@sap/cds-compiler 6.9.2 → 6.9.3

package/CHANGELOG.md

@@ -13,6 +13,16 @@ we might not list every change in its behavior here.
 Productive code should never require a `beta` flag to be set, and
 might use a deprecated flag only for a limited period of time.
 
+## Version 6.9.3 - 2026-06-17
+
+### Bug Fixes
+
+- **api:** New compiler option `noErrorForUnknownAnnotateTarget` downgrades errors to warnings
+for `annotate` statements with security-relevant annotations (`@restrict`, `@requires`, `@ams`)
+whose target does not exist.
+
+
+
 ## Version 6.9.2 - 2026-05-08
 
 ### Bug Fixes

package/lib/api/options.js

@@ -19,6 +19,7 @@ const publicOptionsNewAPI = [
   'addTextsLanguageAssoc',
   'localizedLanguageFallback',  // why can't I define the option type here?
   'severities',
+  'noErrorForUnknownAnnotateTarget',
   'messages',
   'withLocations',
   'structXpr',

package/lib/base/messages.js

@@ -220,6 +220,17 @@ const severitySpecs = {
   debug: { name: 'Debug', level: 3 },
 };
 
+// Message IDs raised for security-relevant annotate statements with non-existing targets.
+// Downgraded to warning when noErrorForUnknownAnnotateTarget option is set.
+const securityAnnotateTargetIds = new Set([
+  'ext-undefined-art-sec',
+  'ext-undefined-def-sec',
+  'ext-undefined-element-sec',
+  'ext-undefined-action-sec',
+  'ext-undefined-param-sec',
+  'ext-unexpected-returns-sec',
+]);
+
 /**
  * Get the reclassified severity of the given message using:
  *
@@ -259,6 +270,11 @@ function reclassifiedSeverity( msg, options, moduleName ) {
     }
   }
 
+  if (options.noErrorForUnknownAnnotateTarget &&
+      severity === 'Error' &&
+      securityAnnotateTargetIds.has(msg.messageId))
+    severity = 'Warning';
+
   if (!options.severities)
     return severity;
 

package/lib/main.d.ts

@@ -32,6 +32,18 @@ declare namespace compiler {
      * during compilation otherwise.
      */
     severities?: { [messageId: string]: MessageSeverity}
+    /**
+     * Downgrade the errors raised for `annotate` statements containing a
+     * security-relevant annotation (`@restrict`, `@requires`, `@ams`) but
+     * whose target does not exist.  Intended as a long-lived migration
+     * switch for projects that cannot fix all such statements at once.
+     *
+     * Explicit per-id entries in `severities` still take precedence over
+     * this option.
+     *
+     * @default false
+     */
+    noErrorForUnknownAnnotateTarget?: boolean
     /**
      * Dictionary of beta flag names.  This option allows fine-grained control
      * over which beta features should be enabled.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "6.9.2",
+  "version": "6.9.3",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",