[michaeldiederich]

Description
When rendering JSON responses via renderWith() in vendor/wheels/controller/rendering.cfc, Wheels tries to convert oracle.sql.TIMESTAMP instances into CFML timestamps. If the data struct contains keys with null values (for example { "data": null, "error": null }), Lucee throws a NullPointerException, because its isInstanceOf(obj, className) implementation calls obj.getClass() on null.

A similar issue can occur in vendor/wheels/view/formsdate.cfc inside $dateOrTimeSelectNormalizeValue(), where isInstanceOf() is called on a value without prior null/object verification.

Steps to reproduce
Pass a struct with null values to renderWith():

response = {
    "success": true,
    "data": javaCast("null", ""),
    "error": javaCast("null", "")
};
renderWith(data=response);

Request the response format as json.

Actual behaviour
Lucee throws an unhandled Java exception: java.lang.NullPointerException: Cannot invoke "Object.getClass()" because "obj" is null, from isInstanceOf in rendering.cfc.

Scope
The guard fixes JSON rendering and the date/time form-helper path. XML rendering of null struct values goes through the separate toXML path and is not covered here — that remains a follow-up.

Maintainer updates pushed to this branch

• 8450de17 — extracted the LocalDateTime/Oracle TIMESTAMP unwrapping into $normalizeDateOrTimeObjectValue() so $dateOrTimeSelectNormalizeValue() passes the complexity gate (32 → 28); added the changelog fragment.
• 5424ab6a — scoped the changelog fragment to JSON rendering.

Tests: core suite, H2, Adobe 2023, BoxLang, RustCFML and smoke legs are green on the current head.

[bpamiri]

Thanks for the detailed report and the fix, Michael — the null-value repro and the isInstanceOf call sites are spot on, and we're taking this forward.

CI is green except the complexity gate: the added guard pushes $dateOrTimeSelectNormalizeValue() to 32 (the gate is 30). I'm pushing a small refactor to your branch that extracts the date/object normalization into a $-prefixed helper, so the main function drops back under the gate while behaviour stays the same. I'll also add a changelog fragment. No change needed from you — shout if you'd rather I carry it in a separate PR instead and leave your branch untouched.

[bpamiri]

Pushed a maintainer commit to your branch: 8450de170 refactor(view): extract date/time object normalization to keep the complexity gate green.

What it does:

• Moves the LocalDateTime / Oracle TIMESTAMP unwrapping out of $dateOrTimeSelectNormalizeValue() into a new $normalizeDateOrTimeObjectValue() helper. Same conversions, same pass-through for null and non-object values — the only change is where the branches live.
• cfml-complexity.py --gate 30 now reports PASS (the function was 32; back under the limit).
• Adds changelog.d/renderwith-null-values.fixed.md for the fix.
• PR title is now conventional (fix(controller): handle null values in renderWith() and date form helpers), which clears the commit-message check.

CI is re-running. No action needed from you — if you'd rather keep your branch exactly as you wrote it, say so and I'll move this into a maintainer-side PR instead.

[michaeldiederich]

Thank you very much!