 'linux') {
+    if (process.arch === 'x64') {
+      url = 'http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html\n';
+      arch = '64-bit';
+    } else if (process.arch === 'x32') {
+      url = 'http://www.oracle.com/technetwork/topics/linuxsoft-082809.html\n';
+      arch = '32-bit';
+    } else {
+      url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
+      arch = process.arch;
+    }
+    mesg += 'You must have ' + arch + ' Oracle client libraries in LD_LIBRARY_PATH, or configured with ldconfig.\n';
+    mesg += 'If you do not have Oracle Database on this computer, then install the Instant Client Basic or Basic Light package from \n';
+    mesg += url;
+  } else if (process.platform === 'darwin') {
+    if (process.arch === 'x64') {
+      url = 'http://www.oracle.com/technetwork/topics/intel-macsoft-096467.html';
+      arch = '64-bit';
+    } else if (process.arch === 'x32') {
+      url = 'http://www.oracle.com/technetwork/topics/intel-macsoft-096467.html';
+      arch = '32-bit';
+    } else {
+      url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
+      arch = process.arch;
+    }
+    mesg += 'You must have the ' + arch + ' Oracle Instant Client Basic or Basic Light package in ~/lib or /usr/local/lib\n';
+    mesg += 'They can be downloaded from ' + url;
+  } else if (process.platform === 'win32') {
+    if (process.arch === 'x64') {
+      url = 'http://www.oracle.com/technetwork/topics/winx64soft-089540.html\n';
+      arch = '64-bit';
+    } else if (process.arch === 'x32') {
+      url = 'http://www.oracle.com/technetwork/topics/winsoft-085727.html\n';
+      arch = '32-bit';
+    } else {
+      url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
+      arch = process.arch;
+    }
+    mesg += 'You must have ' + arch + ' Oracle client libraries in your PATH environment variable.\n';
+    mesg += 'If you do not have Oracle Database on this computer, then install the Instant Client Basic or Basic Light package from\n';
+    mesg += url;
+    mesg += 'A Microsoft Visual Studio Redistributable suitable for your Oracle client library version must be available.\n';
+  } else {
+    url = 'http://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html\n';
+    mesg += 'You must have ' + process.arch + ' Oracle client libraries in your operating system library search path.\n';
+    mesg += 'If you do not have Oracle Database on this computer, then install an Instant Client Basic or Basic Light package from: \n';
+    mesg += url;
+  }
+  return mesg;
+}
+
+module.exports.getInstallHelp = getInstallHelp;
+
 // makeEventEmitter is used to make class instances inherit from the EventEmitter
@@ -55,0 +132,0 @@ // class. This is needed because we extend instances from the C layer and thus

package.json

 {
   "name": "oracledb",
-  "version": "3.0.1",
+  "version": "3.1.0",
   "description": "A Node.js module for Oracle Database access",
@@ -31,12 +31,5 @@ "license": "Apache-2.0",
   },
-  "devDependencies": {
-    "mocha": "^2.4.5",
-    "should": "^8.3.1",
-    "async": "^1.5.0"
-  },
   "scripts": {
-    "install": "node package/oracledbinstall.js",
-    "testv6": "mocha --opts test/opts/mochaNodeV6.opts",
-    "test": "mocha --opts test/opts/mocha.opts",
-    "posttest": "node test/opts/version.js"
+    "install": "node package/install.js",
+    "prune": "node package/prunebinaries.js"
   },
@@ -43,0 +36,0 @@ "engines": {

package/README.md

 # Overview
 
-This directory contains scripts for building, extracting and
-installing binary packages of node-oracledb.  Most users do not need
-to use anything in this directory (the exceptions are when building
-packages for self-hosting, or when doing a [manual
-install](https://oracle.github.io/node-oracledb/INSTALL.html#manualextraction)
-instead of using `npm`).
+This directory is used for building the [node-oracledb npm
+package](https://www.npmjs.com/package/oracledb).  The scripts can
+also be used to create custom packages for hosting on a local server.
 
-The binary install process requires two kinds of package:
+Most users do not need to use anything in this directory.
 
-- a gzipped tar file like `oracledb-X.Y.Z.tgz` containing JavaScript
-  and ancillary files suitable for npm to install.  This is a generic
-  file used on all platforms.
-
-- a gzipped package like `oracledb-vZ.Y.Z-node-abi57-darwin-x64.gz`
-  containing the binary add-on.  The package uses a custom format with
-  three components: length bytes (giving the length of the license
-  file), the license file, and then the node-oracledb binary.  Each
-  Node.js version/architecture needs a unique binary package.
-
-  A custom package format is used due to business and technical requirements:
-
-  - the license text needs to be included with any binary download.
-
-  - Node.js doesn't have a native archive module, and the installer
-    should be lightweight and not have 3rd party dependencies.
-
-When `npm install oracledb` is executed, the JavaScript package is
-first installed by npm.  An 'install' script in its `package.json`
-invokes `oracledbinstall.js`.  This downloads the appropriate
-node-oracledb binary package, and then extracts and installs the
-binary.
-
-If a suitable binary package is not available, users must compile
-source code by installing from GitHub.
-
-Installation is described in [INSTALL](https://oracle.github.io/node-oracledb/INSTALL.html).
-
 # Maintainers
 
-- The Makefile is used by node-oracledb maintainers to create the
-  packages to be uploaded to
-  [GitHub](https://github.com/oracle/node-oracledb) and
-  [npm](https://www.npmjs.com/package/oracledb).
+In a clone or copy of the repository:
 
-    - `make npmpackage` makes the main node-oracledb package
-      containing the general node-oracledb JavaScript files and the
-      package.json in this directory.  This is the package that an
-      `npm install oracledb` will initially install.
+- `npm run buildbinary` calls `buildbinary.js` to create a binary for
+  the current node-oracledb / Node.js / platform combination.
 
-    - `make binarypackage` makes a binary package for the current
-      Node.js / node-oracledb / platform combination and generates a
-      SHA256 for the binary.  A Windows batch file does the same for
-      Windows.
+- `npm run buildpackage` calls `buildpackage.js` to make the
+  node-oracledb package containing the node-oracledb JavaScript files,
+  the available binaries, and a package.json that has an "install"
+  script and a "prune" script.  The package will be created in the top
+  level directory.
 
-- As part of `npm install`, the `package.json` in this directory
-  invokes `oracledbinstall.js` that downloads the appropriate binary
-  package from GitHub.  This variant of `package.json` is the copy
-  bundled for the npm release.
+  Before executing `npm run buildpackage`, all binaries and related
+  build metadata information files from all node-oracledb / Node.js /
+  platform combinations should be placed in the `package/Staging`
+  directory.
 
-  The parent file `../package.json` doesn't have the install target
-  meaning that node-gyp will be invoked to compile node-oracledb.  This
-  allows installation from source code (via GitHub) when no suitable
-  pre-built binary is available.
+Package installation:
 
-- The `make npmpackage` command creates three variants of the JavaScript bundle:
+- As part of an `npm install` that uses the created package, the
+  `package.json` install script runs `package/install.js` to check a
+  binary module for the current Node.js and platform is available.
 
-  - `oracledb-X.Y.Z.tgz` which downloads binaries from the
-    node-oracledb GitHub release page.
+  If a suitable binary is not available, installation will fail.
+  Users must then compile node-oracledb using source code from GitHub,
+  or choose an alternative Node.js / platform that has a pre-built
+  binary module.
 
-  - `staging-oracledb-X.Y.Z.tgz` which downloads binaries from a
-    server of your choice, specified by the environment variables
-    `NODE_ORACLEDB_PACKAGE_HOSTNAME` (e.g. "your.example.com") and
-    `NODE_ORACLEDB_PACKAGE_URL_PATH` (e.g. "/yourpath/") which must be set
-    before running `make`.
+- After install, space conscious users can run `npm run prune` which
+  removes pre-built binaries for all other Node.js releases and
+  architectures.
 
-  - `oracledb-src-X.Y.Z.tgz` which is the complete source code, mainly
-    created because older npm's (e.g. with Node.js 4) do not download the
-    opdi submodule code when installing from a GitHub tag or branch.
-
-- The`staging-oracledb-X.Y.Z.tgz` package can be used to host binaries
-  on internal networks.  Copy `staging-oracledb-X.Y.Z.tgz`, the binary
-  packages for each desired architectures, and a single SHASUMS256.txt
-  file (with one line per available binary package) to an
-  HTTPS-enabled web server to the directory that
-  https://your.example.com/yourpath/vX.Y.Z/ resolves to.  Note if the
-  web server has a self-signed certificate, then you may need to
-  bypass some npm checks:
-
-  ```
-  export NODE_TLS_REJECT_UNAUTHORIZED=0
-  npm config set strict-ssl false
-
-  npm install https://your.example.com/yourpath/vX.Y.Z/staging-oracledb-X.Y.X.tgz
-  ```
-
-  Remember to do `npm config delete strict-ssl` and unset the
-  environment variable when not testing.
-
-- On Windows, MAKEPKG.BAT has command options to create binaries, and
-  also to create staged binaries and the main packages.
-
-- At install time, setting the environment variable
-  `NODE_ORACLEDB_TRACE_INSTALL` to `TRUE` will cause `npm install` to
-  display more tracing information.
-
--  The installer scripts assume GitHub tags have the format "vX.Y.Z".
-   Other assumptions about GitHub paths are also made in the scripts.
-
-- TODO
-
-  - oracledbinstall.js should cache SHASUMS256.txt so it doesn't have to be fetched twice.
-  - Add support for proxies that require authentication
-  - Improve oracledbinstall.js `no_proxy` support for domain names and wildcards.
+By default the top level `package.json` doesn't have an install script
+target.  This means that node-gyp will be invoked to compile
+node-oracledb.  This allows installation from [source
+code](https://oracle.github.io/node-oracledb/INSTALL.html#github) (via
+GitHub) when no suitable pre-built binary is available.

README.md

@@ -1,2 +0,2 @@
-# node-oracledb version 3.0
+# node-oracledb version 3.1
 
@@ -3,0 +3,0 @@ The node-oracledb add-on for Node.js powers high performance Oracle

New alerts

Install scripts

Supply chain risk

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Found 1 instance in 1 package

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Mixed license

License

(Experimental) Package contains multiple licenses.

Found 1 instance in 1 package

Fixed alerts

Install scripts

Supply chain risk

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Found 1 instance in 1 package

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 10 instances in 1 package

Mixed license

License

(Experimental) Package contains multiple licenses.

Found 1 instance in 1 package

Unidentified License

License

(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

7301513

increased by362.07%

Dev dependency count

0

decreased by-100%

Number of low license alerts

2

decreased by-33.33%

Number of high supply chain risk alerts

1

decreased by-50%

Number of low supply chain risk alerts

4

decreased by-77.78%

Published versions last two months

2

increased by100%

Worsened metrics

Number of downloads

207925

decreased by-9.73%

Number of package files

44

decreased by-52.69%

Lines of code

3130

decreased by-17.15%

Number of medium supply chain risk alerts

12

increased by200%

No dependency changes