@sap/cds-dk 10.0.3 → 10.0.5

package/CHANGELOG.md

@@ -6,6 +6,34 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 10.0.5 - 2026-07-16
+
+### Fixed
+
+- `cds add typer` now generates a `jsconfig.json` file that works with VS Code.
+- `cds debug <app> --force` on Kyma now preserves existing `NODE_OPTIONS` flags (e.g. `--max-old-space-size`) instead of overwriting them when enabling the inspector.
+- `cds add sample` now selects `stock` in the Books list and object pages, so the overstock discount shows up in the UI.
+- `cds add data` now generates correct foreign-key columns for nested compositions of aspects, e.g. `up__up__ID,up__ID,ID,name` instead of a broken `up__up_` header.
+- `cds build` no longer fails with `npm ls -ws: unknown option` on npm 12, which dropped the short `-ws` flag.
+- `cds build` now packages transitive npm workspace dependencies again on npm 12, which changed `npm pack --json` to emit an object keyed by package name instead of an array.
+- `cds up` uses `helm --rollback-on-failure` instead of the deprecated `--atomic`.
+- `cds add portal` on Java + IAS disables JWT proof-of-possession on `srv` (`SAP_SPRING_SECURITY_IDENTITY_PROOFTOKEN=false`) so Portal-proxied tile OData works.
+- `cds add ias` forwards client certificates from the approuter to `srv-api` (`backendDestinations.srv-api.forwardAuthCertificates`).
+- `cds add ias` always enables `xsuaa-cross-consumption` in the identity service parameters.
+- `cds add ias` no longer sets an mTLS `expose.host` on the approuter, restoring a plain approuter host for the browser flow.
+- `cds add portal` on Java multitenant now binds the Portal service instance to `srv` so CAP Java's `getDependencies` reports Portal to the SaaS Registry.
+- `cds add kyma` uses a tenant-agnostic (tcpSocket) startup probe for the multitenant approuter, avoiding 400s from `TENANT_HOST_PATTERN` on kubelet probes.
+- `cds add kyma` no longer emits the dead `Authentication: OAuth2UserTokenExchange` key on `backendDestinations.srv-api`.
+- `cds add github-actions` uses updated versions.
+- `cds watch` now works in ESM scenarios where only a global `cds-dk` is installed, where it would formerly fail with `ERR_MODULE_NOT_FOUND` for `@sap/cds`.
+- `cds watch`no longer shows a `'server.hmr.protocol/host/port/path/clientPort/timeout/server' is deprecated` warning when running a Vite application.
+
+## Version 10.0.4 - 2026-07-08
+
+### Fixed
+
+- `cds watch` now starts apps with a SQLite database again in cases where they don't have a `@cap-js/sqlite` dependency or a `package.json`.
+
 ## Version 10.0.3 - 2026-07-02
 
 ### Fixed

package/bin/debug.js

@@ -101,7 +101,11 @@ async function debug() {
 
     if (force) {
       console.log(`\nEnabling Node inspector on deployment/${appName} at 0.0.0.0:${portLocal} ...`)
-      _execSyncSafe(`kubectl ${ns} set env deployment/${appName} NODE_OPTIONS="--inspect=0.0.0.0:${portLocal}"`, { stdio: 'inherit' })
+      const existingOpts = _execSyncSafe(`kubectl ${ns} get deploy ${appName} -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='NODE_OPTIONS')].value}"`)
+      const inspectFlag = `--inspect=0.0.0.0:${portLocal}`
+      const stripped = existingOpts ? existingOpts.replace(/--inspect(-brk)?(=\S+)?\s*/g, '').trim() : ''
+      const newOpts = stripped ? `${stripped} ${inspectFlag}` : inspectFlag
+      _execSyncSafe(`kubectl ${ns} set env deployment/${appName} NODE_OPTIONS="${newOpts.replace(/"/g, '\\"')}"`, { stdio: 'inherit' })
       _execSyncSafe(`kubectl ${ns} rollout restart deployment/${appName}`, { stdio: 'inherit' })
       k(`rollout status deployment/${appName} --timeout=180s`, { stdio: 'inherit' })
     } else {
@@ -281,7 +285,7 @@ async function debug() {
       return _execSync(...args)
     } catch { /* ignore */ }
   }
-  function _execSync(cmd, options={ encoding: 'utf-8', shell: true }) {
+  function _execSync(cmd, options={ encoding: 'utf-8', shell: true, maxBuffer: 10 * 1024 * 1024 }) {
     try {
       return execSync(cmd, options)?.trim()
     } catch (err) {

package/bin/up.js

@@ -346,7 +346,7 @@ async function up() {
       }
     })
 
-    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --atomic --wait --wait-for-jobs --timeout=10m`
+    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --rollback-on-failure --wait --wait-for-jobs --timeout=20m`
     if (hasXsuaa) helmArgs.push(' --set-file xsuaa.jsonParameters=xs-security.json')
     if (helmArgs.length > 0) helmUpgrade += ` ${helmArgs.join(' ')}`
     run(helmUpgrade)

package/bin/watch.js

@@ -148,6 +148,7 @@ async function watch ([cwd], {
   // if sap/cds is not installed locally, run with cds-dk's deps. (sap/cds, sqlite etc)
   if (!installed('@sap/cds', cwd)) {
     env.NODE_PATH = [...paths(cwd), ...paths(__dirname)].join(delimiter)
+    env.NODE_OPTIONS = [env.NODE_OPTIONS, `--import ${require.resolve('../lib/watch/esm-resolve-registration.js')}`].filter(Boolean).join(' ')
   }
 
   const delay = parseInt(process.env.CDS_WATCH_DELAY) || 200

package/lib/build/plugins/helm/files/templates/_deployment_helpers.tpl

@@ -88,6 +88,8 @@ Backend Destinations
     {{- end -}}
     {{- $currentDestination := dict $nameKey $destination.name $urlKey (print  $protocol "://" $destinationHost ) -}}
     {{- $currentDestination := merge $currentDestination $.defaultParameters -}}
+    {{- $extras := omit $destination "name" "service" "external" -}}
+    {{- $currentDestination := merge $extras $currentDestination -}}
     {{- $destinations = (append $destinations $currentDestination) -}}
 {{- end -}}
 {{- $destinations | toJson }}

package/lib/build/plugins/nodejs/index.js

@@ -296,14 +296,17 @@ module.exports = class NodejsBuildPlugin extends require('../edmx') {
      * @param {import('fs').PathLike} dest - destination folder
      * @param {import('fs').PathLike} wsRoot - workspace root folder
      * @param {string[]} workspaces - list of workspace names
-     * @returns {Promise<JSON>} - returns a promise that resolves to the result of the command
+     * @returns {Promise<object[]>} - array of pack descriptors ({ name, filename, ... })
      * @private
      */
     static async _execNpmPack(dest, wsRoot, workspaces) {
-        const args = ['pack', '-ws', '--json', `--pack-destination=${dest}`]
+        const args = ['pack', '--ws', '--json', `--pack-destination=${dest}`]
         workspaces.forEach(w => args.push(`-w=${w}`))
         const result = await cmd.spawnCommand('npm', args, { cwd: wsRoot }, true, !!LOG._debug)
         DEBUG?.(result)
-        return JSON.parse(result)
+        const parsed = JSON.parse(result)
+        // `npm pack --json` returns an array up to npm 11, but an object keyed by
+        // package name as of npm 12 — normalize to an array of descriptors.
+        return Array.isArray(parsed) ? parsed : Object.values(parsed)
     }
 }

package/lib/build/util.js

@@ -300,7 +300,7 @@ async function _execNpmWs(wsRoot) {
     /** @type {string[]} */
     let result = []
     try {
-        const cmdLine = 'npm ls -ws --json'
+        const cmdLine = 'npm ls --ws --json'
         DEBUG?.(`execute ${cmdLine}`)
         // @ts-expect-error - TODO: shell should be a string. But can probably be removed altogether?
         const { stdout } = await execAsync(cmdLine, { shell: IS_WIN, stdio: ['inherit', 'pipe', 'inherit'], cwd: wsRoot })

package/lib/init/template/ams/files/containerize.yaml.hbs

@@ -17,4 +17,5 @@ modules:
         {{/isJava}}
         env:
           BP_NODE_RUN_SCRIPTS: ""
+          BP_NODE_VERSION: "24"
 

package/lib/init/template/approuter/files/values.yaml.hbs

@@ -16,11 +16,20 @@ approuter:
       ephemeral-storage: 1G
       cpu: 500m
       memory: 500M
+{{^hasMultitenancy}}
   health:
     liveness:
       path: /
     readiness:
       path: /
+{{/hasMultitenancy}}
+{{#hasMultitenancy}}
+  health:
+    liveness:
+      path: ""
+    readiness:
+      path: ""
+{{/hasMultitenancy}}
 {{=<% %>=}}
   envFrom:
     - configMapRef:
@@ -29,7 +38,6 @@ approuter:
 backendDestinations:
   srv-api:
     service: srv
-    Authentication: OAuth2UserTokenExchange
   {{#hasMultitenancy}}
   mtx-api:
     service: {{#isJava}}srv{{/isJava}}{{^isJava}}sidecar{{/isJava}}

package/lib/init/template/data/as-csv.js

@@ -37,10 +37,12 @@ module.exports = async (data={}, csn, { headerOnly=false, separator=',' }={}) =>
             if (element.on) {
               continue // skip unmanaged associations with explicit on condition
             }
+            // flatten nested foreign keys (composite keys of nested aspects) into up__up__ID columns
+            const {headers: fkHeaders, records: fkRecords} = resolveStruct(value, name)
             if (i === 0) {
-              header.push(...Object.keys(value).map(foreignKey => name + '_' + foreignKey))
+              header.push(...fkHeaders)
             }
-            record.push(...Object.values(value))
+            record.push(...fkRecords)
           }
           else if (element.is_struct && element.type !== 'cds.Map') {
             const {headers: structHeaders, records: structRecords} = resolveStruct(value, name);

package/lib/init/template/data/as-json.js

@@ -257,7 +257,10 @@ function dataForField(element, artifact, csn, record, data, parent, depth, refer
 
       const [ownKey, ownKeyStructured, targetKey] = findKeysInOnCondition(element, target)
       if (ownKey && targetKey) {
-        const value = ownKeyStructured ? { [ownKey]: record[ownKey] } : record[ownKey]
+        // carry over all parent keys, not just the first, so composite/nested keys survive
+        const value = ownKeyStructured
+          ? Object.fromEntries(Object.keys(artifact.keys).map(k => [k, record[k]]))
+          : record[ownKey]
         targetRecords.forEach(targetRecord => {
           // Set parent in target as non-enumerable. Json serialization doesn't need it, but csv does.
           Object.defineProperty(targetRecord, targetKey, { value, enumerable: false })

package/lib/init/template/github-actions/files/workflows/cf.yaml.hbs

@@ -44,13 +44,13 @@ jobs:
           echo "${PWD}/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
       {{/sap}}
       {{/isJava}}
-      - uses: cap-js/cf-setup@v1
+      - uses: cap-js/cf-setup@v2
         with:
-          cf-api: {{#literal}}${{ vars.CF_API }}{{/literal}}
-          cf-org: {{#literal}}${{ vars.CF_ORG }}{{/literal}}
-          cf-space: {{#literal}}${{ vars.CF_SPACE }}{{/literal}}
-          cf-username: {{#literal}}${{ vars.CF_USERNAME }}{{/literal}}
-          cf-password: {{#literal}}${{ secrets.CF_PASSWORD }}{{/literal}}
+          api: {{#literal}}${{ vars.CF_API }}{{/literal}}
+          org: {{#literal}}${{ vars.CF_ORG }}{{/literal}}
+          space: {{#literal}}${{ vars.CF_SPACE }}{{/literal}}
+          username: {{#literal}}${{ vars.CF_USERNAME }}{{/literal}}
+          password: {{#literal}}${{ secrets.CF_PASSWORD }}{{/literal}}
       - run: npm install
       - run: npx cds up
 

package/lib/init/template/ias/files/values.yaml.hbs

@@ -13,14 +13,16 @@ sidecar:
 {{#hasApprouter}}
 approuter:
   expose:
-    gateway: {{#literal}}"{{ .Release.Namespace }}/kyma-mtls-gateway"{{/literal}}
-    host: {{#literal}}"{{ .Release.Name }}-approuter-{{ .Release.Namespace }}.cert"{{/literal}}
+    host: {{#literal}}"{{ .Release.Name }}-approuter-{{ .Release.Namespace }}"{{/literal}}
   bindings:
     auth:
       serviceInstanceName: identity
       parameters:
         credential-type: X509_GENERATED
         app-identifier: approuter
+backendDestinations:
+  srv-api:
+    forwardAuthCertificates: true
 {{/hasApprouter}}
 srv:
   expose:
@@ -41,9 +43,7 @@ identity:
     {{#hasMultitenancy}}
     multi-tenant: true
     {{/hasMultitenancy}}
-    {{#hasXsuaa}}
     xsuaa-cross-consumption: true
-    {{/hasXsuaa}}
     provided-apis:
       - name: {{appName}}-ias-api
         description: API exposed by the application

package/lib/init/template/portal/files/values.yaml.hbs

@@ -6,9 +6,21 @@ approuter:
 portal:
     serviceOfferingName: portal
     servicePlanName: standard
+{{#isJava}}{{#hasIas}}
+srv:
+  env:
+    # Portal Service proxies tile OData without forwarding the client cert.
+    SAP_SPRING_SECURITY_IDENTITY_PROOFTOKEN: "false"
+{{/hasIas}}{{/isJava}}
 {{#hasMultitenancy}}
 sidecar:
   bindings:
     portal:
       serviceInstanceName: portal
+{{#isJava}}
+srv:
+  bindings:
+    portal:
+      serviceInstanceName: portal
+{{/isJava}}
 {{/hasMultitenancy}}

package/lib/init/template/sample/files/app/browse/fiori-service.cds

@@ -27,6 +27,7 @@ annotate CatalogService.Books with @(UI : {
       Value : currency.symbol,
       Label : '{i18n>Currency}'
     },
+    {Value : stock},
   ]},
 });
 
@@ -53,5 +54,6 @@ annotate CatalogService.Books with @(UI : {
     {Value : genre.name},
     {Value : price},
     {Value : currency.symbol},
+    {Value : stock},
   ]
 });

package/lib/init/template/typer/files/xsconfig.json

@@ -1,6 +1,6 @@
 {
   "compilerOptions": {
-    "moduleResolution": "nodenext",
+    "module": "NodeNext",
     "paths": {
       "#cds-models/*": ["./@cds-models/*"],
       "@sap/cds": ["./node_modules/@cap-js/cds-types"]

package/lib/init/template/typescript/files/package.json

@@ -3,6 +3,6 @@
     "@cap-js/cds-types": "^0.18.0",
     "@types/node": "^24.0.0",
     "tsx": "^4",
-    "typescript": "^6.0.0"
+    "typescript": "^7.0.0"
   }
 }

package/lib/lint/eslintHelp.json

@@ -1,5 +1,5 @@
 {
-  "version": "10.6.0",
+  "version": "10.7.0",
   "help": "\n# SYNOPSIS\n\n    *cds lint* [options] file.js [file.js] [dir]\n\n    Runs environment checks and/or checks the specified models\n    based on the ESLint framework\n\n# OPTIONS\n    \n    Basic configuration:\n      --no-config-lookup               Disable look up for eslint.config.js\n      -c, --config path::String        Use this configuration instead of eslint.config.js, eslint.config.mjs, or eslint.config.cjs\n      --inspect-config                 Open the config inspector with the current configuration\n      --ext [String]                   Specify additional file extensions to lint\n      --global [String]                Define global variables\n      --parser String                  Specify the parser to be used\n      --parser-options Object          Specify parser options\n    \n    Specify Rules and Plugins:\n      --plugin [String]                Specify plugins\n      --rule Object                    Specify rules\n    \n    Fix Problems:\n      --fix                            Automatically fix problems\n      --fix-dry-run                    Automatically fix problems without saving the changes to the file system\n      --fix-type Array                 Specify the types of fixes to apply (directive, problem, suggestion, layout)\n    \n    Ignore Files:\n      --no-ignore                      Disable use of ignore files and patterns\n      --ignore-pattern [String]        Patterns of files to ignore\n    \n    Use stdin:\n      --stdin                          Lint code provided on <STDIN> - default: false\n      --stdin-filename String          Specify filename to process STDIN as\n    \n    Handle Warnings:\n      --quiet                          Report errors only - default: false\n      --max-warnings Int               Number of warnings to trigger nonzero exit code - default: -1\n    \n    Output:\n      -o, --output-file path::String   Specify file to write report to\n      -f, --format String              Use a specific output format - default: stylish\n      --color, --no-color              Force enabling/disabling of color\n    \n    Inline configuration comments:\n      --no-inline-config               Prevent comments from changing config or rules\n      --report-unused-disable-directives  Adds reported errors for unused eslint-disable and eslint-enable directives\n      --report-unused-disable-directives-severity String  Chooses severity level for reporting unused eslint-disable and eslint-enable directives - either: off, warn, error, 0, 1, or 2\n      --report-unused-inline-configs String  Adds reported errors for unused eslint inline config comments - either: off, warn, error, 0, 1, or 2\n    \n    Caching:\n      --cache                          Only check changed files - default: false\n      --cache-file path::String        Path to the cache file. Deprecated: use --cache-location - default: .eslintcache\n      --cache-location path::String    Path to the cache file or directory\n      --cache-strategy String          Strategy to use for detecting changed files in the cache - either: metadata or content - default: metadata\n    \n    Suppressing Violations:\n      --suppress-all                   Suppress all violations - default: false\n      --suppress-rule [String]         Suppress specific rules\n      --suppressions-location path::String  Specify the location of the suppressions file\n      --prune-suppressions             Prune unused suppressions - default: false\n      --pass-on-unpruned-suppressions  Ignore unused suppressions - default: false\n    \n    Miscellaneous:\n      --init                           Run config initialization wizard - default: false\n      --env-info                       Output execution environment information - default: false\n      --no-error-on-unmatched-pattern  Prevent errors when pattern is unmatched\n      --exit-on-fatal-error            Exit with exit code 2 in case of fatal error - default: false\n      --no-warn-ignored                Suppress warnings when the file list includes ignored files\n      --pass-on-no-patterns            Exit with exit code 0 in case no file patterns are passed\n      --debug                          Output debugging information\n      -h, --help                       Show help\n      -v, --version                    Output the version number\n      --print-config path::String      Print the configuration for the given file\n      --stats                          Add statistics to the lint report - default: false\n      --flag [String]                  Enable a feature flag\n      --mcp                            Start the ESLint MCP server\n      --concurrency Int|String         Number of linting threads, auto to choose automatically, off for no multithreading - default: off\n    \n",
   "options": [
     "--config",

package/lib/watch/esm-resolve-registration.js

@@ -0,0 +1,27 @@
+// we want to allow starting projects with having nothing but a global cds-dk installed in a watched context.
+// In that case, we want to fall back to resolving internal packages from the global cds-dk's own node_modules.
+// Enriching NODE_PATH can be used in CJS (require(...)), but not in ESM (import ... from and import(...)),
+// which requires a custom loader instead.
+// https://nodejs.org/api/esm.html#no-node_path
+const { createRequire, registerHooks } = require('node:module')
+const { pathToFileURL } = require('node:url')
+
+const ourModules = new Set(['@sap/cds'])
+
+const requireFromHere = createRequire(__filename)
+const resolveFromHere = url => pathToFileURL(requireFromHere.resolve(url)).href
+
+registerHooks({
+    resolve(specifier, context, nextResolve) {
+        try {
+            // use default Node resolver first.
+            // Note: registering more hooks is UB!
+            return nextResolve(specifier, context)
+        } catch (error) {
+            if (error.code === 'ERR_MODULE_NOT_FOUND' && ourModules.has(specifier)) {
+                return { url: resolveFromHere(specifier), shortCircuit: true }
+            }
+            throw error
+        }
+    }
+})

package/lib/watch/vite-watch.js

@@ -79,7 +79,7 @@ cds.on('bootstrap', app => {
 
     for (const viteApp of viteApps) {
       const base = viteApp.root ? '/' : normalizeBase(viteApp.name)
-      const server = await createServer({ base, root: viteApp.path, server: { middlewareMode: true, hmr: { port: hmrPort++ } }})
+      const server = await createServer({ base, root: viteApp.path, server: { middlewareMode: true, ws: { port: hmrPort++ } }})
       viteServers.push({ base, root: viteApp.root, middlewares: server.middlewares })
     }