@sap/cds-dk 10.0.4 → 10.0.5

package/CHANGELOG.md

@@ -6,6 +6,28 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 10.0.5 - 2026-07-16
+
+### Fixed
+
+- `cds add typer` now generates a `jsconfig.json` file that works with VS Code.
+- `cds debug <app> --force` on Kyma now preserves existing `NODE_OPTIONS` flags (e.g. `--max-old-space-size`) instead of overwriting them when enabling the inspector.
+- `cds add sample` now selects `stock` in the Books list and object pages, so the overstock discount shows up in the UI.
+- `cds add data` now generates correct foreign-key columns for nested compositions of aspects, e.g. `up__up__ID,up__ID,ID,name` instead of a broken `up__up_` header.
+- `cds build` no longer fails with `npm ls -ws: unknown option` on npm 12, which dropped the short `-ws` flag.
+- `cds build` now packages transitive npm workspace dependencies again on npm 12, which changed `npm pack --json` to emit an object keyed by package name instead of an array.
+- `cds up` uses `helm --rollback-on-failure` instead of the deprecated `--atomic`.
+- `cds add portal` on Java + IAS disables JWT proof-of-possession on `srv` (`SAP_SPRING_SECURITY_IDENTITY_PROOFTOKEN=false`) so Portal-proxied tile OData works.
+- `cds add ias` forwards client certificates from the approuter to `srv-api` (`backendDestinations.srv-api.forwardAuthCertificates`).
+- `cds add ias` always enables `xsuaa-cross-consumption` in the identity service parameters.
+- `cds add ias` no longer sets an mTLS `expose.host` on the approuter, restoring a plain approuter host for the browser flow.
+- `cds add portal` on Java multitenant now binds the Portal service instance to `srv` so CAP Java's `getDependencies` reports Portal to the SaaS Registry.
+- `cds add kyma` uses a tenant-agnostic (tcpSocket) startup probe for the multitenant approuter, avoiding 400s from `TENANT_HOST_PATTERN` on kubelet probes.
+- `cds add kyma` no longer emits the dead `Authentication: OAuth2UserTokenExchange` key on `backendDestinations.srv-api`.
+- `cds add github-actions` uses updated versions.
+- `cds watch` now works in ESM scenarios where only a global `cds-dk` is installed, where it would formerly fail with `ERR_MODULE_NOT_FOUND` for `@sap/cds`.
+- `cds watch`no longer shows a `'server.hmr.protocol/host/port/path/clientPort/timeout/server' is deprecated` warning when running a Vite application.
+
 ## Version 10.0.4 - 2026-07-08
 
 ### Fixed

package/bin/debug.js

@@ -101,7 +101,11 @@ async function debug() {
 
     if (force) {
       console.log(`\nEnabling Node inspector on deployment/${appName} at 0.0.0.0:${portLocal} ...`)
-      _execSyncSafe(`kubectl ${ns} set env deployment/${appName} NODE_OPTIONS="--inspect=0.0.0.0:${portLocal}"`, { stdio: 'inherit' })
+      const existingOpts = _execSyncSafe(`kubectl ${ns} get deploy ${appName} -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='NODE_OPTIONS')].value}"`)
+      const inspectFlag = `--inspect=0.0.0.0:${portLocal}`
+      const stripped = existingOpts ? existingOpts.replace(/--inspect(-brk)?(=\S+)?\s*/g, '').trim() : ''
+      const newOpts = stripped ? `${stripped} ${inspectFlag}` : inspectFlag
+      _execSyncSafe(`kubectl ${ns} set env deployment/${appName} NODE_OPTIONS="${newOpts.replace(/"/g, '\\"')}"`, { stdio: 'inherit' })
       _execSyncSafe(`kubectl ${ns} rollout restart deployment/${appName}`, { stdio: 'inherit' })
       k(`rollout status deployment/${appName} --timeout=180s`, { stdio: 'inherit' })
     } else {
@@ -281,7 +285,7 @@ async function debug() {
       return _execSync(...args)
     } catch { /* ignore */ }
   }
-  function _execSync(cmd, options={ encoding: 'utf-8', shell: true }) {
+  function _execSync(cmd, options={ encoding: 'utf-8', shell: true, maxBuffer: 10 * 1024 * 1024 }) {
     try {
       return execSync(cmd, options)?.trim()
     } catch (err) {

package/bin/up.js

@@ -346,7 +346,7 @@ async function up() {
       }
     })
 
-    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --atomic --wait --wait-for-jobs --timeout=10m`
+    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --rollback-on-failure --wait --wait-for-jobs --timeout=20m`
     if (hasXsuaa) helmArgs.push(' --set-file xsuaa.jsonParameters=xs-security.json')
     if (helmArgs.length > 0) helmUpgrade += ` ${helmArgs.join(' ')}`
     run(helmUpgrade)

package/bin/watch.js

@@ -148,6 +148,7 @@ async function watch ([cwd], {
   // if sap/cds is not installed locally, run with cds-dk's deps. (sap/cds, sqlite etc)
   if (!installed('@sap/cds', cwd)) {
     env.NODE_PATH = [...paths(cwd), ...paths(__dirname)].join(delimiter)
+    env.NODE_OPTIONS = [env.NODE_OPTIONS, `--import ${require.resolve('../lib/watch/esm-resolve-registration.js')}`].filter(Boolean).join(' ')
   }
 
   const delay = parseInt(process.env.CDS_WATCH_DELAY) || 200

package/lib/build/plugins/helm/files/templates/_deployment_helpers.tpl

@@ -88,6 +88,8 @@ Backend Destinations
     {{- end -}}
     {{- $currentDestination := dict $nameKey $destination.name $urlKey (print  $protocol "://" $destinationHost ) -}}
     {{- $currentDestination := merge $currentDestination $.defaultParameters -}}
+    {{- $extras := omit $destination "name" "service" "external" -}}
+    {{- $currentDestination := merge $extras $currentDestination -}}
     {{- $destinations = (append $destinations $currentDestination) -}}
 {{- end -}}
 {{- $destinations | toJson }}

package/lib/build/plugins/nodejs/index.js

@@ -296,14 +296,17 @@ module.exports = class NodejsBuildPlugin extends require('../edmx') {
      * @param {import('fs').PathLike} dest - destination folder
      * @param {import('fs').PathLike} wsRoot - workspace root folder
      * @param {string[]} workspaces - list of workspace names
-     * @returns {Promise<JSON>} - returns a promise that resolves to the result of the command
+     * @returns {Promise<object[]>} - array of pack descriptors ({ name, filename, ... })
      * @private
      */
     static async _execNpmPack(dest, wsRoot, workspaces) {
-        const args = ['pack', '-ws', '--json', `--pack-destination=${dest}`]
+        const args = ['pack', '--ws', '--json', `--pack-destination=${dest}`]
         workspaces.forEach(w => args.push(`-w=${w}`))
         const result = await cmd.spawnCommand('npm', args, { cwd: wsRoot }, true, !!LOG._debug)
         DEBUG?.(result)
-        return JSON.parse(result)
+        const parsed = JSON.parse(result)
+        // `npm pack --json` returns an array up to npm 11, but an object keyed by
+        // package name as of npm 12 — normalize to an array of descriptors.
+        return Array.isArray(parsed) ? parsed : Object.values(parsed)
     }
 }

package/lib/build/util.js

@@ -300,7 +300,7 @@ async function _execNpmWs(wsRoot) {
     /** @type {string[]} */
     let result = []
     try {
-        const cmdLine = 'npm ls -ws --json'
+        const cmdLine = 'npm ls --ws --json'
         DEBUG?.(`execute ${cmdLine}`)
         // @ts-expect-error - TODO: shell should be a string. But can probably be removed altogether?
         const { stdout } = await execAsync(cmdLine, { shell: IS_WIN, stdio: ['inherit', 'pipe', 'inherit'], cwd: wsRoot })

package/lib/init/template/ams/files/containerize.yaml.hbs

@@ -17,4 +17,5 @@ modules:
         {{/isJava}}
         env:
           BP_NODE_RUN_SCRIPTS: ""
+          BP_NODE_VERSION: "24"
 

package/lib/init/template/approuter/files/values.yaml.hbs

@@ -16,11 +16,20 @@ approuter:
       ephemeral-storage: 1G
       cpu: 500m
       memory: 500M
+{{^hasMultitenancy}}
   health:
     liveness:
       path: /
     readiness:
       path: /
+{{/hasMultitenancy}}
+{{#hasMultitenancy}}
+  health:
+    liveness:
+      path: ""
+    readiness:
+      path: ""
+{{/hasMultitenancy}}
 {{=<% %>=}}
   envFrom:
     - configMapRef:
@@ -29,7 +38,6 @@ approuter:
 backendDestinations:
   srv-api:
     service: srv
-    Authentication: OAuth2UserTokenExchange
   {{#hasMultitenancy}}
   mtx-api:
     service: {{#isJava}}srv{{/isJava}}{{^isJava}}sidecar{{/isJava}}

package/lib/init/template/data/as-csv.js

@@ -37,10 +37,12 @@ module.exports = async (data={}, csn, { headerOnly=false, separator=',' }={}) =>
             if (element.on) {
               continue // skip unmanaged associations with explicit on condition
             }
+            // flatten nested foreign keys (composite keys of nested aspects) into up__up__ID columns
+            const {headers: fkHeaders, records: fkRecords} = resolveStruct(value, name)
             if (i === 0) {
-              header.push(...Object.keys(value).map(foreignKey => name + '_' + foreignKey))
+              header.push(...fkHeaders)
             }
-            record.push(...Object.values(value))
+            record.push(...fkRecords)
           }
           else if (element.is_struct && element.type !== 'cds.Map') {
             const {headers: structHeaders, records: structRecords} = resolveStruct(value, name);

package/lib/init/template/data/as-json.js

@@ -257,7 +257,10 @@ function dataForField(element, artifact, csn, record, data, parent, depth, refer
 
       const [ownKey, ownKeyStructured, targetKey] = findKeysInOnCondition(element, target)
       if (ownKey && targetKey) {
-        const value = ownKeyStructured ? { [ownKey]: record[ownKey] } : record[ownKey]
+        // carry over all parent keys, not just the first, so composite/nested keys survive
+        const value = ownKeyStructured
+          ? Object.fromEntries(Object.keys(artifact.keys).map(k => [k, record[k]]))
+          : record[ownKey]
         targetRecords.forEach(targetRecord => {
           // Set parent in target as non-enumerable. Json serialization doesn't need it, but csv does.
           Object.defineProperty(targetRecord, targetKey, { value, enumerable: false })

package/lib/init/template/github-actions/files/workflows/cf.yaml.hbs

@@ -44,13 +44,13 @@ jobs:
           echo "${PWD}/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
       {{/sap}}
       {{/isJava}}
-      - uses: cap-js/cf-setup@v1
+      - uses: cap-js/cf-setup@v2
         with:
-          cf-api: {{#literal}}${{ vars.CF_API }}{{/literal}}
-          cf-org: {{#literal}}${{ vars.CF_ORG }}{{/literal}}
-          cf-space: {{#literal}}${{ vars.CF_SPACE }}{{/literal}}
-          cf-username: {{#literal}}${{ vars.CF_USERNAME }}{{/literal}}
-          cf-password: {{#literal}}${{ secrets.CF_PASSWORD }}{{/literal}}
+          api: {{#literal}}${{ vars.CF_API }}{{/literal}}
+          org: {{#literal}}${{ vars.CF_ORG }}{{/literal}}
+          space: {{#literal}}${{ vars.CF_SPACE }}{{/literal}}
+          username: {{#literal}}${{ vars.CF_USERNAME }}{{/literal}}
+          password: {{#literal}}${{ secrets.CF_PASSWORD }}{{/literal}}
       - run: npm install
       - run: npx cds up
 

package/lib/init/template/ias/files/values.yaml.hbs

@@ -13,14 +13,16 @@ sidecar:
 {{#hasApprouter}}
 approuter:
   expose:
-    gateway: {{#literal}}"{{ .Release.Namespace }}/kyma-mtls-gateway"{{/literal}}
-    host: {{#literal}}"{{ .Release.Name }}-approuter-{{ .Release.Namespace }}.cert"{{/literal}}
+    host: {{#literal}}"{{ .Release.Name }}-approuter-{{ .Release.Namespace }}"{{/literal}}
   bindings:
     auth:
       serviceInstanceName: identity
       parameters:
         credential-type: X509_GENERATED
         app-identifier: approuter
+backendDestinations:
+  srv-api:
+    forwardAuthCertificates: true
 {{/hasApprouter}}
 srv:
   expose:
@@ -41,9 +43,7 @@ identity:
     {{#hasMultitenancy}}
     multi-tenant: true
     {{/hasMultitenancy}}
-    {{#hasXsuaa}}
     xsuaa-cross-consumption: true
-    {{/hasXsuaa}}
     provided-apis:
       - name: {{appName}}-ias-api
         description: API exposed by the application

package/lib/init/template/portal/files/values.yaml.hbs

@@ -6,9 +6,21 @@ approuter:
 portal:
     serviceOfferingName: portal
     servicePlanName: standard
+{{#isJava}}{{#hasIas}}
+srv:
+  env:
+    # Portal Service proxies tile OData without forwarding the client cert.
+    SAP_SPRING_SECURITY_IDENTITY_PROOFTOKEN: "false"
+{{/hasIas}}{{/isJava}}
 {{#hasMultitenancy}}
 sidecar:
   bindings:
     portal:
       serviceInstanceName: portal
+{{#isJava}}
+srv:
+  bindings:
+    portal:
+      serviceInstanceName: portal
+{{/isJava}}
 {{/hasMultitenancy}}

package/lib/init/template/sample/files/app/browse/fiori-service.cds

@@ -27,6 +27,7 @@ annotate CatalogService.Books with @(UI : {
       Value : currency.symbol,
       Label : '{i18n>Currency}'
     },
+    {Value : stock},
   ]},
 });
 
@@ -53,5 +54,6 @@ annotate CatalogService.Books with @(UI : {
     {Value : genre.name},
     {Value : price},
     {Value : currency.symbol},
+    {Value : stock},
   ]
 });

package/lib/init/template/typer/files/xsconfig.json

@@ -1,6 +1,6 @@
 {
   "compilerOptions": {
-    "moduleResolution": "nodenext",
+    "module": "NodeNext",
     "paths": {
       "#cds-models/*": ["./@cds-models/*"],
       "@sap/cds": ["./node_modules/@cap-js/cds-types"]

package/lib/init/template/typescript/files/package.json

@@ -3,6 +3,6 @@
     "@cap-js/cds-types": "^0.18.0",
     "@types/node": "^24.0.0",
     "tsx": "^4",
-    "typescript": "^6.0.0"
+    "typescript": "^7.0.0"
   }
 }

package/lib/lint/eslintHelp.json

@@ -1,5 +1,5 @@
 {
-  "version": "10.6.0",
+  "version": "10.7.0",
   "help": "\n# SYNOPSIS\n\n    *cds lint* [options] file.js [file.js] [dir]\n\n    Runs environment checks and/or checks the specified models\n    based on the ESLint framework\n\n# OPTIONS\n    \n    Basic configuration:\n      --no-config-lookup               Disable look up for eslint.config.js\n      -c, --config path::String        Use this configuration instead of eslint.config.js, eslint.config.mjs, or eslint.config.cjs\n      --inspect-config                 Open the config inspector with the current configuration\n      --ext [String]                   Specify additional file extensions to lint\n      --global [String]                Define global variables\n      --parser String                  Specify the parser to be used\n      --parser-options Object          Specify parser options\n    \n    Specify Rules and Plugins:\n      --plugin [String]                Specify plugins\n      --rule Object                    Specify rules\n    \n    Fix Problems:\n      --fix                            Automatically fix problems\n      --fix-dry-run                    Automatically fix problems without saving the changes to the file system\n      --fix-type Array                 Specify the types of fixes to apply (directive, problem, suggestion, layout)\n    \n    Ignore Files:\n      --no-ignore                      Disable use of ignore files and patterns\n      --ignore-pattern [String]        Patterns of files to ignore\n    \n    Use stdin:\n      --stdin                          Lint code provided on <STDIN> - default: false\n      --stdin-filename String          Specify filename to process STDIN as\n    \n    Handle Warnings:\n      --quiet                          Report errors only - default: false\n      --max-warnings Int               Number of warnings to trigger nonzero exit code - default: -1\n    \n    Output:\n      -o, --output-file path::String   Specify file to write report to\n      -f, --format String              Use a specific output format - default: stylish\n      --color, --no-color              Force enabling/disabling of color\n    \n    Inline configuration comments:\n      --no-inline-config               Prevent comments from changing config or rules\n      --report-unused-disable-directives  Adds reported errors for unused eslint-disable and eslint-enable directives\n      --report-unused-disable-directives-severity String  Chooses severity level for reporting unused eslint-disable and eslint-enable directives - either: off, warn, error, 0, 1, or 2\n      --report-unused-inline-configs String  Adds reported errors for unused eslint inline config comments - either: off, warn, error, 0, 1, or 2\n    \n    Caching:\n      --cache                          Only check changed files - default: false\n      --cache-file path::String        Path to the cache file. Deprecated: use --cache-location - default: .eslintcache\n      --cache-location path::String    Path to the cache file or directory\n      --cache-strategy String          Strategy to use for detecting changed files in the cache - either: metadata or content - default: metadata\n    \n    Suppressing Violations:\n      --suppress-all                   Suppress all violations - default: false\n      --suppress-rule [String]         Suppress specific rules\n      --suppressions-location path::String  Specify the location of the suppressions file\n      --prune-suppressions             Prune unused suppressions - default: false\n      --pass-on-unpruned-suppressions  Ignore unused suppressions - default: false\n    \n    Miscellaneous:\n      --init                           Run config initialization wizard - default: false\n      --env-info                       Output execution environment information - default: false\n      --no-error-on-unmatched-pattern  Prevent errors when pattern is unmatched\n      --exit-on-fatal-error            Exit with exit code 2 in case of fatal error - default: false\n      --no-warn-ignored                Suppress warnings when the file list includes ignored files\n      --pass-on-no-patterns            Exit with exit code 0 in case no file patterns are passed\n      --debug                          Output debugging information\n      -h, --help                       Show help\n      -v, --version                    Output the version number\n      --print-config path::String      Print the configuration for the given file\n      --stats                          Add statistics to the lint report - default: false\n      --flag [String]                  Enable a feature flag\n      --mcp                            Start the ESLint MCP server\n      --concurrency Int|String         Number of linting threads, auto to choose automatically, off for no multithreading - default: off\n    \n",
   "options": [
     "--config",

package/lib/watch/esm-resolve-registration.js

@@ -0,0 +1,27 @@
+// we want to allow starting projects with having nothing but a global cds-dk installed in a watched context.
+// In that case, we want to fall back to resolving internal packages from the global cds-dk's own node_modules.
+// Enriching NODE_PATH can be used in CJS (require(...)), but not in ESM (import ... from and import(...)),
+// which requires a custom loader instead.
+// https://nodejs.org/api/esm.html#no-node_path
+const { createRequire, registerHooks } = require('node:module')
+const { pathToFileURL } = require('node:url')
+
+const ourModules = new Set(['@sap/cds'])
+
+const requireFromHere = createRequire(__filename)
+const resolveFromHere = url => pathToFileURL(requireFromHere.resolve(url)).href
+
+registerHooks({
+    resolve(specifier, context, nextResolve) {
+        try {
+            // use default Node resolver first.
+            // Note: registering more hooks is UB!
+            return nextResolve(specifier, context)
+        } catch (error) {
+            if (error.code === 'ERR_MODULE_NOT_FOUND' && ourModules.has(specifier)) {
+                return { url: resolveFromHere(specifier), shortCircuit: true }
+            }
+            throw error
+        }
+    }
+})

package/lib/watch/vite-watch.js

@@ -79,7 +79,7 @@ cds.on('bootstrap', app => {
 
     for (const viteApp of viteApps) {
       const base = viteApp.root ? '/' : normalizeBase(viteApp.name)
-      const server = await createServer({ base, root: viteApp.path, server: { middlewareMode: true, hmr: { port: hmrPort++ } }})
+      const server = await createServer({ base, root: viteApp.path, server: { middlewareMode: true, ws: { port: hmrPort++ } }})
       viteServers.push({ base, root: viteApp.root, middlewares: server.middlewares })
     }
 

package/node_modules/@sap/cds-compiler/CHANGELOG.md

@@ -15,6 +15,20 @@ might use a deprecated flag only for a limited period of time.
 
 
 
+## Version 7.0.2 - 2026-07-14
+
+### Bug Fixes
+
+- **compiler:**
+  + Avoid dump for a new association in a projection with backlink comparison while reporting a missing backlink target element.
+  + Soften incompatibility concerning backlink comparisons: missing target elements which are referred to in the foreign keys or ON-condition of the backlink
+    association now only lead to a warning.
+  + Soften incompatibility concerning structure values for annotations: a structure property like `list` won't be rejected; we avoid an ambiguity with an
+    _expression_ `(1, 2, 3)` by putting `'=': true` next to `list: …` in the CSN, like in compiler v6. A `xpr` expression is rendered without a sibling `=`,
+    though.
+
+
+
 ## Version 7.0.1 - 2026-06-18
 
 ### ⚠ BREAKING CHANGES

package/node_modules/@sap/cds-compiler/bin/cdsse.js

@@ -201,7 +201,7 @@ function offset( buf, alsoSuffix ) { // for line and column
       return false;
   }
   let cursor = pos + column - 1;
-  // eslint-disable-next-line sonarjs/slow-regex
+  // eslint-disable-next-line sonarjs/super-linear-regex
   const prefix = /[a-z_0-9$]*$/i.exec( buf.substring( pos, cursor ) ).index + pos;
   const col = column + prefix - cursor;
   if (alsoSuffix)

package/node_modules/@sap/cds-compiler/bin/cdsv2m.js

@@ -39,7 +39,7 @@ function ria() {
   // 'Choose via $(ANNO) one of $(SORTED_ARTS) as redirection target for $(TARGET) in … $(ART) otherwise'
   // NOTE: regex match on message text not for productive code!
   for (const msgObj of msgs) {
-    // eslint-disable-next-line sonarjs/slow-regex
+    // eslint-disable-next-line sonarjs/super-linear-regex
     const matches = msgObj.message.match( /["“][^"”]+["”]/ug );
     matches.slice( 1, -2 ).forEach( (name) => {
       annotates[name.slice( 1, -1 )] = true;

package/node_modules/@sap/cds-compiler/doc/IncompatibleChanges_v7.md

@@ -173,7 +173,7 @@ In cds-compiler v7, we make `name-deprecated-$self` a non-configurable error.
 Before cds-compiler v7:  
 The CSN representation of an expression-like annotation value is an object with
 properties `=` and one of `ref`, `xpr`, `val`, `func`, `SELECT`, `list`.
-In `=` we capture the (space-normalized, comments removed) string representation of the expression,
+In `=` we capture the (space-normalized, comments removed) string CDL representation of the expression,
 the other one holds the parsed expression as a token stream.
 
 When the annotation is propagated ...
@@ -222,25 +222,32 @@ Resulting CSN:
 ```
 
 In cds-compiler v7:  
-* For anno-xpr that are a simple ref (simple: can be path, but no filter, no parameters), keep current behavior:
-  - Keep both `=` and `ref`.
+* For anno-xpr that are a simple ref (simple: can be path, but no filter, no parameters)
+  in the compiler and runtime CSN:
+  - In `=`, render the `.`-concatenated `ref` items without CDL escaping
+    (like for unchecked references, but unlike compiler v6);
+    e.g. for a reference, written as `(![in])` in CDL, use `{ '=': 'in', ref: ['in'] }` in CSN.
   - When rewriting is necessary, also adapt the `=`.
+* For expression which are a simple enum symbols, with or without surrounding parentheses:
+  - Just render the `#`, omit the `=` property.
+* For expressions which are represented in CSN by a simple `xpr`:
+  - Do not render a `=` property anymore, just render the `xpr`.
 * For all other expressions:
-  - Remove the `=`
-    + both in original and in propagated annotations
-    + no matter whether rewriting is necessary or not
-
-With the removal of `=`, any object with a `ref` or `xpr` or `val` inside an array
-is regarded as an expression value. This could introduce ambiguities. Outside arrays
-there is no danger of ambiguity due to flattening.
-To avoid such ambiguities in CDL, the parser in v7 throws an error for "ambiguous" sources like
+  - Use `=` property with value `true`, do not use the CDL source as value,
+    both in original and in propagated annotations.
+
+With the removal of `=`, any object in a CSN with just a `xpr`
+is regarded as an expression value. With that, a structure inside an array
+with just a `xpr` property could not be represented without ambiguity.
+
+Therefore, the parser in v7 reports an error for such invalid structure values:
 ```cds
 @A_xpr: [(2*foo)]
 @A_str: [{xpr: [{val: 2}, '*', {ref: ['foo']}]}]
 entity E { foo : Integer; }
 ```
-For: ref, xpr, val, func, SELECT, list.
-
+The compiler also reports an error for structures inside arrays containing a `=` property and
+a primary expression property (`ref`, `xpr`, `list`, `val`, `#`, `func`, `SELECT` and `SET`).
 
 ### Default for structures
 

package/node_modules/@sap/cds-compiler/lib/base/builtins.js

@@ -107,7 +107,10 @@ const exprProperties = [
  * Return whether JSON object `val` is a representation for an annotation expression
  */
 function isAnnotationExpression( val ) {
-  return val && primaryExprProperties.some( prop => val[prop] !== undefined );
+  return val && (val['=']
+    ? primaryExprProperties.some( prop => val[prop] !== undefined )
+    : val.xpr !== undefined && Object.keys( val ).length === 1 || val['#'] !== undefined
+  );
 }
 
 module.exports = {

package/node_modules/@sap/cds-compiler/lib/base/message-registry.js

@@ -147,6 +147,8 @@ const centralMessages = {
   'ref-invalid-source': { severity: 'Error' },
   'ref-invalid-target': { severity: 'Error' },
   'ref-invalid-backlink': { severity: 'Error', configurableFor: 'before_v8' },
+  'ref-missing-backlink-element': { severity: 'Warning', errorFor: [ 'v8' ] },
+  'ref-deprecated-backlink': { severity: 'Warning', errorFor: [ 'v8' ] },
   'ref-missing-self-counterpart': { severity: 'Error', configurableFor: true },
   'ref-sloppy-target': { severity: 'Error', configurableFor: 'deprecated_before_v8' },
 
@@ -546,8 +548,10 @@ const centralMessageTexts = {
     colon: 'Use a $(NEWCODE), not a $(CODE) between the element names in a reference',
   },
   'syntax-invalid-anno-struct': {
-    std: 'Most CSN processors interpret a structure with property $(PROP) as expression',
-    ref: 'The value of property $(PROP) must be a non-empty string, which most CSN processors interpret as reference',
+    std: 'Objects with properties $(PROP) and $(SIBLINGPROP) are reserved for expressions and can\'t be used as structures',
+    xpr: 'Objects with $(PROP) as only property are reserved for expressions and can\'t be used as structures',
+    '#': 'Objects with a property $(PROP) are reserved for enum values and can\'t be used as structures',
+    ref: 'The value of property $(PROP) in structures must be a non-empty string',
   },
   // 'syntax-ignoring-doc-comment' (Info)
   'syntax-unexpected-reserved-word': '$(CODE) is a reserved word - write $(DELIMITED) instead if you want to use it as name',
@@ -917,6 +921,7 @@ const centralMessageTexts = {
   'rewrite-undefined-key': {
     std: 'Can\'t redirect association $(NAME), as redirection target $(TARGET) does not project element $(ID), which is required to match foreign key of $(NAME)',
     backlink: 'Can\'t project association, as the current entity does not project element $(ID), which is required to match foreign key of the backlink association',
+    // TODO: delete text variant 'backlink' again
   },
   'type-unexpected-typeof': {
     std: 'Unexpected $(KEYWORD) for the type reference here',
@@ -1180,6 +1185,14 @@ const centralMessageTexts = {
     include: 'The open backlink target $(TARGET) of the aspect is unrelated to the current entity',
     backlink: 'Can\'t use $(ART) as backlink association, because its ON-condition contains a backlink comparison',
   },
+  'ref-deprecated-backlink': {
+    std: 'The target $(TARGET) of the backlink association is just distantly related to the current entity; do not use a comparison with $(ID)',
+    inferred: 'The target $(TARGET) of the backlink association $(NAME) is just distantly related to the current entity; provide an ON-condition not using a comparison with $(ID)',
+  },
+  'ref-missing-backlink-element': {
+    std: 'Element $(ID) must also be projected when projecting this association containing a backlink comparison',
+    def: 'Element $(ID) must be projected when defining this association containing a backlink comparison',
+  },
   'extend-columns': {
     std: 'Artifact $(ART) can\'t be extended with columns, only simple views/projections without JOINs and UNIONs can',
     join: 'Artifact $(ART) can\'t be extended with columns, because it contains a JOIN',

package/node_modules/@sap/cds-compiler/lib/checks/defaultValues.js

@@ -23,7 +23,6 @@ function validateDefaultValues( member, memberName, prop, path ) {
       // TODO: This check only counts the number of leading signs, not inbetween (e.g. 1 - - 1).
       //       The message also needs to be improved.
       if (i > 1)
-        // eslint-disable-next-line cds-compiler/message-no-quotes
         this.error(null, path, {}, 'Illegal number of unary \'+\'/\'-\' operators');
     }
   }

package/node_modules/@sap/cds-compiler/lib/compiler/resolve.js

@@ -1229,7 +1229,8 @@ function resolve( model ) {
   function checkBacklinkPartner( assoc ) {
     checkBareDollarSelf( assoc );
     // console.log('CBP:',assoc.kind,assoc._main?.name?.id,assoc.name.id,!!assoc.$backlink)
-    const target = assoc.$backlink?._origin?.target?._artifact;
+    const origin = assoc.$backlink?._origin;
+    const target = origin?.target?._artifact;
     if (!target)
       return;
     const main = assoc._main;
@@ -1254,10 +1255,10 @@ function resolve( model ) {
       // TODO: we should do the "simple projection ancestor" probably only if no
       // include is involved in the redirection chain
       if (redirectionChain( null, main, ancestor, true )) {
-        warning( 'ref-dubious-backlink', [ assoc.$backlink.location, assoc ],
-                 { target },
-                 // eslint-disable-next-line @stylistic/max-len
-                 'The target $(TARGET) of the backlink association has just a distant relationship to the current entity' );
+        const msg = (assoc.on.$inferred ? 'inferred' : 'std');
+        message( 'ref-deprecated-backlink', [ assoc.$backlink.location, assoc ],
+                 // eslint-disable-next-line @stylistic/object-curly-newline
+                 { '#': msg, target, id: '$self', name: origin.name.id } );
         return;
       }
     }

package/node_modules/@sap/cds-compiler/lib/compiler/tweak-assocs.js

@@ -450,13 +450,24 @@ function tweakAssocs( model ) {
           if (projectedKey.index > 0)
             targetElement.path.splice(0, projectedKey.index);
         }
+        else if (elem._outer?.$backlink === elem) {
+          const undef = targetElement.path[0];
+          setArtifactLink( undef, null );
+          setArtifactLink( targetElement, null );
+          const outer = elem._outer;
+          message( 'ref-missing-backlink-element',
+                   [ (outer.value || outer.name).location, outer ],
+                   { '#': (outer.value ? 'std' : 'def'), id: undef.id } );
+        // TODO: more info if element was already missing in "intermediate" projection
+        // TODO: collect all missing elements?
+        }
         else {
           setArtifactLink( targetElement.path[0], null );
           setArtifactLink( targetElement, null );
 
           const culprit = !elem.target.$inferred && elem.target ||
-          elem.value?.path?.[elem.value.path.length - 1] ||
-          elem;
+            elem.value?.path?.[elem.value.path.length - 1] ||
+            elem;
           // TODO: probably better to collect the non-projected foreign keys
           // and have one message for all
           error( 'rewrite-undefined-key', [ weakLocation( culprit.location ), elem ], {
@@ -825,8 +836,16 @@ function tweakAssocs( model ) {
       if (!item)
         return;     // just $self
       // console.log('REB:',assoc.name?.id,expr.path.map(i=>i.id))
-      if (item.id === assoc.name.id)
-        rewritePath( expr, item, assoc, assoc, null );
+      if (item.id === assoc.name.id &&
+          rewritePath( expr, item, assoc, assoc, null )) {
+        const undef = expr.path.find( i => !i._artifact );
+        const outer = assoc._outer;
+        message( 'ref-missing-backlink-element',
+                 [ (outer.value || outer.name).location, outer ],
+                 { '#': (outer.value ? 'std' : 'def'), id: undef.id } );
+        // TODO: more info if element was already missing in "intermediate" projection
+        // TODO: collect all missing elements?
+      }
     }
     else if (assoc._main.query) { // from ON cond of mixin element in query
       // here also $calc
@@ -877,7 +896,7 @@ function tweakAssocs( model ) {
           element: 'This element is not originally referred to in the ON-condition of association $(MEMBER) of $(ART)',
         } );
       }
-      rewritePath( expr, item, assoc, elem, null );
+      rewritePath( expr, item, assoc, elem, null ); // TODO: really no error?
     }
   }
 
@@ -1044,6 +1063,8 @@ function tweakAssocs( model ) {
    * Rewrite the reference `ref` with first elem/mixin ref item `item` for user
    * `assoc` (the query element).  `elem` is usually the first (or preferred)
    * query element for item.
+   *
+   * If `location` is falsy, do not issue an error.
    */
   function rewritePath( ref, item, assoc, elem, location ) {
     const { path } = ref;
@@ -1092,7 +1113,7 @@ function tweakAssocs( model ) {
         if (state && state !== true)
           continue;
         if (!state && !location)
-          return true;
+          return true;          // no rewrite possible
         break;
       }
     }

package/node_modules/@sap/cds-compiler/lib/edm/annotations/edmJson.js

@@ -978,6 +978,11 @@ function xpr2edmJson( carrier, anno, location, options, messageFunctions, generi
       return xpr;
     }
 
+    // "'=': true" has no meaning as an OData operator here and must be removed
+    // before transform runs, otherwise transform['='] misinterprets it as $Eq.
+    if (xpr['='] === true)
+      delete xpr['='];
+
     if (xpr.list)
       xpr.list.forEach( preTransformExpression );
 

package/node_modules/@sap/cds-compiler/lib/json/from-csn.js

@@ -117,7 +117,7 @@
 
 const { dictAdd } = require('../compiler/dictionaries');
 const { quotedLiteralPatterns } = require('../compiler/builtins');
-const { exprProperties, primaryExprProperties } = require('../base/builtins');
+const { exprProperties, isAnnotationExpression } = require('../base/builtins');
 const { CompilerAssertion } = require('../base/error');
 const { Location } = require('../base/location');
 const { XsnSource } = require('../compiler/xsn-model');
@@ -1490,10 +1490,10 @@ function annoValue( val, spec ) {
     }
     return retval;
   }
-  else if (primaryExprProperties.some( prop => val[prop] !== undefined )) {
+  else if (isAnnotationExpression( val )) {
     const s = schema['@'].schema['-expr'];
     const r = object( val, s );
-    r.$tokenTexts = true;       // property `=` might not be present
+    r.$tokenTexts = true;
     return r;
   }
   else if (val['...'] !== undefined && Object.keys( val ).length === 1) {

package/node_modules/@sap/cds-compiler/lib/json/to-csn.js

@@ -1149,10 +1149,11 @@ function annoValue( node ) {
   if (!node.$tokenTexts)
     return value( node );
   const csn = expression( node ); // expressions in annotation values
-  return (!csn?.ref || gensrcFlavor || universalCsn ||
-          csn.cast || csn.param || csn.ref.some( id => typeof id !== 'string' ))
-    ? csn
-    : Object.assign({ '=': csn.ref.join( '.' ) }, csn );
+  if (!csn || csn['#'] || csn.xpr && Object.keys( csn ).length === 1)
+    return csn;                 // '#' and 'xpr' without sibling '='
+  const asTrue = !csn?.ref || gensrcFlavor || universalCsn ||
+    csn.cast || csn.param || csn.ref.some( id => typeof id !== 'string' );
+  return Object.assign({ '=': !!asTrue || csn.ref.join( '.' ) }, csn );
 }
 
 function value( node ) {

package/node_modules/@sap/cds-compiler/lib/parsers/AstBuildingParser.js

@@ -1190,15 +1190,26 @@ class AstBuildingParser extends BaseParser {
   }
 
   checkStructProps( dict ) {
+    // see also isAnnotationExpression()
+    if (!dict['=']) {
+      const prop = dict['#'] && '#' ||
+        dict.xpr && Object.keys( dict ).length === 1 && 'xpr';
+      if (!prop)
+        return;
+      this.error( 'syntax-invalid-anno-struct', dict[prop].name.location,
+                  { '#': prop, prop } );
+      return;
+    }
     const prop = primaryExprProperties.find( p => dict[p] !== undefined );
     if (prop) {
       this.error( 'syntax-invalid-anno-struct', dict[prop].name.location,
-                  { '#': 'std', prop } );
+                  { '#': 'std', prop, siblingprop: '=' } );
     }
-    else if (dict['='] && (dict['='].literal !== 'string' || !dict['='].val)) {
+    else if (dict['='].literal !== 'string' || !dict['='].val) {
       this.error( 'syntax-invalid-anno-struct', dict['='].location,
                   { '#': 'ref', prop: '=' } );
     }
+    // TODO: also check '...' ?
   }
 
   // TODO: remove the check from the parser; move it to shared.js
@@ -1635,7 +1646,7 @@ function addOneForDefinition( count, ext ) {
 
 // Significant digits (before exponent) without leading and trailing zeros
 function relevantDigits( val ) {
-  // eslint-disable-next-line sonarjs/slow-regex
+  // eslint-disable-next-line sonarjs/super-linear-regex
   val = val.replace( /e.+$/i, '' ); // this regex has no newlines -> is not slow
 
   const init = /^[-+0.]+/g;     // global flag to have lastIndex

package/node_modules/@sap/cds-compiler/lib/tool-lib/enrichCsn.js

@@ -143,7 +143,7 @@ function enrichCsn( csn, options = {} ) {
     }
     else {
       const record = !isAnnotationExpression( obj ) && assignment;
-      // is record without primary expression property
+      // is record without primary expression property and usually '='
       for (const name of Object.getOwnPropertyNames( obj ) ) {
         const trans = record || transformers[name] || transformers[name.charAt(0)] || standard;
         trans( obj, name, obj[name] );

package/node_modules/@sap/cds-compiler/lib/transform/db/cdsPersistence.js

@@ -51,11 +51,12 @@ function getAssocToSkippedIgnorer( csn, options, messageFunctions, csnUtils ) {
    *
    * @param {CSN.Artifact} artifact
    * @param {string} artifactName
+   * @param {string} _prop
+   * @param {CSN.Path} _path
    */
   function ignoreAssociationToSkippedTarget( artifact, artifactName, _prop, _path ) {
-    if (isPersistedOnDatabase(artifact)) {
+    if (isPersistedOnDatabase(artifact))
       forEachMemberRecursively(artifact, ignore, [ 'definitions', artifactName ]);
-    }
   }
 
   /**

package/node_modules/@sap/cds-compiler/lib/transform/db/views.js

@@ -130,6 +130,7 @@ function getViewTransformer( csn, options, _messageFunctions ) {
    * @param {CSN.Element} elem
    * @param {string} elemName
    * @param {CSN.Path} elementsPath Path pointing to elements
+   * @param {CSN.Path} _queryPath
    */
   function handleAssociationElement( query, elements, columnMap, publishedMixins, elem, elemName, elementsPath, _queryPath ) {
     const isNotMixinByItself = checkIsNotMixinByItself(query, columnMap, elemName);
@@ -391,9 +392,8 @@ function getColumnMap( query, csnUtils ) {
 function ensureColumnNames( query, csnUtils, _options ) {
   const select = query.SELECT || query.projection;
   for (const col of select?.columns || []) {
-    if (col !== '*' && !columnAlias(col)) {
+    if (col !== '*' && !columnAlias(col))
       setProp(col, 'as', csnUtils.getColumnName(col));
-    }
   }
 }
 

package/node_modules/@sap/cds-compiler/lib/transform/transformUtils.js

@@ -218,9 +218,8 @@ function getTransformers(model, options, msgFunctions, pathDelimiter = '_') {
       if (flattenedNames.length === 1) {
         // Single element: propagate default if leaf doesn't have one
         const singleElem = result[flattenedNames[0]];
-        if (singleElem.default?.val === undefined) {
+        if (singleElem.default?.val === undefined)
           singleElem.default = elem.default; // Copy entire default object {val, location}
-        }
       }
       else if (flattenedNames.length > 1) {
         // Multi-element structure: warn that default is ignored

package/node_modules/@sap/cds-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "7.0.1",
+  "version": "7.0.2",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",

package/node_modules/ws/lib/receiver.js

@@ -77,6 +77,7 @@ class Receiver extends Writable {
 
     this._totalPayloadLength = 0;
     this._messageLength = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     this._errored = false;
@@ -500,6 +501,19 @@ class Receiver extends Writable {
       return;
     }
 
+    if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+      const error = this.createError(
+        RangeError,
+        'Too many message fragments',
+        false,
+        1008,
+        'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+      );
+
+      cb(error);
+      return;
+    }
+
     if (this._compressed) {
       this._state = INFLATING;
       this.decompress(data, cb);
@@ -507,22 +521,6 @@ class Receiver extends Writable {
     }
 
     if (data.length) {
-      if (
-        this._maxFragments > 0 &&
-        this._fragments.length >= this._maxFragments
-      ) {
-        const error = this.createError(
-          RangeError,
-          'Too many message fragments',
-          false,
-          1008,
-          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-        );
-
-        cb(error);
-        return;
-      }
-
       //
       // This message is not compressed so its length is the sum of the payload
       // length of all fragments.
@@ -562,22 +560,6 @@ class Receiver extends Writable {
           return;
         }
 
-        if (
-          this._maxFragments > 0 &&
-          this._fragments.length >= this._maxFragments
-        ) {
-          const error = this.createError(
-            RangeError,
-            'Too many message fragments',
-            false,
-            1008,
-            'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-          );
-
-          cb(error);
-          return;
-        }
-
         this._fragments.push(buf);
       }
 
@@ -604,6 +586,7 @@ class Receiver extends Writable {
     this._totalPayloadLength = 0;
     this._messageLength = 0;
     this._fragmented = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     if (this._opcode === 2) {

package/node_modules/ws/lib/websocket-server.js

@@ -43,9 +43,9 @@ class WebSocketServer extends EventEmitter {
    *     called
    * @param {Function} [options.handleProtocols] A hook to handle protocols
    * @param {String} [options.host] The hostname where to bind the server
-   * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+   * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
    *     buffered data chunks
-   * @param {Number} [options.maxFragments=131072] The maximum number of message
+   * @param {Number} [options.maxFragments=16384] The maximum number of message
    *     fragments
    * @param {Number} [options.maxPayload=104857600] The maximum allowed message
    *     size
@@ -69,8 +69,8 @@ class WebSocketServer extends EventEmitter {
     options = {
       allowSynchronousEvents: true,
       autoPong: true,
-      maxBufferedChunks: 1024 * 1024,
-      maxFragments: 128 * 1024,
+      maxBufferedChunks: 256 * 1024,
+      maxFragments: 16 * 1024,
       maxPayload: 100 * 1024 * 1024,
       skipUTF8Validation: false,
       perMessageDeflate: false,

package/node_modules/ws/lib/websocket.js

@@ -646,9 +646,9 @@ module.exports = WebSocket;
  *     masking key
  * @param {Number} [options.handshakeTimeout] Timeout in milliseconds for the
  *     handshake request
- * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+ * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
  *     buffered data chunks
- * @param {Number} [options.maxFragments=131072] The maximum number of message
+ * @param {Number} [options.maxFragments=16384] The maximum number of message
  *     fragments
  * @param {Number} [options.maxPayload=104857600] The maximum allowed message
  *     size
@@ -670,8 +670,8 @@ function initAsClient(websocket, address, protocols, options) {
     autoPong: true,
     closeTimeout: CLOSE_TIMEOUT,
     protocolVersion: protocolVersions[1],
-    maxBufferedChunks: 1024 * 1024,
-    maxFragments: 128 * 1024,
+    maxBufferedChunks: 256 * 1024,
+    maxFragments: 16 * 1024,
     maxPayload: 100 * 1024 * 1024,
     skipUTF8Validation: false,
     perMessageDeflate: true,

package/node_modules/ws/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ws",
-  "version": "8.21.0",
+  "version": "8.21.1",
   "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
   "keywords": [
     "HyBi",
@@ -66,5 +66,9 @@
     "nyc": "^15.0.0",
     "prettier": "^3.0.0",
     "utf-8-validate": "^6.0.0"
+  },
+  "allowScripts": {
+    "bufferutil": true,
+    "utf-8-validate": true
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "10.0.4",
+  "version": "10.0.5",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [