@sap/cds-dk 10.0.5 → 10.0.7

package/node_modules/@cap-js/openapi/lib/compile/diagram.js

@@ -6,7 +6,7 @@ const { isIdentifier, nameParts } = require('./csdl');
 
 /**
  * Diagram representation of property cardinality
- * @param {object} typedElement Typed model element, e.g. property
+ * @param {*} typedElement Typed model element, e.g. property
  * @return {string} cardinality
  */
 function cardinality(typedElement) {
@@ -14,7 +14,7 @@ function cardinality(typedElement) {
 }
 
 class Diagram {
-    /** @type {import('./csdl').CSDLMeta} */
+    /** @type {*} */
     #meta
     #comma = ''
     // TODO: make colors configurable
@@ -26,7 +26,7 @@ class Diagram {
 
     /**
      * Construct resource diagram using web service at https://yuml.me
-     * @param {object} entityContainer Entity Container object
+     * @param {*} entityContainer Entity Container object
      * @return {string} resource diagram
      */
     getResourceDiagram(entityContainer) {
@@ -86,7 +86,7 @@ class Diagram {
     /**
      * Diagram representation of action or function overload
      * @param {string} name Name of action or function import
-     * @param {object} overload Action or function overload
+     * @param {*} overload Action or function overload
      * @return diagram part
      */
     #overloadDiagram(name, overload) {

package/node_modules/@cap-js/openapi/lib/compile/types.d.ts

@@ -23,7 +23,9 @@ type BooleanSchema = {
 
 type ArraySchema = {
     type: 'array',
-    items: Schema
+    items: Schema,
+    minItems?: number,
+    maxItems?: number
 }
 
 type ObjectSchema = {

package/node_modules/@cap-js/openapi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/openapi",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "CAP tool for OpenAPI",
   "repository": {
     "type": "git",
@@ -36,9 +36,9 @@
   },
   "devDependencies": {
     "@mermaid-js/mermaid-cli": "^11.12.0",
-    "@types/node": "^25.0.3",
+    "@types/node": "^26.1.1",
     "eslint": "^10.4.1",
     "globals": "^17.6.0",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   }
 }

package/node_modules/@sap/cds/CHANGELOG.md

@@ -4,6 +4,22 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 10.0.5 - 2026-07-28
+
+### Fixed
+
+- Messaging management requests to SAP Event Mesh or Event Mesh in SAP Integration Suite (EMIS) now always send a (possibly empty) body for `PUT`/`POST` requests, as required by EMIS (and compatible with SAP Event Mesh)
+- Only convert `@Common.Text` to `@cds.search` for service entities
+
+## Version 10.0.4 - 2026-07-21
+
+### Fixed
+
+- Default language fallbacks for incomplete `i18n` bundles in Java projects
+- `srv.on/before('READ',...)` handlers registered with a cds-typer singular entity proxy were erroneously rewritten to event `each`
+- Asynchronous plugins (exporting a Promise) were not awaited in ESM projects
+- Fixed context propagation for local app and remote service calls 
+
 ## Version 10.0.3 - 2026-07-02
 
 ### Fixed

package/node_modules/@sap/cds/lib/compile/for/nodejs.js

@@ -13,6 +13,7 @@ function _compile_for_nodejs (csn, o) {
   // @Common.Text → @cds.search
   text_to_search: for (const name in dsn.definitions) {
     const def = dsn.definitions[name]
+    if (!def._service) continue
     if (!def.associations) continue
 
     // if any @cds.search.* === true, @Common.Text should be ignored

package/node_modules/@sap/cds/lib/env/defaults.js

@@ -133,6 +133,7 @@ module.exports = exports = {
     ],
     /** @deprecated */ fallback_bundle: '',
     /** @deprecated */ fatjson: false, // REVISIT: remove in cds^11
+    '[java]': { fatjson: true },
   },
 
   odata: {

package/node_modules/@sap/cds/lib/plugins.js

@@ -36,9 +36,11 @@ exports.activate = async function (plugins = cds.env?.plugins || exports.fetch()
   }
   await Promise.all (all.map (([n,c]) => n in prioritized && _load(n,c)))
   await Promise.all (all.map (([n,c]) => n in prioritized || _load(n,c)))
-  function _load (plugin, conf) {
+  async function _load (plugin, conf) {
     DEBUG?.log(`[cds.plugins] - loading ${plugin}:`, { impl: local(conf.impl) })
-    return cds.utils._import (conf.impl)
+    const module = await cds.utils._import (conf.impl)
+    if (module?.default) await module.default
+    return module
   }
   DEBUG?.timeEnd ('[cds.plugins] - loaded plugins in')
   return plugins

package/node_modules/@sap/cds/lib/srv/srv-handlers.js

@@ -48,7 +48,7 @@ class EventHandlers {
       return srv
     }
     else if (typeof path === 'object') {
-      if (path.is_singular && event === 'READ') event = 'each' //> srv.after ('READ', Book, ...) w/ Book is a singular def from cds-typer
+      if (phase === 'after' && path.is_singular && event === 'READ') event = 'each' //> srv.after ('READ', Book, ...) w/ Book is a singular def from cds-typer
       path = path.name || cds.error.expected `${{path}} to be a string or an entity's CSN definition`
     }
     else if (typeof path === 'string') {

package/node_modules/@sap/cds/libx/_runtime/common/Service.js

@@ -66,7 +66,7 @@ class ApplicationService extends cds.Service {
       // we need to provide target explicitly because it's cached within ensure_target
       const target = cds.infer.target(query, this)
       const _req = new cds.Request({ query, target, _resolved: true })
-      return this.handle(_req).then(result => postProcess(_req, result, this))
+      return this.dispatch(_req).then(result => postProcess(_req, result, this))
     }
 
     // async

package/node_modules/@sap/cds/libx/_runtime/messaging/common-utils/authorizedRequest.js

@@ -22,9 +22,10 @@ const authorizedRequest = ({ method, uri, path, oa2, tenant, dataObj, headers, t
           method
         }
 
+        // EMIS management API requires a body for write requests, even if empty
         let data
-        if (dataObj) {
-          data = JSON.stringify(dataObj)
+        if (dataObj || method === 'PUT' || method === 'POST') {
+          data = JSON.stringify(dataObj ?? {})
           httpOptions.headers['Content-Type'] = 'application/json'
           httpOptions.headers['Content-Length'] = Buffer.byteLength(data)
         }

package/node_modules/@sap/cds/libx/_runtime/remote/Service.js

@@ -317,7 +317,7 @@ class RemoteService extends cds.Service {
       // we need to provide target explicitly because it's cached within ensure_target
       const target = cds.infer.target(query, this)
       const _req = new cds.Request({ query, target, _resolved: true, headers: req.headers, method: req.method })
-      return this.handle(_req).then(result => postProcess(_req, result, this, true))
+      return this.dispatch(_req).then(result => postProcess(_req, result, this, true))
     }
 
     // we need to post process if alias was explicitly set in query

package/node_modules/@sap/cds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "10.0.3",
+  "version": "10.0.5",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds-compiler/CHANGELOG.md

@@ -15,6 +15,18 @@ might use a deprecated flag only for a limited period of time.
 
 
 
+## Version 7.0.3 - 2026-07-21
+
+### Bug Fixes
+
+- **compiler:** When a backlink target is at least distantly related to the entity
+  embedding an association with a backlink comparison, the compiler issues a
+  warning ref-deprecated-backlink instead of reporting an error ref-invalid-backlink;
+  this is now also the case if the target entity is auto-exposed.
+- **sql:** Avoid dump in to.sql.migration with complex models.
+
+
+
 ## Version 7.0.2 - 2026-07-14
 
 ### Bug Fixes

package/node_modules/@sap/cds-compiler/lib/compiler/populate.js

@@ -1094,6 +1094,7 @@ function populate( model ) {
         elem._main?._ancestors?.includes( target )) {
       // source and target of the model association are the same entity, and
       // the current main artifact is a suitable auto-redirection target → return it
+      // TODO: check with auto-exposed entities (which do not have _ancestors)
       return elem._main;
     }
     const elemScope = preferredElemScope( target, service, elem, assoc._main || assoc );

package/node_modules/@sap/cds-compiler/lib/compiler/resolve.js

@@ -1240,7 +1240,7 @@ function resolve( model ) {
     if (chain)                  // standard correct case
       return;
 
-    if (target._ancestors) { // && assocHasForeignKeys( assoc.$backlink?._origin )) {
+    if (target._ancestors || target.$inferred === 'autoexposed') {
       // with non-cyclic projection ancestors, not only for managed assoc, but also
       // unmanaged, see test3/Associations/Backlinks/CrossEyedBacklink.sql-err.cds
       // Current entity is no valid redirection target for the backlink association

package/node_modules/@sap/cds-compiler/lib/model/csnUtils.js

@@ -920,12 +920,10 @@ const _dependents = Symbol('_dependents');
  * _dependencies: All artifacts this artifact depends on (because it has a ref to it)
  *
  * @param {CSN.Model} csn A CSN to enrich in-place
- * @param {object} refs csnRefs, only used for artifactRef
  * @returns {object} CSN with _dependents/_dependencies set, "cleanup" function, _dependents/_dependencies Symbol used
  */
-function setDependencies( csn, refs = csnRefs(csn) ) {
+function setDependencies( csn ) {
   const cleanup = [];
-  const { artifactRef } = refs;
 
   forEachDefinition(csn, (artifact, artifactName) => {
     const queries = getNormalizedQuery(artifact).query;
@@ -933,11 +931,18 @@ function setDependencies( csn, refs = csnRefs(csn) ) {
       initDependencies(artifact);
       forAllQueries(queries, (query) => {
         if (query.SELECT?.from) {
-          if (query.SELECT.from.args)
+          if (query.SELECT.from.args) {
             handleArgs(artifact, artifactName, query.SELECT.from.args);
-
-          else if (typeof query.SELECT.from === 'string' || query.SELECT.from.ref)
-            handleDependency(artifactRef.from(query.SELECT.from), artifact, artifactName);
+          }
+          else if (typeof query.SELECT.from === 'string') {
+            handleDependency(csn.definitions[query.SELECT.from], artifact, artifactName);
+          }
+          else if (query.SELECT.from.ref) {
+            if (query.SELECT.from.ref[0].id)
+              handleDependency(csn.definitions[query.SELECT.from.ref[0].id], artifact, artifactName);
+            else
+              handleDependency(csn.definitions[query.SELECT.from.ref[0]], artifact, artifactName);
+          }
         }
       }, [ 'definitions', artifactName, (artifact.projection ? 'projection' : 'query') ]);
     }
@@ -952,7 +957,7 @@ function setDependencies( csn, refs = csnRefs(csn) ) {
       if (arg.args)
         handleArgs(artifact, artifactName, arg.args);
       else if (arg.ref)
-        handleDependency(artifactRef.from(arg), artifact, artifactName);
+        handleDependency(csn.definitions[arg.ref[0].id ? arg.ref[0].id : arg.ref[0]], artifact, artifactName);
     }
   }
 

package/node_modules/@sap/cds-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "7.0.2",
+  "version": "7.0.3",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",

package/node_modules/@sap/cds-mtxs/CHANGELOG.md

@@ -6,6 +6,42 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 4.0.2 - 2026-08-07
+
+### Fixed
+
+- `PUT /-/cds/extensibility/Extensions/<id>` with a status that is not active (0 or 1), now returns the correct entry.
+- Extensions table is now resolved properly again when `cds.sql.names = quoted` is set.
+
+### Changed
+- When updating from `@sap/cds-mtxs@<3.6.0`, you now need to upgrade your tenant database before you can add new extensions.
+
+## Version 4.0.1 - 2026-06-23
+
+### Changed
+
+- Migration from `@sap/cds-mtx` has been removed.
+- Annotation `@Common.FieldControl` is now also blocked for extensions.
+- Annotations `@Capabilities.*` are now also blocked for extensions.
+- The MTX sidecar now logs a warning if `cds.sql` is configured differently in both the project root and the sidecar. By setting `cds.env.requires['cds.xt.ModelProviderService']['use-root-sql-config'] === true`,
+you can enforce the configuration of the project root.
+
+### Fixed
+
+- Default value 3 for `cds.requires.multitenancy.jobs.clusterSize` is now effective for upgrade. When using HANA TMS v2, the default for `clusterSize` is set to 1.
+
+## Version 3.9.6 - 2026-08-07
+
+### Fixed
+
+- Parallel single-tenant upgrades no longer fail with `tar: Cannot open: File exists` when extensibility is disabled.
+- Deployment to tenant containers is more stable with a large number of service bindings provided via `VCAP_SERVICES_FILE_PATH`.
+- More robust error handling for HDI deployment logs on read-only file system on Kyma.
+- Configuration `cds.requires.multitenancy.retries` is now effective.
+- Reading tenants no longer logs a spurious `Failed to parse metadata to JSON` error for tenants without metadata.
+- A tenant's HANA connection pool now reliably recovers once valid credentials are restored, as cache-bypassing Service Manager lookups no longer overwrite the shared bindings cache with transiently invalid credentials.
+- More robust handling of Service Manager errors.
+
 ## Version 3.9.5 - 2026-07-01
 
 ### Changed

package/node_modules/@sap/cds-mtxs/bin/cds-mtx-migrate.js

@@ -2,9 +2,32 @@
 /* eslint-disable no-console */
 
 async function run(param, options) {
+    const { dry, genTenantList, syncTenantList, cleanup, directory, tag, tagRule } = options
+    const skipVerification = options['skip-verification'] || options.skipVerification
+
+    function _handleError(message) {
+        console.log(message)
+        process.exit(1)
+    }
+
+    // Check for removed migration options
+    const removedOptions = []
+    if (cleanup) removedOptions.push('--cleanup')
+    if (directory) removedOptions.push('--directory')
+    if (tag) removedOptions.push('--tag')
+    if (tagRule) removedOptions.push('--tagRule')
+    if (skipVerification) removedOptions.push('--skip-verification')
+
+    if (removedOptions.length) {
+        _handleError(`The option(s) ${removedOptions.join(', ')} are no longer supported. The migration from @sap/cds-mtx to @sap/cds-mtxs has been removed.`)
+    }
+
+    if (!genTenantList && !syncTenantList) {
+        _handleError(`The migration from @sap/cds-mtx to @sap/cds-mtxs has been removed. Only --init-tenant-list and --sync-tenant-list are still supported.`)
+    }
+
     const cds = require('@sap/cds')
-    const { migrate,  cleanupMetatenants, syncTenantList: synchronizeTenantList, _hasMtEnv, getDbId } = require('../lib/migration/migration')
-    const { dry, cleanup, genTenantList, syncTenantList } = options
+    const { syncTenantList: synchronizeTenantList, _hasMtEnv } = require('../lib/migration/migration')
 
     async function cds_mtx_migrate(tenants, options) {
         if (!_hasMtEnv()) _handleError(`cds-mtx-migrate operation can only be run inside a multitenant application environment using @sap/cds-mtxs.`)
@@ -26,35 +49,9 @@ async function run(param, options) {
         await cds.serve(services)
         cds.env.requires.multitenancy = cds.env.requires.multitenancy || true // needed for current sidecar config that only enables services
 
-        // get and set database id
-        const deploymentServiceConfig = cds.env.requires['cds.xt.DeploymentService'] || {}
-        if (!deploymentServiceConfig.hdi?.create?.database_id) {
-            const foundDbId = await getDbId()
-            if (foundDbId) {
-                cds.env.requires['cds.xt.DeploymentService'] = {
-                    ...deploymentServiceConfig,
-                    hdi: { ...deploymentServiceConfig.hdi,
-                        create: {
-                            ...deploymentServiceConfig.hdi?.create,
-                            database_id: foundDbId
-                        }
-                    }
-                }
-            }
-        }
-
         await cds.emit('served')
 
-        if (cleanup) {
-            const deletedTenants = await cleanupMetatenants(tenantList, options)
-            for (let t of deletedTenants.connectedTenants) await cds.db.disconnect(t)
-            await cds.db.disconnect()
-
-            deletedTenants.logResult(dry)
-
-            // always fail gracefully
-            // if (deletedTenants.hasError) process.exit(1)
-        } else if (genTenantList) {
+        if (genTenantList) {
             const tenantListResult = await synchronizeTenantList(tenantList, options)
             for (let t of tenantListResult.connectedTenants) await cds.db.disconnect(t)
             await cds.db.disconnect()
@@ -66,22 +63,9 @@ async function run(param, options) {
             await cds.db.disconnect()
 
             tenantListResult.logResult(dry)
-        }else {
-            const migratedTenants = await migrate(tenantList, options)
-            for (let t of migratedTenants.connectedTenants) await cds.db.disconnect(t)
-            await cds.db.disconnect()
-
-            migratedTenants.logResult()
-            // make sure to get result != 0 so that potential followup scripts know of problems
-            if (migratedTenants.hasError) process.exit(1)
         }
     }
 
-    function _handleError(message) {
-        console.log(message)
-        process.exit(1)
-    }
-
     function _splitTenants(tenants) {
         return tenants.split(',')
     }
@@ -100,16 +84,16 @@ if (require.main === module) {
    // TODO use command line parser to get arguments
    // comma separated list of tenants
    const [, , tenants, ...options] = process.argv
-   const directory = getParameterValue(options, '-d')
-   const tag = getParameterValue(options, '--tag')
-   const tagRule = getParameterValue(options, '--tagRule')
    const dry = options.includes('--dry')
-   const cleanup = options.includes('--cleanup')
    const genTenantList = options.includes('--init-tenant-list')
    const syncTenantList = options.includes('--sync-tenant-list')
    const force = options.includes('--force')
+   const cleanup = options.includes('--cleanup')
    const skipVerification = options.includes('--skip-verification')
-   run(tenants, { directory, dry, force, tag, tagRule, "skip-verification": skipVerification, cleanup, genTenantList, syncTenantList }).catch(console.error)
+   const directory = getParameterValue(options, '-d') || getParameterValue(options, '--directory')
+   const tag = getParameterValue(options, '--tag')
+   const tagRule = getParameterValue(options, '--tagRule')
+   run(tenants, { dry, force, genTenantList, syncTenantList, cleanup, directory, tag, tagRule, 'skip-verification': skipVerification }).catch(console.error)
 } else {
-    module.exports.run = run
+     module.exports.run = run
 }

package/node_modules/@sap/cds-mtxs/bin/cds-mtx.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/* eslint-disable no-console */
 
 const cds = require('@sap/cds')
 const { _import, isfile, local, path } = cds.utils

package/node_modules/@sap/cds-mtxs/cds-plugin.js

@@ -6,6 +6,9 @@ if (major < 9) throw new Error('@sap/cds-mtxs 3 requires @sap/cds version 9 or h
 const cdscDefaults = Object.fromEntries(
     Object.entries(cds.env.defaults?.cdsc || {}).filter(([key]) => !key.startsWith('[') )
 )
+const sqlDefaults = Object.fromEntries(
+    Object.entries(cds.env.defaults?.sql || {}).filter(([key]) => !key.startsWith('[') )
+)
 
 require('./srv/extensibility/linter').legacyCheck()
 
@@ -28,3 +31,18 @@ if (main.env.cdsc && cds.env.requires['cds.xt.ModelProviderService']?._in_sideca
 } else {
     cds.env.cdsc = main.env.cdsc
 }
+
+if (cds.env.requires['cds.xt.ModelProviderService']?._in_sidecar === true) {
+    if (!(cds.env.requires['cds.xt.ModelProviderService']?.['use-root-sql-config'] === true)) {
+        const stringifiedSql = JSON.stringify(cds.env.sql)
+
+        if (stringifiedSql !== JSON.stringify(main.env.sql) && stringifiedSql !== JSON.stringify(sqlDefaults)) {
+            LOG.warn('inconsistent sql configuration: using cds.sql configuration of mtx sidecar')
+        }
+        // LATER: cds.env.sql = main.env.sql
+    } else {
+        cds.env.sql = main.env.sql
+    }
+} else {
+    cds.env.sql = main.env.sql
+}