@sap/cds-dk 10.0.4 → 10.0.6

package/CHANGELOG.md

@@ -6,6 +6,43 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 10.0.6 - 2026-07-24
+
+### Added
+
+- `cds add xsuaa` now generates namespace-suffixed XSUAA `role-collections` for Kyma.
+
+### Fixed
+
+- `cds add http` no longer throws `MULTIPLE_DOCS` when `application.yaml` uses `---` separators (Spring Boot multi-profile format).
+- `cds export --data` now reads seed data via in-memory SQLite instead of the configured db driver, so it no longer fails in projects with `requires.db: hana` (e.g. CAP Java).
+- `cds init --java --add mta` now writes `path: srv` for the Java `srv` module in `mta.yaml` instead of `gen/srv`, so `mbt build` no longer fails with `the "gen/srv" path of the "<app>-srv" module does not exist`.
+- `cds version` no longer reports dependency problems if no dependencies are installed at all. It prints an info message instead.
+- `cds add test` creates tests that are green by default. Sample data is provided as commented code.
+
+## Version 10.0.5 - 2026-07-16
+
+### Fixed
+
+- `cds build --for hana` now declares the plugin for native HANA artifacts placed in the build output (e.g. a `.hdbprojectionview` from `db/src`) in the generated `.hdiconfig`.
+- `cds add typer` now generates a `jsconfig.json` file that works with VS Code.
+- `cds debug <app> --force` on Kyma now preserves existing `NODE_OPTIONS` flags (e.g. `--max-old-space-size`) instead of overwriting them when enabling the inspector.
+- `cds add sample` now selects `stock` in the Books list and object pages, so the overstock discount shows up in the UI.
+- `cds add data` now generates correct foreign-key columns for nested compositions of aspects, e.g. `up__up__ID,up__ID,ID,name` instead of a broken `up__up_` header.
+- `cds build` no longer fails with `npm ls -ws: unknown option` on npm 12, which dropped the short `-ws` flag.
+- `cds build` now packages transitive npm workspace dependencies again on npm 12, which changed `npm pack --json` to emit an object keyed by package name instead of an array.
+- `cds up` uses `helm --rollback-on-failure` instead of the deprecated `--atomic`.
+- `cds add portal` on Java + IAS disables JWT proof-of-possession on `srv` (`SAP_SPRING_SECURITY_IDENTITY_PROOFTOKEN=false`) so Portal-proxied tile OData works.
+- `cds add ias` forwards client certificates from the approuter to `srv-api` (`backendDestinations.srv-api.forwardAuthCertificates`).
+- `cds add ias` always enables `xsuaa-cross-consumption` in the identity service parameters.
+- `cds add ias` no longer sets an mTLS `expose.host` on the approuter, restoring a plain approuter host for the browser flow.
+- `cds add portal` on Java multitenant now binds the Portal service instance to `srv` so CAP Java's `getDependencies` reports Portal to the SaaS Registry.
+- `cds add kyma` uses a tenant-agnostic (tcpSocket) startup probe for the multitenant approuter, avoiding 400s from `TENANT_HOST_PATTERN` on kubelet probes.
+- `cds add kyma` no longer emits the dead `Authentication: OAuth2UserTokenExchange` key on `backendDestinations.srv-api`.
+- `cds add github-actions` uses updated versions.
+- `cds watch` now works in ESM scenarios where only a global `cds-dk` is installed, where it would formerly fail with `ERR_MODULE_NOT_FOUND` for `@sap/cds`.
+- `cds watch`no longer shows a `'server.hmr.protocol/host/port/path/clientPort/timeout/server' is deprecated` warning when running a Vite application.
+
 ## Version 10.0.4 - 2026-07-08
 
 ### Fixed

package/bin/debug.js

@@ -101,7 +101,11 @@ async function debug() {
 
     if (force) {
       console.log(`\nEnabling Node inspector on deployment/${appName} at 0.0.0.0:${portLocal} ...`)
-      _execSyncSafe(`kubectl ${ns} set env deployment/${appName} NODE_OPTIONS="--inspect=0.0.0.0:${portLocal}"`, { stdio: 'inherit' })
+      const existingOpts = _execSyncSafe(`kubectl ${ns} get deploy ${appName} -o jsonpath="{.spec.template.spec.containers[0].env[?(@.name=='NODE_OPTIONS')].value}"`)
+      const inspectFlag = `--inspect=0.0.0.0:${portLocal}`
+      const stripped = existingOpts ? existingOpts.replace(/--inspect(-brk)?(=\S+)?\s*/g, '').trim() : ''
+      const newOpts = stripped ? `${stripped} ${inspectFlag}` : inspectFlag
+      _execSyncSafe(`kubectl ${ns} set env deployment/${appName} NODE_OPTIONS="${newOpts.replace(/"/g, '\\"')}"`, { stdio: 'inherit' })
       _execSyncSafe(`kubectl ${ns} rollout restart deployment/${appName}`, { stdio: 'inherit' })
       k(`rollout status deployment/${appName} --timeout=180s`, { stdio: 'inherit' })
     } else {
@@ -281,7 +285,7 @@ async function debug() {
       return _execSync(...args)
     } catch { /* ignore */ }
   }
-  function _execSync(cmd, options={ encoding: 'utf-8', shell: true }) {
+  function _execSync(cmd, options={ encoding: 'utf-8', shell: true, maxBuffer: 10 * 1024 * 1024 }) {
     try {
       return execSync(cmd, options)?.trim()
     } catch (err) {

package/bin/export.js

@@ -200,7 +200,7 @@ class Export extends Minify {
   }
 
   async export_data (model) {
-    const db = cds.db = await cds.deploy ('*',{silent:true})
+    const db = cds.db = await cds.deploy ('*',{silent:true}).to ('sqlite::memory:')
     const out = path.resolve (this.options.to, 'data')
     await fs.promises.rm (out, { recursive: true, force: true })
     await mkdirp (this.options.to, 'data')

package/bin/up.js

@@ -346,7 +346,7 @@ async function up() {
       }
     })
 
-    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --atomic --wait --wait-for-jobs --timeout=10m`
+    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --rollback-on-failure --wait --wait-for-jobs --timeout=20m`
     if (hasXsuaa) helmArgs.push(' --set-file xsuaa.jsonParameters=xs-security.json')
     if (helmArgs.length > 0) helmUpgrade += ` ${helmArgs.join(' ')}`
     run(helmUpgrade)

package/bin/version.js

@@ -1,3 +1,4 @@
+const cds = require('../lib')
 
 module.exports = exports = async function cds_version (pattern, options) {
   console.log()
@@ -9,7 +10,12 @@ module.exports = exports = async function cds_version (pattern, options) {
   print_versions (all.flat(),o)
   if (!o.json) {
     if (o.info) console.log ('\n','> Project:', project_info (o))
-    if (o._elsp) console.log ('\n', `${RED}ELSPROBLEMS${RESET} reported by ${BOLD}npm ls${RESET}. Run ${BOLD}npm install${RESET} to fix dependency problems, then rerun ${BOLD}cds version${RESET}.`)
+    if (o._elsp) {
+      if (!cds.utils.fs.existsSync(join(o.root, 'node_modules')))
+        console.log (`\nNo dependencies installed. Run ${BOLD}npm install${RESET}, then rerun ${BOLD}cds version${RESET}.`)
+      else
+        console.log (`\n${RED}ELSPROBLEMS${RESET} reported by ${BOLD}npm ls${RESET}. Run ${BOLD}npm install${RESET} to fix dependency problems, then rerun ${BOLD}cds version${RESET}.`)
+    }
   }
   console.log()
 }
@@ -49,8 +55,6 @@ exports.help = `
       repository URL at the end as a markdown link.
 `
 
-
-const cds = require('../lib')
 const $ = cds.utils.sh || sh_polyfill
 const child_process = require('node:child_process')
 const home = require('os').homedir()

package/bin/watch.js

@@ -148,6 +148,7 @@ async function watch ([cwd], {
   // if sap/cds is not installed locally, run with cds-dk's deps. (sap/cds, sqlite etc)
   if (!installed('@sap/cds', cwd)) {
     env.NODE_PATH = [...paths(cwd), ...paths(__dirname)].join(delimiter)
+    env.NODE_OPTIONS = [env.NODE_OPTIONS, `--import ${require.resolve('../lib/watch/esm-resolve-registration.js')}`].filter(Boolean).join(' ')
   }
 
   const delay = parseInt(process.env.CDS_WATCH_DELAY) || 200

package/lib/build/plugins/hana/index.js

@@ -68,7 +68,6 @@ module.exports = class HanaBuildPlugin extends require('../internal') {
             }
 
             // create additional stuff in dest
-            await this._writeHdiConfig(hdiPlugins)
             await this._writeHdiNamespace()
             await this._writeUndeployJson()
 
@@ -100,6 +99,8 @@ module.exports = class HanaBuildPlugin extends require('../internal') {
                 )
             }
 
+            await this._writeHdiConfig(hdiPlugins)
+
             // relocate .hdbsynonymconfig files containing *.configure properties to cfg/ folder
             // HDI's template mechanism for configuration files only works from the cfg/ folder
             // For inplace builds (Java), restrict the scan to compileDest only to avoid moving user's
@@ -433,7 +434,8 @@ module.exports = class HanaBuildPlugin extends require('../internal') {
     async _writeHdiConfig(compileHdiPlugins) {
         const DEFAULT_HDI_PLUGINS = [FILE_EXT_CSV, FILE_EXT_HDBTABLEDATA, FILE_EXT_HDBTABLE, ".hdbview", ".hdbindex", ".hdbconstraint", ".hdbcalculationview"]
         const undeployHdiPlugins = await this._readTypesFromUndeployJson() // see CAP issue #6222
-        const hdiPlugins = new Set([...DEFAULT_HDI_PLUGINS, ...undeployHdiPlugins, ...compileHdiPlugins])
+        const destHdiPlugins = await this._readTypesFromCompileDest()
+        const hdiPlugins = new Set([...DEFAULT_HDI_PLUGINS, ...undeployHdiPlugins, ...compileHdiPlugins, ...destHdiPlugins])
         let hdiConfigPath
 
         // do not create the .hdiconfig file in 'gen/db' root folder for now
@@ -543,6 +545,21 @@ module.exports = class HanaBuildPlugin extends require('../internal') {
         return hdiPlugins
     }
 
+    async _readTypesFromCompileDest() {
+        const hdiPlugins = new Set()
+        const dir = path.join(this.task.dest, 'src')
+        if (!exists(dir)) return hdiPlugins
+
+        const template = await _readTemplateAsJson('.hdiconfig-all')
+        const knownSuffixes = new Set(Object.keys(template['file_suffixes']).map(key => '.' + key))
+        const files = await find(dir, { filter: (entry) => !isdir(entry) })
+        files.forEach(file => {
+            const suffix = path.extname(file)
+            if (knownSuffixes.has(suffix)) hdiPlugins.add(suffix)
+        })
+        return hdiPlugins
+    }
+
     async _validateMigrationTableFiles() {
         const dbSrcDir = path.join(this.task.src, "src")
         const migrationTableFiles = await find(dbSrcDir, { filter: (res) => {

package/lib/build/plugins/helm/files/templates/_deployment_helpers.tpl

@@ -88,6 +88,8 @@ Backend Destinations
     {{- end -}}
     {{- $currentDestination := dict $nameKey $destination.name $urlKey (print  $protocol "://" $destinationHost ) -}}
     {{- $currentDestination := merge $currentDestination $.defaultParameters -}}
+    {{- $extras := omit $destination "name" "service" "external" -}}
+    {{- $currentDestination := merge $extras $currentDestination -}}
     {{- $destinations = (append $destinations $currentDestination) -}}
 {{- end -}}
 {{- $destinations | toJson }}

package/lib/build/plugins/nodejs/index.js

@@ -296,14 +296,17 @@ module.exports = class NodejsBuildPlugin extends require('../edmx') {
      * @param {import('fs').PathLike} dest - destination folder
      * @param {import('fs').PathLike} wsRoot - workspace root folder
      * @param {string[]} workspaces - list of workspace names
-     * @returns {Promise<JSON>} - returns a promise that resolves to the result of the command
+     * @returns {Promise<object[]>} - array of pack descriptors ({ name, filename, ... })
      * @private
      */
     static async _execNpmPack(dest, wsRoot, workspaces) {
-        const args = ['pack', '-ws', '--json', `--pack-destination=${dest}`]
+        const args = ['pack', '--ws', '--json', `--pack-destination=${dest}`]
         workspaces.forEach(w => args.push(`-w=${w}`))
         const result = await cmd.spawnCommand('npm', args, { cwd: wsRoot }, true, !!LOG._debug)
         DEBUG?.(result)
-        return JSON.parse(result)
+        const parsed = JSON.parse(result)
+        // `npm pack --json` returns an array up to npm 11, but an object keyed by
+        // package name as of npm 12 — normalize to an array of descriptors.
+        return Array.isArray(parsed) ? parsed : Object.values(parsed)
     }
 }

package/lib/build/util.js

@@ -300,7 +300,7 @@ async function _execNpmWs(wsRoot) {
     /** @type {string[]} */
     let result = []
     try {
-        const cmdLine = 'npm ls -ws --json'
+        const cmdLine = 'npm ls --ws --json'
         DEBUG?.(`execute ${cmdLine}`)
         // @ts-expect-error - TODO: shell should be a string. But can probably be removed altogether?
         const { stdout } = await execAsync(cmdLine, { shell: IS_WIN, stdio: ['inherit', 'pipe', 'inherit'], cwd: wsRoot })

package/lib/init/projectReader.js

@@ -3,6 +3,7 @@ const { join, resolve, basename } = require('node:path')
 const { execSync } = require('node:child_process')
 const { fs, exists, isfile, isdir, path } = cds.utils
 const { parseXml } = require('./xml')
+const YAML = require('yaml')
 const { REGEX_JAVA_VERSION, JAVA_LTS_VERSIONS } = require('./constants')
 const TRACE = cds.debug('trace')
 
@@ -69,6 +70,7 @@ module.exports = new class ProjectReader {
     readProject() {
         if (!this.appName) this.#setPackageInfo()
         const env = this.env4('production')
+        if (this.isJava) env.build.target = '.'
         const { appVersion, appName, appId, appDescription, jdkVersion } = this
         TRACE?.({ env })
 
@@ -249,8 +251,8 @@ module.exports._readSpringBootConfig = async function (roots = [cds.env.folders.
     for (let r of rootDirs) {
         const file = isfile(join(r, './src/main/resources/application.yaml'))
         if (file) {
-            const yaml = cds.load.yaml(file)
-            for (let yamlDoc of Array.isArray(yaml) ? yaml : [yaml]) {
+            const docs = YAML.parseAllDocuments(fs.readFileSync(file, 'utf-8'))
+            for (let yamlDoc of docs.map(d => d.toJS())) {
                 let cds = yamlDoc?.cds;
                 if (!cds) continue
                 cds = _normalizeSpringBootCfg(cds)

package/lib/init/template/ams/files/containerize.yaml.hbs

@@ -17,4 +17,5 @@ modules:
         {{/isJava}}
         env:
           BP_NODE_RUN_SCRIPTS: ""
+          BP_NODE_VERSION: "24"
 

package/lib/init/template/ams/files/package.json.hbs

@@ -4,7 +4,7 @@
     "@sap/ams": "^3"
   },
   "devDependencies": {
-    "@sap/ams-dev": "^2"
+    "@sap/ams-dev": "^3"
   },
   "engines": {
     "node": "^24"

package/lib/init/template/approuter/files/values.yaml.hbs

@@ -16,11 +16,20 @@ approuter:
       ephemeral-storage: 1G
       cpu: 500m
       memory: 500M
+{{^hasMultitenancy}}
   health:
     liveness:
       path: /
     readiness:
       path: /
+{{/hasMultitenancy}}
+{{#hasMultitenancy}}
+  health:
+    liveness:
+      path: ""
+    readiness:
+      path: ""
+{{/hasMultitenancy}}
 {{=<% %>=}}
   envFrom:
     - configMapRef:
@@ -29,7 +38,6 @@ approuter:
 backendDestinations:
   srv-api:
     service: srv
-    Authentication: OAuth2UserTokenExchange
   {{#hasMultitenancy}}
   mtx-api:
     service: {{#isJava}}srv{{/isJava}}{{^isJava}}sidecar{{/isJava}}

package/lib/init/template/data/as-csv.js

@@ -37,10 +37,12 @@ module.exports = async (data={}, csn, { headerOnly=false, separator=',' }={}) =>
             if (element.on) {
               continue // skip unmanaged associations with explicit on condition
             }
+            // flatten nested foreign keys (composite keys of nested aspects) into up__up__ID columns
+            const {headers: fkHeaders, records: fkRecords} = resolveStruct(value, name)
             if (i === 0) {
-              header.push(...Object.keys(value).map(foreignKey => name + '_' + foreignKey))
+              header.push(...fkHeaders)
             }
-            record.push(...Object.values(value))
+            record.push(...fkRecords)
           }
           else if (element.is_struct && element.type !== 'cds.Map') {
             const {headers: structHeaders, records: structRecords} = resolveStruct(value, name);

package/lib/init/template/data/as-json.js

@@ -257,7 +257,10 @@ function dataForField(element, artifact, csn, record, data, parent, depth, refer
 
       const [ownKey, ownKeyStructured, targetKey] = findKeysInOnCondition(element, target)
       if (ownKey && targetKey) {
-        const value = ownKeyStructured ? { [ownKey]: record[ownKey] } : record[ownKey]
+        // carry over all parent keys, not just the first, so composite/nested keys survive
+        const value = ownKeyStructured
+          ? Object.fromEntries(Object.keys(artifact.keys).map(k => [k, record[k]]))
+          : record[ownKey]
         targetRecords.forEach(targetRecord => {
           // Set parent in target as non-enumerable. Json serialization doesn't need it, but csv does.
           Object.defineProperty(targetRecord, targetKey, { value, enumerable: false })

package/lib/init/template/github-actions/files/workflows/cf.yaml.hbs

@@ -44,13 +44,13 @@ jobs:
           echo "${PWD}/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
       {{/sap}}
       {{/isJava}}
-      - uses: cap-js/cf-setup@v1
+      - uses: cap-js/cf-setup@v2
         with:
-          cf-api: {{#literal}}${{ vars.CF_API }}{{/literal}}
-          cf-org: {{#literal}}${{ vars.CF_ORG }}{{/literal}}
-          cf-space: {{#literal}}${{ vars.CF_SPACE }}{{/literal}}
-          cf-username: {{#literal}}${{ vars.CF_USERNAME }}{{/literal}}
-          cf-password: {{#literal}}${{ secrets.CF_PASSWORD }}{{/literal}}
+          api: {{#literal}}${{ vars.CF_API }}{{/literal}}
+          org: {{#literal}}${{ vars.CF_ORG }}{{/literal}}
+          space: {{#literal}}${{ vars.CF_SPACE }}{{/literal}}
+          username: {{#literal}}${{ vars.CF_USERNAME }}{{/literal}}
+          password: {{#literal}}${{ secrets.CF_PASSWORD }}{{/literal}}
       - run: npm install
       - run: npx cds up
 

package/lib/init/template/ias/files/values.yaml.hbs

@@ -13,14 +13,16 @@ sidecar:
 {{#hasApprouter}}
 approuter:
   expose:
-    gateway: {{#literal}}"{{ .Release.Namespace }}/kyma-mtls-gateway"{{/literal}}
-    host: {{#literal}}"{{ .Release.Name }}-approuter-{{ .Release.Namespace }}.cert"{{/literal}}
+    host: {{#literal}}"{{ .Release.Name }}-approuter-{{ .Release.Namespace }}"{{/literal}}
   bindings:
     auth:
       serviceInstanceName: identity
       parameters:
         credential-type: X509_GENERATED
         app-identifier: approuter
+backendDestinations:
+  srv-api:
+    forwardAuthCertificates: true
 {{/hasApprouter}}
 srv:
   expose:
@@ -41,9 +43,7 @@ identity:
     {{#hasMultitenancy}}
     multi-tenant: true
     {{/hasMultitenancy}}
-    {{#hasXsuaa}}
     xsuaa-cross-consumption: true
-    {{/hasXsuaa}}
     provided-apis:
       - name: {{appName}}-ias-api
         description: API exposed by the application

package/lib/init/template/portal/files/values.yaml.hbs

@@ -6,9 +6,21 @@ approuter:
 portal:
     serviceOfferingName: portal
     servicePlanName: standard
+{{#isJava}}{{#hasIas}}
+srv:
+  env:
+    # Portal Service proxies tile OData without forwarding the client cert.
+    SAP_SPRING_SECURITY_IDENTITY_PROOFTOKEN: "false"
+{{/hasIas}}{{/isJava}}
 {{#hasMultitenancy}}
 sidecar:
   bindings:
     portal:
       serviceInstanceName: portal
+{{#isJava}}
+srv:
+  bindings:
+    portal:
+      serviceInstanceName: portal
+{{/isJava}}
 {{/hasMultitenancy}}

package/lib/init/template/sample/files/app/browse/fiori-service.cds

@@ -27,6 +27,7 @@ annotate CatalogService.Books with @(UI : {
       Value : currency.symbol,
       Label : '{i18n>Currency}'
     },
+    {Value : stock},
   ]},
 });
 
@@ -53,5 +54,6 @@ annotate CatalogService.Books with @(UI : {
     {Value : genre.name},
     {Value : price},
     {Value : currency.symbol},
+    {Value : stock},
   ]
 });

package/lib/init/template/test/files/test/test.xs.hbs

@@ -19,7 +19,7 @@ describe('{{serviceName}} OData APIs', () => {
   it('serves <%name%>', async () => {
     const { data } = await GET `<%&urlPath%> ${{ params: { $select: '<%&selectString%>' } }}`
     expect(data.value).to.containSubset([
-      <%&elementsString%>,
+      // <%&elementsString%>,
     ])
   })
 <%={{ }}=%>{{/entities}}
@@ -27,7 +27,8 @@ describe('{{serviceName}} OData APIs', () => {
 {{#actions}}{{=<% %>=}}
   it('executes <%name%>', async () => {
     const { data } = await POST `<%&urlPath%> ${
-      <%&paramsString%>
+      {}
+      // <%&paramsString%>
     }`
     // TODO finish this test
     // expect(data.value).to...

package/lib/init/template/typer/files/xsconfig.json

@@ -1,6 +1,6 @@
 {
   "compilerOptions": {
-    "moduleResolution": "nodenext",
+    "module": "NodeNext",
     "paths": {
       "#cds-models/*": ["./@cds-models/*"],
       "@sap/cds": ["./node_modules/@cap-js/cds-types"]

package/lib/init/template/typescript/files/package.json

@@ -3,6 +3,6 @@
     "@cap-js/cds-types": "^0.18.0",
     "@types/node": "^24.0.0",
     "tsx": "^4",
-    "typescript": "^6.0.0"
+    "typescript": "^7.0.0"
   }
 }

package/lib/init/template/xsuaa/index.js

@@ -86,13 +86,17 @@ module.exports = class XsuaaTemplate extends require('../../plugin') {
         if (addKyma || addMultitenancy && hasKyma) {
             const overwrites = addMultitenancy ? [{ item: 'xsuaa.parameters.tenant-mode', withValue: 'shared' }] : []
             await merge(__dirname, 'files/values.yaml.hbs').into('chart/values.yaml', { with: project, overwrites })
-            await merge({
-                xsuaa: {
-                    parameters: {
-                        xsappname: `${project.appName}-{{ .Release.Namespace }}`
-                    }
-                }
-            }).into('chart/values.yaml')
+            const parameters = {
+                xsappname: `${project.appName}-{{ .Release.Namespace }}`
+            }
+            if (!project.hasCustomRoleCollections && xsSecurity['role-templates'].length) {
+                parameters['role-collections'] = xsSecurity['role-templates'].map(role => ({
+                    name: `${role.name} (${project.appName} {{ .Release.Namespace }})`,
+                    description: 'generated',
+                    'role-template-references': [`$XSAPPNAME.${role.name}`],
+                }))
+            }
+            await merge({ xsuaa: { parameters } }).into('chart/values.yaml')
             await KymaTemplate.mergeDependency('service-instance', 'xsuaa')
 
         }

package/lib/lint/eslintHelp.json

@@ -1,5 +1,5 @@
 {
-  "version": "10.6.0",
+  "version": "10.7.0",
   "help": "\n# SYNOPSIS\n\n    *cds lint* [options] file.js [file.js] [dir]\n\n    Runs environment checks and/or checks the specified models\n    based on the ESLint framework\n\n# OPTIONS\n    \n    Basic configuration:\n      --no-config-lookup               Disable look up for eslint.config.js\n      -c, --config path::String        Use this configuration instead of eslint.config.js, eslint.config.mjs, or eslint.config.cjs\n      --inspect-config                 Open the config inspector with the current configuration\n      --ext [String]                   Specify additional file extensions to lint\n      --global [String]                Define global variables\n      --parser String                  Specify the parser to be used\n      --parser-options Object          Specify parser options\n    \n    Specify Rules and Plugins:\n      --plugin [String]                Specify plugins\n      --rule Object                    Specify rules\n    \n    Fix Problems:\n      --fix                            Automatically fix problems\n      --fix-dry-run                    Automatically fix problems without saving the changes to the file system\n      --fix-type Array                 Specify the types of fixes to apply (directive, problem, suggestion, layout)\n    \n    Ignore Files:\n      --no-ignore                      Disable use of ignore files and patterns\n      --ignore-pattern [String]        Patterns of files to ignore\n    \n    Use stdin:\n      --stdin                          Lint code provided on <STDIN> - default: false\n      --stdin-filename String          Specify filename to process STDIN as\n    \n    Handle Warnings:\n      --quiet                          Report errors only - default: false\n      --max-warnings Int               Number of warnings to trigger nonzero exit code - default: -1\n    \n    Output:\n      -o, --output-file path::String   Specify file to write report to\n      -f, --format String              Use a specific output format - default: stylish\n      --color, --no-color              Force enabling/disabling of color\n    \n    Inline configuration comments:\n      --no-inline-config               Prevent comments from changing config or rules\n      --report-unused-disable-directives  Adds reported errors for unused eslint-disable and eslint-enable directives\n      --report-unused-disable-directives-severity String  Chooses severity level for reporting unused eslint-disable and eslint-enable directives - either: off, warn, error, 0, 1, or 2\n      --report-unused-inline-configs String  Adds reported errors for unused eslint inline config comments - either: off, warn, error, 0, 1, or 2\n    \n    Caching:\n      --cache                          Only check changed files - default: false\n      --cache-file path::String        Path to the cache file. Deprecated: use --cache-location - default: .eslintcache\n      --cache-location path::String    Path to the cache file or directory\n      --cache-strategy String          Strategy to use for detecting changed files in the cache - either: metadata or content - default: metadata\n    \n    Suppressing Violations:\n      --suppress-all                   Suppress all violations - default: false\n      --suppress-rule [String]         Suppress specific rules\n      --suppressions-location path::String  Specify the location of the suppressions file\n      --prune-suppressions             Prune unused suppressions - default: false\n      --pass-on-unpruned-suppressions  Ignore unused suppressions - default: false\n    \n    Miscellaneous:\n      --init                           Run config initialization wizard - default: false\n      --env-info                       Output execution environment information - default: false\n      --no-error-on-unmatched-pattern  Prevent errors when pattern is unmatched\n      --exit-on-fatal-error            Exit with exit code 2 in case of fatal error - default: false\n      --no-warn-ignored                Suppress warnings when the file list includes ignored files\n      --pass-on-no-patterns            Exit with exit code 0 in case no file patterns are passed\n      --debug                          Output debugging information\n      -h, --help                       Show help\n      -v, --version                    Output the version number\n      --print-config path::String      Print the configuration for the given file\n      --stats                          Add statistics to the lint report - default: false\n      --flag [String]                  Enable a feature flag\n      --mcp                            Start the ESLint MCP server\n      --concurrency Int|String         Number of linting threads, auto to choose automatically, off for no multithreading - default: off\n    \n",
   "options": [
     "--config",

package/lib/watch/esm-resolve-registration.js

@@ -0,0 +1,27 @@
+// we want to allow starting projects with having nothing but a global cds-dk installed in a watched context.
+// In that case, we want to fall back to resolving internal packages from the global cds-dk's own node_modules.
+// Enriching NODE_PATH can be used in CJS (require(...)), but not in ESM (import ... from and import(...)),
+// which requires a custom loader instead.
+// https://nodejs.org/api/esm.html#no-node_path
+const { createRequire, registerHooks } = require('node:module')
+const { pathToFileURL } = require('node:url')
+
+const ourModules = new Set(['@sap/cds'])
+
+const requireFromHere = createRequire(__filename)
+const resolveFromHere = url => pathToFileURL(requireFromHere.resolve(url)).href
+
+registerHooks({
+    resolve(specifier, context, nextResolve) {
+        try {
+            // use default Node resolver first.
+            // Note: registering more hooks is UB!
+            return nextResolve(specifier, context)
+        } catch (error) {
+            if (error.code === 'ERR_MODULE_NOT_FOUND' && ourModules.has(specifier)) {
+                return { url: resolveFromHere(specifier), shortCircuit: true }
+            }
+            throw error
+        }
+    }
+})

package/lib/watch/vite-watch.js

@@ -79,7 +79,7 @@ cds.on('bootstrap', app => {
 
     for (const viteApp of viteApps) {
       const base = viteApp.root ? '/' : normalizeBase(viteApp.name)
-      const server = await createServer({ base, root: viteApp.path, server: { middlewareMode: true, hmr: { port: hmrPort++ } }})
+      const server = await createServer({ base, root: viteApp.path, server: { middlewareMode: true, ws: { port: hmrPort++ } }})
       viteServers.push({ base, root: viteApp.root, middlewares: server.middlewares })
     }
 

package/node_modules/@sap/cds/CHANGELOG.md

@@ -4,6 +4,15 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 10.0.4 - 2026-07-21
+
+### Fixed
+
+- Default language fallbacks for incomplete `i18n` bundles in Java projects
+- `srv.on/before('READ',...)` handlers registered with a cds-typer singular entity proxy were erroneously rewritten to event `each`
+- Asynchronous plugins (exporting a Promise) were not awaited in ESM projects
+- Fixed context propagation for local app and remote service calls 
+
 ## Version 10.0.3 - 2026-07-02
 
 ### Fixed

package/node_modules/@sap/cds/lib/env/defaults.js

@@ -133,6 +133,7 @@ module.exports = exports = {
     ],
     /** @deprecated */ fallback_bundle: '',
     /** @deprecated */ fatjson: false, // REVISIT: remove in cds^11
+    '[java]': { fatjson: true },
   },
 
   odata: {

package/node_modules/@sap/cds/lib/plugins.js

@@ -36,9 +36,11 @@ exports.activate = async function (plugins = cds.env?.plugins || exports.fetch()
   }
   await Promise.all (all.map (([n,c]) => n in prioritized && _load(n,c)))
   await Promise.all (all.map (([n,c]) => n in prioritized || _load(n,c)))
-  function _load (plugin, conf) {
+  async function _load (plugin, conf) {
     DEBUG?.log(`[cds.plugins] - loading ${plugin}:`, { impl: local(conf.impl) })
-    return cds.utils._import (conf.impl)
+    const module = await cds.utils._import (conf.impl)
+    if (module?.default) await module.default
+    return module
   }
   DEBUG?.timeEnd ('[cds.plugins] - loaded plugins in')
   return plugins

package/node_modules/@sap/cds/lib/srv/srv-handlers.js

@@ -48,7 +48,7 @@ class EventHandlers {
       return srv
     }
     else if (typeof path === 'object') {
-      if (path.is_singular && event === 'READ') event = 'each' //> srv.after ('READ', Book, ...) w/ Book is a singular def from cds-typer
+      if (phase === 'after' && path.is_singular && event === 'READ') event = 'each' //> srv.after ('READ', Book, ...) w/ Book is a singular def from cds-typer
       path = path.name || cds.error.expected `${{path}} to be a string or an entity's CSN definition`
     }
     else if (typeof path === 'string') {

package/node_modules/@sap/cds/libx/_runtime/common/Service.js

@@ -66,7 +66,7 @@ class ApplicationService extends cds.Service {
       // we need to provide target explicitly because it's cached within ensure_target
       const target = cds.infer.target(query, this)
       const _req = new cds.Request({ query, target, _resolved: true })
-      return this.handle(_req).then(result => postProcess(_req, result, this))
+      return this.dispatch(_req).then(result => postProcess(_req, result, this))
     }
 
     // async

package/node_modules/@sap/cds/libx/_runtime/remote/Service.js

@@ -317,7 +317,7 @@ class RemoteService extends cds.Service {
       // we need to provide target explicitly because it's cached within ensure_target
       const target = cds.infer.target(query, this)
       const _req = new cds.Request({ query, target, _resolved: true, headers: req.headers, method: req.method })
-      return this.handle(_req).then(result => postProcess(_req, result, this, true))
+      return this.dispatch(_req).then(result => postProcess(_req, result, this, true))
     }
 
     // we need to post process if alias was explicitly set in query

package/node_modules/@sap/cds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "10.0.3",
+  "version": "10.0.4",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [