@sap/cds-dk 10.1.0 → 10.1.1

package/node_modules/@sap/cds-compiler/lib/transform/translateAssocsToJoins.js

@@ -612,7 +612,7 @@ function translateAssocsToJoins(model, inputOptions = {}) {
           args.push({
             op: { val: '=' },
             args: [ constructPathNode( [ srcAlias, prefixFK(assoc.$elementPrefix, assoc.$flatSrcFKs[i]) ] ),
-              constructPathNode( [ tgtAlias, assoc.$flatTgtFKs[i] ] ) ],
+              constructPathNode( [ tgtAlias, resolveTgtFKToAlias(assoc.$flatTgtFKs[i], tgtAlias) ] ) ],
           });
         }
         return parenthesise((args.length > 1 ? { op: { val: 'and' }, args } : args[0] ));
@@ -808,7 +808,19 @@ function translateAssocsToJoins(model, inputOptions = {}) {
         const assocSource = assoc._main;
         if (assoc.kind === 'mixin' && (i > 0 || fwdTarget !== assocSource) && fwdOrigin.kind !== 'mixin') {
           const tas = Object.values(env.lead.$tableAliases);
-          const j = tas.findIndex(ta => ta._artifact === fwdOrigin.target._artifact);
+          // The backlink association's target may be reached through a view
+          // over it, whose alias is not the target artifact itself; fall back
+          // to the alias whose `_origin` chain reaches the target.
+          let j = tas.findIndex(ta => ta._artifact === fwdOrigin.target._artifact);
+          if (j < 0) {
+            j = tas.findIndex((ta) => {
+              for (let a = ta._artifact; a; a = a._origin) {
+                if (a === fwdOrigin.target._artifact)
+                  return true;
+              }
+              return false;
+            });
+          }
           if (j >= 0 && tas[j].$QA) {
             newTgtAlias.id = tas[j].$QA.name.id;
             newTgtAlias._artifact = tas[j]._effectiveType;
@@ -1061,6 +1073,21 @@ function translateAssocsToJoins(model, inputOptions = {}) {
         const backlink = backlinkAssoc.$backlink;
         return backlink && (backlink.foreignKeys || backlink.on) ? backlink : fwdAssoc;
       }
+
+      // Resolve the target foreign key to the alias of the target table.
+      // If the target foreign key is not found in the scope of the target alias,
+      // try to find it in the origin chain of the foreign key artifact.
+      function resolveTgtFKToAlias( fk, tgtAlias ) {
+        const env = tgtAlias && (tgtAlias._effectiveType || tgtAlias._artifact);
+        const scope = env && env.elements;
+        if (!scope || !fk || scope[fk.id] || !fk._artifact || !fk._artifact._origin)
+          return fk;
+        for (let o = fk._artifact._origin; o; o = o._origin) {
+          if (o.name && scope[o.name.id])
+            return { id: o.name.id, _artifact: fk._artifact, acc: fk.acc };
+        }
+        return fk;
+      }
     } // createOnCondition
   } // createJoinQA
 

package/node_modules/@sap/cds-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "7.1.0",
+  "version": "7.1.1",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",

package/node_modules/@sap/cds-mtxs/CHANGELOG.md

@@ -6,6 +6,39 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 4.1.0 - 2026-09-04
+
+### Added
+
+- Beta: Multitenant provisioning now supports HANA Cloud serverless, resolving one HDI container per tenant through the serverless Tenant API.
+- Beta: The MTX job service can now use native javascript workers to make the MTX sidecar more responsive while jobs (e. g. tenant upgrade) are running.
+Native workers can be enabled by `nativeWorkers` in the jobs configuration, e. g.
+  ```jsonc
+  "cds.xt.SaasProvisioningService":  {
+        "jobs": {
+          "nativeWorkers": true,
+          "workerSize": 3,
+          "clusterSize": 3
+        }
+      },
+  ```
+  - With configuration `cds.requires['cds.xt.SaasProvisioning'].upgrade.skipAlreadyUpgraded: true` or `cds.requires['cds.xt.SmsProvisioning'].upgrade.skipAlreadyUpgraded: true`,
+already upgraded tenants are skipped when running an upgrade of all tenants (`tenants: ['*']`). Tenants are considered as already upgraded if the last upgrade was run after the
+last deployment of the application.
+
+### Fixed
+
+- `SmsProvisioningService` certificate check is now better aligned with the Java implementation.
+- Extension validation checks have been refined.
+- `POST /-/cds/model-provider/getEdmx` now checks the requested service name more exactly.
+- Callback url for Saas Registry and Subscription Manager is now determined in a more robust way.
+
+## Version 4.0.4 - 2026-08-21
+
+### Fixed
+
+- Version bump
+
 ## Version 4.0.3 - 2026-08-21
 
 ### Added
@@ -20,6 +53,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 - HANA credential health-check now detects the available driver via `require.resolve()` instead of reading `package.json`, fixing `MODULE_NOT_FOUND` for apps that follow the "Plug & Play" guidance and don't declare `hdb` or `@sap/hana-client` directly.
 - Tenant upgrade now reports a clear per-tenant `422` error when a stored extension is incompatible with the changed base model, instead of aborting with an uncaught compilation error.
+- `cds-mtx-migrate` now runs more robust with uncommon model configurations.
 
 ## Version 4.0.2 - 2026-08-07
 

package/node_modules/@sap/cds-mtxs/bin/cds-mtx-migrate.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 /* eslint-disable no-console */
 
+const cds = require('@sap/cds')
+const { _import, isfile, local, path } = cds.utils
+
 async function run(param, options) {
     const { dry, genTenantList, syncTenantList, cleanup, directory, tag, tagRule } = options
     const skipVerification = options['skip-verification'] || options.skipVerification
@@ -26,7 +29,6 @@ async function run(param, options) {
         _handleError(`The migration from @sap/cds-mtx to @sap/cds-mtxs has been removed. Only --init-tenant-list and --sync-tenant-list are still supported.`)
     }
 
-    const cds = require('@sap/cds')
     const { syncTenantList: synchronizeTenantList, _hasMtEnv } = require('../lib/migration/migration')
 
     async function cds_mtx_migrate(tenants, options) {
@@ -45,11 +47,20 @@ async function run(param, options) {
             services.push('@sap/cds-mtxs/srv/extensibility-service')
         }
 
-        await cds.connect.to('db')
-        await cds.serve(services)
-        cds.env.requires.multitenancy = cds.env.requires.multitenancy || true // needed for current sidecar config that only enables services
+        await _local_server_js()
+        cds.emit ('bootstrap')
+        const model = await cds.load([...services, '@sap/cds-mtxs/db/extensions'])
+        cds.model = cds.compile.for.nodejs(model)
+        const d = 'cds.xt.DeploymentService'
+        const unserved = !cds.services[d]
+        if (unserved) {
+            await cds.serve(services)
+        }
+        await cds.plugins
+
+        await cds.emit('served', cds.services)
 
-        await cds.emit('served')
+        cds.env.requires.multitenancy ??= true // needed for current sidecar config that only enables services
 
         if (genTenantList) {
             const tenantListResult = await synchronizeTenantList(tenantList, options)
@@ -73,6 +84,16 @@ async function run(param, options) {
     await cds_mtx_migrate(param, options).catch(console.error)
 }
 
+// copied from cds.serve
+async function _local_server_js() {
+    const _local = file => isfile(file) || isfile (path.join(cds.env.folders.srv,file))
+    const cli_js = process.env.CDS_TYPESCRIPT && _local('cli.ts') || _local('cli.js')
+    if (cli_js) {
+      console.log ('[cds] - loading server from', { file: local(cli_js) })
+      await _import(cli_js)
+    }
+  }
+
 function getParameterValue(options, parameter) {
    const index = options.indexOf(parameter)
    const value = (index > -1) ? options[index + 1] : undefined

package/node_modules/@sap/cds-mtxs/bin/cds-mtx.js

@@ -78,6 +78,9 @@ async function cds_mtx(cmd, tenant, body) {
             cds.db.disconnect(cds.env.requires.multitenancy.t0 ?? 't0')
             for (const t of connectedTenants) cds.db.disconnect(t)
         }
+        if (isCli) {
+            await cds.exit()
+        }
     }
 }
 

package/node_modules/@sap/cds-mtxs/lib/utils.js

@@ -104,14 +104,15 @@ function authUrl(baseUrl, subdomain, pathname) {
   return u
 }
 
-async function token(credentials, { query = {}, form = {}, subdomain } = {}) {
+async function token(credentials, { query = {}, form = {}, subdomain, path = '/oauth/token' } = {}) {
   const { clientid, clientsecret, certurl, url, certificate, key } = credentials ?? {}
   if (!form.grant_type) throw cds.error('grant_type is required', { status: 400 })
-  const u = authUrl(certurl || url, subdomain, '/oauth/token')
+  const u = authUrl(certurl || url, subdomain, path)
   Object.entries(query).forEach(([k, v]) => u.searchParams.append(k, v))
   const body = new URLSearchParams({ client_id: clientid, ...form })
   const headers = { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' }
   let raw
+  const _fail = (statusCode, respBody) => new Error(`token request to ${u.origin}${u.pathname} for client ${clientid} failed (${statusCode}): ${respBody}`, { status: statusCode })
   if (certificate) {
     raw = await new Promise((resolve, reject) => {
       const req = require('node:https').request({
@@ -126,7 +127,7 @@ async function token(credentials, { query = {}, form = {}, subdomain } = {}) {
         res.on('data', x => chunks.push(x))
         res.on('end', () => {
           if (res.statusCode >= 200 && res.statusCode < 300) resolve(Buffer.concat(chunks).toString())
-          else reject(new Error(Buffer.concat(chunks).toString(), { status: res.statusCode }))
+          else reject(_fail(res.statusCode, Buffer.concat(chunks).toString()))
         })
       })
       req.on('error', reject)
@@ -176,7 +177,7 @@ async function fetchResiliently(url, req, { retriesLeft = maxRetries, maxRetryAf
     const data = contentType.includes('application/json') ? await res.json() : await res.text()
 
     if (!res.ok) {
-      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause].filter(Boolean).join(' – ')
+      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause, typeof data?.details === 'object' ? JSON.stringify(data.details) : data?.details].filter(Boolean).join(' – ')
       if (res.status === 429 && res.headers.get('retry-after')) msg += ` – retry after ${res.headers.get('retry-after')}`
       throw Object.assign(new Error(msg), { status, statusText, headers, code: data?.error?.code })
     }

package/node_modules/@sap/cds-mtxs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-mtxs",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "description": "SAP Cloud Application Programming Model - Multitenancy library",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds-mtxs/srv/cf/abstract-provisioning-service.js

@@ -5,6 +5,7 @@ const { fetchResiliently, token } = require('../../lib/utils')
 const DeploymentService = 'cds.xt.DeploymentService'
 const JobsService = 'cds.xt.JobsService'
 const Tenants = 'cds.xt.Tenants'
+const { SKIPPED_DB } = require('../jobs-service')
 
 // we need to run in multitenancy mode for t0 ops
 if (!cds.env.requires.multitenancy) cds.env.requires.multitenancy = true
@@ -112,9 +113,9 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     )).map(({ ID, metadata, createdAt, modifiedAt }) => ({ subscribedTenantId: ID, ...this._toMetadataJson(metadata, ID), createdAt, modifiedAt }))
   }
 
-  async _getTenants() {
+  async _getTenants(options) {
     const ds = await cds.connect.to(DeploymentService)
-    const all = await ds.getTenants()
+    const all = await ds.getTenants(options)
     if (cds.env.requires[this.name]?.upgrade?.ignoreNonExistingContainers) {
       const containers = await ds.getContainers()
       return all.filter(t => containers.includes(t))
@@ -129,9 +130,37 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const all = tenantIds.includes('*')
     const sharedGenDir = !main.requires.extensibility
     if (sharedGenDir) options.skipResources ??= sharedGenDir
-    const tenants = all ? await this._getTenants() : tenantIds
+
+    // Merge static upgrade config with dynamic options (dynamic takes precedence)
+    const upgradeConfig = cds.env.requires[this.name]?.upgrade
+    if (upgradeConfig) {
+      options.upgrade = cds.utils.merge({ ...upgradeConfig }, options.upgrade)
+    }
+
+    // Determine skipAfter: from explicit option or derived from package.json mtime
+    let skipAfter = options?.upgrade?.skipAfter
+    if (!skipAfter && options?.upgrade?.skipAlreadyUpgraded) {
+      const { stat } = require('fs/promises')
+      const { mtime } = await stat(cds.root + '/package.json')
+      skipAfter = mtime.toISOString()
+    }
+
+    const tenantsOptions = skipAfter ? { skipAfter } : undefined
+    let tenants
+    let skipped = []
+    if (all) {
+      tenants = await this._getTenants(tenantsOptions)
+    } else if (skipAfter) {
+      const upgradeable = await this._getTenants(tenantsOptions)
+      tenants = tenantIds.filter(t => upgradeable.includes(t))
+      // Requested tenants filtered out by skipAfter are considered already upgraded.
+      skipped = tenantIds.filter(t => !upgradeable.includes(t))
+    } else {
+      tenants = tenantIds
+    }
+
     const { isSync } = this._parseHeaders(cds.context.http?.req.headers)
-    if (!tenants.length && isSync) return
+    if (!tenants.length && !skipped.length && isSync) return
     if (sharedGenDir && cds.requires.db.kind === 'hana') { // REVISIT: Ideally part of HANA plugin
       const { resources4, csvs4, directory4 } = require('../plugins/hana')
       const out = await directory4('base', true)
@@ -141,13 +170,26 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const { 'cds.xt.DeploymentService': ds } = cds.services
     const js = await cds.connect.to(JobsService)
     const { clusterSize = 3 } = js._config()
-    const dbToTenants = (clusterSize > 1 && ds) ? await ds.tenantsByDb(tenants) : [new Set(tenants)]
-    LOG.info('upgrading', { tenants })
+    const dbToTenants = (tenants.length && clusterSize > 1 && ds) ? await ds.tenantsByDb(tenants) : [new Set(tenants)]
+    // Skipped tenants go into a separate pseudo-db cluster so JobsService records them (and their
+    // tasks) as FINISHED without upgrading.
+    let clusters = dbToTenants
+    if (skipped.length) {
+      // Normalize array-form to a db-id-keyed object so skipped tenants get their own cluster.
+      clusters = { ...dbToTenants }
+      // Drop skipped tenants from regular clusters (some tenantsByDb impls ignore the tenant list).
+      const skippedSet = new Set(skipped)
+      for (const db of Object.keys(clusters)) {
+        clusters[db] = new Set([...clusters[db]].filter(t => tenants.includes(t) && !skippedSet.has(t)))
+      }
+      clusters[SKIPPED_DB] = skippedSet
+    }
+    LOG.info('upgrading', { tenants, skipped })
 
 
     return await new Promise((resolve, reject) => {
       const tx = js.tx({ tenant: cds.context.tenant, user: new cds.User.Privileged() })
-      const job = tx.enqueue(DeploymentService, 'upgrade', dbToTenants, { options }, async error => {
+      const job = tx.enqueue(DeploymentService, 'upgrade', clusters, { options }, async error => {
         if (error) {
           await this._sendCallback('FAILED', `Tenant upgrade failed with error '${error}'`)
           if (isSync) reject(new Error(error))
@@ -303,4 +345,17 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const cred = s?.credentials ?? multitenancy?.credentials ?? {}
     return cred
   }
+
+  _resolveCallbackUrl(callbackPath, baseUrl) {
+    if (!callbackPath || !baseUrl) return undefined
+    if (typeof callbackPath !== 'string' || !/^\/(?![/\\])/.test(callbackPath) || callbackPath.includes('\\')) {
+      throw cds.error(`Invalid callback path: ${callbackPath}`, { status: 400 })
+    }
+    const base = new URL(baseUrl)
+    const resolved = new URL(callbackPath, base)
+    if (resolved.origin !== base.origin) {
+      throw cds.error(`Invalid callback path: ${callbackPath}`, { status: 400 })
+    }
+    return resolved.toString()
+  }
 }

package/node_modules/@sap/cds-mtxs/srv/cf/saas-provisioning-service.js

@@ -28,7 +28,7 @@ module.exports = class SaasProvisioningService extends require('./abstract-provi
   _parseHeaders(headers) {
     const { prefer, status_callback, mtx_status_callback } = headers ?? {}
     const { saas_registry_url } = this._getCredentials()
-    const callbackUrl = mtx_status_callback ?? (status_callback && saas_registry_url && new URL(status_callback, saas_registry_url).toString())
+    const callbackUrl = mtx_status_callback ?? this._resolveCallbackUrl(status_callback, saas_registry_url)
     return {
       callbackUrl,
       isCustomCallback: !!mtx_status_callback,

package/node_modules/@sap/cds-mtxs/srv/cf/sms-provisioning-service.js

@@ -53,7 +53,7 @@ module.exports = class SmsProvisioningService extends require('./abstract-provis
     _parseHeaders(headers) {
         const { prefer, status_callback } = headers ?? {}
         const { subscription_manager_url } = this._getCredentials()
-        const callbackUrl = (status_callback && subscription_manager_url && new URL(status_callback, subscription_manager_url).toString())
+        const callbackUrl = this._resolveCallbackUrl(status_callback, subscription_manager_url)
         return {
             callbackUrl,
             isSync: !(prefer?.includes('respond-async') || callbackUrl)
@@ -102,11 +102,31 @@ module.exports = class SmsProvisioningService extends require('./abstract-provis
         const isIssuerValid = isValid(callback_certificate_issuer, cert.issuer)
         const isSubjectValid = isValid(callback_certificate_subject, cert.subject)
 
+        function parseDN(dn) {
+            // Node's X509Certificate.issuer/subject uses newline as RDN separator.
+            // Each line is a single "attribute=value" pair. Multiple lines with the
+            // same attribute (e.g. multiple OU= entries) are all collected into an array.
+            const fields = {}
+            for (const line of dn.split('\n')) {
+                const eq = line.indexOf('=')
+                if (eq === -1) continue
+                const attr = line.slice(0, eq).trim().toUpperCase()
+                const val = line.slice(eq + 1).trim()
+                if (fields[attr]) fields[attr].push(val)
+                else fields[attr] = [val]
+            }
+            return fields
+        }
+
         function isValid(expected, fromCert) {
+            const certFields = parseDN(fromCert)
             return Object.entries(JSON.parse(expected)).every(([k, v]) => {
                 if (v === '*') return true
-                if (Array.isArray(v)) return v.some(v => fromCert.includes(`${k}=${v}`))
-                else return fromCert.includes(`${k}=${v}`)
+                const certVals = certFields[k.toUpperCase()] ?? []
+                // For array expected values every element must be present in the cert.
+                // For a scalar expected value the cert must contain that exact value.
+                if (Array.isArray(v)) return v.every(allowed => certVals.includes(allowed))
+                else return certVals.includes(v)
             })
         }
 

package/node_modules/@sap/cds-mtxs/srv/extensibility/compat/update.js

@@ -1,9 +1,15 @@
 const cds = require('@sap/cds')
+const { path } = cds.utils
 module.exports = (srv) => {
     // mainly normalizing the input
     srv.before(['UPDATE', 'UPSERT'], 'Extensions', req => { // must be synchronous to be handled first
         const { csn: extension, i18n: bundles, csvs: csvData } = req.data
 
+        // reject file names with path components (path traversal, see DbAdapter.put)
+        for (const files of [bundles, csvData]) {
+            if (Array.isArray(files)) files.forEach(_assertPlainFileName)
+        }
+
         // Validation of extension
         if (!extension) throw new cds.error({ message: 'Property "extension" is missing', code: 400 })
         if (Array.isArray(extension)) {
@@ -41,6 +47,15 @@ module.exports = (srv) => {
         req.data.csn = extCsn
     })
 
+    // rejects a FILE name that is not a plain file name (prevents path traversal)
+    const _assertPlainFileName = function (file) {
+        const name = file?.name
+        if (typeof name !== 'string' || !name.length) return
+        if (path.isAbsolute(name) || name.includes('/') || name.includes('\\') || path.basename(name) !== name) {
+            throw new cds.error({ message: `Invalid file name: "${name}"`, code: 400 })
+        }
+    }
+
     const _isCSN = str => str.substring(0, 1) === '{'
 
     const _mergeCSN = function (extension, merged) {

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/annotations.js

@@ -143,8 +143,8 @@ module.exports = class AnnotationsChecker {
          // get element permissions from allowlist
         const kind = this._getExtendedKind(fullCsn, extCsn, entityOrService)
         const permissions = allowList.getPermission(kind, entityOrService)
-        // check if annotation is allowed
-        if (permissions && permissions.annotations && permissions.annotations.includes(annotationName)) return null
+        // skip only this annotation; keep checking the remaining ones on the same element
+        if (permissions && permissions.annotations && permissions.annotations.includes(annotationName)) continue
 
         const fn = checkedExtensionAnnotations.get(annotationName) ?? _createGenericAnnotationWarning
         const warning = fn(annotationName, annotation);

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/config.js

@@ -2,6 +2,8 @@ const EXTENSION_ALLOWLIST = 'extension-allowlist'
 
 const PROTECTED_NAMESPACES = ['cds.xt']
 
+module.exports.PROTECTED_NAMESPACES = PROTECTED_NAMESPACES
+
 const BUILT_IN_NAMESPACES = ['cds.core', 'cds.outbox'] //> cds.outbox for legacy apps
 
 module.exports.isBuiltIn = (name) => {

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/index.js

@@ -4,6 +4,7 @@ const { deduplicateMessages } = require('@sap/cds-compiler')
 const NamespaceChecker = require('./namespace')
 const AnnotationsChecker = require('./annotations')
 const AllowlistChecker = require('./allowlist')
+const ProtectedNamespaceChecker = require('./protected-namespace')
 
 const customLinters = []
 
@@ -39,6 +40,7 @@ module.exports.lint = (extCsn, fullCsn, env = cds.env, cloneExt = false) => {
   const reflectedFullCsn = cds.reflect(fullCsn)
   const compileBaseDir = cds.root
   const messages = [
+    ...new ProtectedNamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new NamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new AnnotationsChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options, extCsn),
     ...new AllowlistChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options)

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/protected-namespace.js

@@ -0,0 +1,45 @@
+const LinterMessage = require('./message')
+const { PROTECTED_NAMESPACES } = require('./config')
+
+function _protectedNamespaceOf(name) {
+  if (!name) return null
+  return PROTECTED_NAMESPACES.find(ns => name === ns || name.startsWith(`${ns}.`)) ?? null
+}
+
+function locationString(element) {
+  const loc = element?.$location
+  if (!loc) return ''
+  const line = loc.line ? `${loc.line}:` : ''
+  return loc.col ? `${loc.file}:${line}${loc.col}:` : `${loc.file}:${line}`
+}
+
+// Rejects defining, extending or annotating artifacts in a protected namespace (e.g. 'cds.xt').
+// Runs unconditionally, independent of linter configuration.
+module.exports = class ProtectedNamespaceChecker {
+
+  // eslint-disable-next-line no-unused-vars
+  check(reflectedCsn, fullCsn, compileDir, mtxConfig) {
+    const messages = []
+
+    for (const name of Object.keys(reflectedCsn.definitions ?? {})) {
+      if (_protectedNamespaceOf(name)) {
+        messages.push(this._createWarning(name, reflectedCsn.definitions[name]))
+      }
+    }
+
+    for (const extension of reflectedCsn.extensions ?? []) {
+      const target = extension.extend ?? extension.annotate
+      if (_protectedNamespaceOf(target)) {
+        messages.push(this._createWarning(target, extension))
+      }
+    }
+
+    return messages
+  }
+
+  _createWarning(name, element) {
+    const namespace = _protectedNamespaceOf(name)
+    const message = `Extending, annotating or defining '${name}' in the protected namespace '${namespace}' is not supported in extensions`
+    return new LinterMessage(locationString(element) + message, element)
+  }
+}

package/node_modules/@sap/cds-mtxs/srv/extensibility-service.js

@@ -58,7 +58,12 @@ class DbAdapter {
       try {
         const root = await mkdirp(path.join(temp, 'data'))
         for (const csv in ext.csvs) {
-          await write(path.join(root, csv), ext.csvs[csv])
+          // defense-in-depth: 'csv' is user-supplied and must not escape 'root'
+          const target = path.join(root, csv)
+          if (path.relative(root, target).match(/^\.\.($|[/\\])/) || path.isAbsolute(path.relative(root, target))) {
+            throw Error(`Invalid file name: "${csv}"`)
+          }
+          await write(target, ext.csvs[csv])
         }
         ext.archive = await tar.cz(temp)
       } finally {
@@ -74,7 +79,7 @@ class DbAdapter {
     const csn = JSON.stringify(ext.csn)
     const i18n = ext.i18n ? JSON.stringify(ext.i18n) : null
     const tag = ext.ID
-    await cds.tx({ tenant, user: new cds.User.Privileged() }, async tx => {
+    await cds.tx({ tenant }, async tx => {
       // remove current inactive extension with tag
       if (tag) await tx.run(DELETE.from('cds.xt.Extensions').where({ tag, activated: { '!=': this.activated(ACTIVE) } }))
       // will break with missing appid
@@ -455,7 +460,7 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
     let extEntry
     try {
       // TODO: handle '*'?
-      await cds.tx(async () => {
+      await cds.tx({ tenant },async () => {
         // use native table names to avoid issues with missing appid
         extEntry = await SELECT(['ID','csn', 'tag','activated']).one.from('cds.xt.Extensions').where({ tag, activated: { '!=': 'database' } }).forUpdate() // select only entries with activated != 'database'
         if (!extEntry) {