@sap/cds-dk 10.1.0 → 10.1.2

package/node_modules/@sap/cds/CHANGELOG.md

@@ -4,6 +4,25 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 10.1.1 - 2026-09-17
+
+### Fixed
+
+- Messaging consumers (Event Mesh AMQP, Kafka, Redis) no longer crash with `TypeError: Cannot use 'in' operator to search for 'data' in null` when a message with a `null` payload is received
+- `cds.env` now correctly replaces an array default with an object project override instead of assigning object properties onto the array
+- SQLite now uses its default pool config (single, non-evicting connection) even when `@cap-js/sqlite` is installed globally rather than as a local dependency
+- Stripping of `IsActiveEntity` in programmatic deep updates to draft instances
+- Server crash when string keys contain control characters in OData `Location` response header
+- Binary keys in OData `Location` response header are now formatted as binary literals (`binary'...'`)
+- Skip periodic message processing when no provider tenant is configured
+- The parent-readable check during CREATE/navigation no longer swallows system errors (e.g. database failures); such errors are now propagated instead of being masked as a `404`
+- Support X.509 in `enterprise-messaging`'s deploy task
+- Incompatibility of global config `cds.sql.lock_acquire_timeout` and event-queue implementation
+- Outbox messages written before `appid` was introduced are now processed after an upgrade instead of being skipped
+- A queued outbox message whose target service cannot be resolved is now dead-lettered instead of crashing the application
+- Recurring scheduled tasks (`.every()`) are no longer resurrected when unscheduled while running, and re-submitting one while it runs no longer discards the updated schedule and payload
+- Convenience handling of `/$count` requests for custom handlers simply returning arrays
+
 ## Version 10.1.0 - 2026-09-02
 
 ### Added

package/node_modules/@sap/cds/common.cds

@@ -166,9 +166,9 @@ annotate managed with {
   createdBy  @Core.Immutable;
 }
 
-annotate sap.common.Countries  with { code @Common.Text:name; }
-annotate sap.common.Currencies with { code @Common.Text:name; }
-annotate sap.common.Languages  with { code @Common.Text:name; }
+annotate sap.common.Currencies :code with @Common.Text:name;
+annotate sap.common.Countries  :code with @Common.Text:name;
+annotate sap.common.Languages  :code with @Common.Text:name;
 
 
 //---------------------------------------------------------------------------

package/node_modules/@sap/cds/lib/compile/minify.js

@@ -93,7 +93,8 @@ class Minifier {
     let r = q.from.ref[0]; if (r.id) r = r.id; if (r in this.kept) return
     let e = this.defs[r]; if (!e) return
     let all = e.elements, kept = {}
-    if (q.columns) _keep (q.columns)
+    if (e['@cds.minify'] === 'unused-elements') return this.keep (r,e) // avoids propagation
+    if (q.columns) _keep (q.columns); else return this.keep (r,e)
     if (q.where) _keep (q.where)
     e.elements = kept
     return this.keep (r,e)
@@ -101,6 +102,7 @@ class Minifier {
       if (x.func) { _keep (x.args); continue }
       if (x.xpr) { _keep (x.xpr); continue }
       if (x.ref) { let [r] = x.ref; if (r in all) kept[r] = all[r] }
+      if (x === '*') return kept = all
     }}
   }
 

package/node_modules/@sap/cds/lib/env/cds-env.js

@@ -515,7 +515,7 @@ function _merge (dst, src, _profiles) {
     const v = pd.value
     if (typeof v === 'object' && !Array.isArray(v) && v != null) {
       if (!dst[p]) dst[p] = {}
-      if (typeof dst[p] !== 'object') dst[p] = v
+      if (typeof dst[p] !== 'object' || Array.isArray(dst[p])) dst[p] = v
       else _merge (dst[p], v, _profiles)
       continue
     }

package/node_modules/@sap/cds/lib/env/cds-requires.js

@@ -138,6 +138,7 @@ const _databases = {
 
   "sqlite": {
     impl: '@cap-js/sqlite', credentials: { url: 'db.sqlite' },
+    pool: { evictionRunIntervalMillis: 0, min: 1, max: 1 },
     ..._db_data,
   },
   "sqlite:memory": {

package/node_modules/@sap/cds/libx/_runtime/common/generic/crud.js

@@ -1,4 +1,5 @@
 const cds = require('../../cds')
+const LOG = cds.log('app')
 const { SELECT } = cds.ql
 
 module.exports = exports = cds.service.impl(function () {
@@ -18,7 +19,7 @@ module.exports = exports = cds.service.impl(function () {
       ? SELECT.one`1 as $parent`.from({ ref: ref.slice(0, -1) })
       : null
     const parent_readable_check = parent_exists_query
-      ? async () => (parent_skip_auth ? cds.db : this).run(parent_exists_query).catch(() => null)
+      ? async () => (parent_skip_auth ? cds.db : this).run(parent_exists_query).catch(parent_unreadable_error)
       : null
 
     if (req.event === 'CREATE' && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
@@ -84,6 +85,11 @@ async function legacy_behavior(req, result, parent) {
   }
 }
 
+function parent_unreadable_error(e) {
+  if (cds.error.isSystemError(e)) throw e
+  LOG._debug && LOG.debug('Parent readable check failed:', e)
+}
+
 exports._handle_result = legacy_behavior
 exports._always_return_arrays = on_off => {
   if (on_off === undefined) return exports._handle_result === new_behavior

package/node_modules/@sap/cds/libx/_runtime/common/utils/cqn.js

@@ -4,7 +4,7 @@ const { setEntityContained } = require('./csn')
 
 // scope: simple wheres à la "[{ ref: ['foo'] }, '=', { val: 'bar' }, 'and', ... ]"
 function where2obj(where, target = null, data = {}) {
-  for (let i = 0; i < where.length;) {
+  for (let i = 0; i < where.length; ) {
     const a = where[i++]
     if (a.xpr) {
       where2obj(a.xpr, target, data)

package/node_modules/@sap/cds/libx/_runtime/fiori/lean-draft.js

@@ -1090,7 +1090,7 @@ const draftHandle = async function (req) {
       for (const assoc in target.associations) {
         const val = data[assoc]
         if (val && typeof val === 'object') {
-          const _target = req.target.associations[assoc]._target
+          const _target = target.associations[assoc]._target
           if (Array.isArray(val)) {
             val.forEach(v => _rmIsActiveEntity(v, _target))
           } else {

package/node_modules/@sap/cds/libx/_runtime/messaging/common-utils/normalizeIncomingMessage.js

@@ -11,7 +11,7 @@ const _JSONorString = string => {
 const normalizeIncomingMessage = message => {
   const _payload = typeof message === 'object' ? message : _JSONorString(message)
   let data, headers
-  if (typeof _payload === 'object' && 'data' in _payload) {
+  if (_payload !== null && typeof _payload === 'object' && 'data' in _payload) {
     data = _payload.data
     headers = { ..._payload }
     delete headers.data

package/node_modules/@sap/cds/libx/_runtime/messaging/kafka.js

@@ -161,7 +161,7 @@ function _JSONorString(string) {
 function _normalizeIncomingMessage(message) {
   const _payload = _JSONorString(message)
   let data, headers
-  if (typeof _payload === 'object' && 'data' in _payload) {
+  if (_payload !== null && typeof _payload === 'object' && 'data' in _payload) {
     data = _payload.data
     headers = { ..._payload }
     delete headers.data

package/node_modules/@sap/cds/libx/http/location.js

@@ -8,14 +8,16 @@ module.exports = (target, srv, result, keys_as_segments) => {
 
   const keyValuePairs = filteredKeys.reduce((acc, key) => {
     const value = result[key]
-    if (result[key] === undefined) return acc
 
     if (Buffer.isBuffer(value)) {
-      acc[key] = value.toString('base64')
+      const base64 = value.toString('base64')
+      acc[key] = keys_as_segments ? base64 : `binary'${base64}'`
+    } else if (keys_as_segments) {
+      acc[key] = value
     } else {
-      const _type = target.elements[key]._type
-      if (!keys_as_segments && typeof value === 'string' && _type !== 'cds.UUID') acc[key] = `'${value}'`
-      else acc[key] = value
+      const el = target.elements[key]
+      const needsQuotes = typeof value === 'string' && (el._type !== 'cds.UUID' || el['@odata.Type'] === 'Edm.String')
+      acc[key] = needsQuotes ? `'${value}'` : value
     }
 
     return acc
@@ -24,19 +26,16 @@ module.exports = (target, srv, result, keys_as_segments) => {
   if (keys_as_segments) {
     let location = targetName
     for (const k in keyValuePairs) location += `/${keyValuePairs[k]}`
-    return location
+    return encodeURI(location)
   }
 
   let keys
   const entries = Object.entries(keyValuePairs)
   if (entries.length === 1) {
     keys = entries[0][1]
-    if (target.elements[entries[0][0]]['@odata.Type'] === 'Edm.String') keys = `'${keys}'`
   } else {
-    keys = entries
-      .map(([key, value]) => `${key}=${target.elements[key]['@odata.Type'] === 'Edm.String' ? `'${value}'` : value}`)
-      .join(',')
+    keys = entries.map(([key, value]) => `${key}=${value}`).join(',')
   }
 
-  return `${targetName}(${keys})`
+  return encodeURI(`${targetName}(${keys})`)
 }

package/node_modules/@sap/cds/libx/odata/middleware/read.js

@@ -126,7 +126,7 @@ const _isNullableSingleton = query => query._target._isSingleton && query._targe
 const _isToOneAssoc = query =>
   query.SELECT.from.ref.length > 1 && typeof query.SELECT.from.ref.slice(-1)[0] === 'string'
 
-const _getCountFromResult = result => (Array.isArray(result) ? (result[0].$count ?? 0) : (result.$count ?? 0))
+const _getCountFromResult = result => (Array.isArray(result) ? (result[0]?.$count ?? 0) : (result?.$count ?? 0))
 
 const _getCountFromResultForArrayOfQueries = result => {
   if (!Array.isArray(result)) return result.$count ?? 0

package/node_modules/@sap/cds/libx/queue/SchedulingService.js

@@ -24,6 +24,8 @@ const _setLongTimeout = (cb, delay) => {
 }
 
 let T0
+const MISSING_T0 =
+  'Skipping periodic message processing: no provider tenant is configured via `cds.requires.multitenancy.t0`. This is unexpected outside the `mtx-sidecar` profile.'
 
 module.exports = class SchedulingService extends cds.Service {
   constructor(...args) {
@@ -101,6 +103,8 @@ module.exports = class SchedulingService extends cds.Service {
 
       // NOTE: in the future, we also need to trigger task processing in sidecar for mtx
       if (cds.env.profile !== 'mtx-sidecar') {
+        if (!T0) return LOG.warn(MISSING_T0)
+
         const periodic_flush = setInterval(() => _flush(T0), flush_interval_ms).unref()
         cds.on('shutdown', () => clearInterval(periodic_flush))
         _flush(T0)

package/node_modules/@sap/cds/libx/queue/index.js

@@ -132,7 +132,7 @@ const _processTasks = (target, tenant, _opts = {}) => {
 
       if (opts.maxAttempts) tasksQuery.where({ attempts: { '<': opts.maxAttempts } })
       if (opts.parallel) {
-        tasksQuery.SELECT.forUpdate.ignoreLocked = true
+        tasksQuery.forUpdate({ ignoreLocked: true })
         const shifted = new Date(Math.max(0, currTime - _timeout)).toISOString()
         tasksQuery.where({ status: null, or: { lastAttemptTimestamp: { '<': shifted } } })
         // Note: If there are messages which are not yet timed out, but will hang eventually,
@@ -215,8 +215,14 @@ const _processTasks = (target, tenant, _opts = {}) => {
           const user = new cds.User.Privileged(userId)
           context.user = user
 
-          // The latter is for backwards compatibility where `service` was not stored and `target` was the service name
-          const srvName = _msg.service || _task.target
+          // older messages have no `service`; the name is encoded in `target` as
+          // `<targetPrefix><serviceName>` (see utils.targetName)
+          let srvName = _msg.service
+          if (!srvName) {
+            srvName = _task.target
+            if (opts.targetPrefix && srvName.startsWith(opts.targetPrefix))
+              srvName = srvName.slice(opts.targetPrefix.length)
+          }
           delete _msg.service
 
           const fromSend = _msg._fromSend
@@ -227,6 +233,7 @@ const _processTasks = (target, tenant, _opts = {}) => {
 
           const task = {
             ID: _task.ID,
+            timestamp: _task.timestamp,
             msg,
             context,
             srvName,
@@ -246,6 +253,19 @@ const _processTasks = (target, tenant, _opts = {}) => {
       let minAttemptFailed
       try {
         const _handleWithErr = async task => {
+          if (!cds.services[task.srvName]) {
+            // service not served/registered: unrecoverable, so dead-letter it (attempts -> maxAttempts)
+            // instead of crashing the app or blocking the queue
+            LOG.error(`No service '${task.srvName}' found for a queued message; treating as unrecoverable.`)
+            if (!minAttemptFailed) minAttemptFailed = task.attempts
+            else minAttemptFailed = Math.min(minAttemptFailed, task.attempts)
+            task[$error] = new Error(`No service '${task.srvName}' found`)
+            if (opts.maxAttempts) {
+              task.updateData = { attempts: opts.maxAttempts }
+              toBeUpdated.push(task)
+            } else toBeDeleted.push(task)
+            return
+          }
           const service = cds.unqueued(await cds.connect.to(task.srvName))
           try {
             if (task.msg.query) {
@@ -264,9 +284,21 @@ const _processTasks = (target, tenant, _opts = {}) => {
               // we can only delete in the current tx if legacyLocking (i.e., long-lasting db locks) is false
               if (!opts.legacyLocking) {
                 const _delete = DELETE.from(tasksEntity).where({ ID: task.ID })
-                // only delete singleton task if not modified in the meantime
-                if (task.msg.queue?.task) _delete.where({ timestamp: { '<': _timestampPlusOneMS(task.msg.timestamp) } })
-                await _delete
+                // guard on the selected row's timestamp (not `task.msg.timestamp`: `timestamp` is in
+                // `_ignoredContext`, absent from the msg, and reads back as `now`)
+                if (task.msg.queue?.task)
+                  _delete.where({ timestamp: { '<': _timestampPlusOneMS(new Date(task.timestamp)) } })
+                const _deleted = await _delete
+                const _cnt = typeof _deleted === 'number' ? _deleted : (_deleted?.affected ?? 0)
+                // recreate the next occurrence in the same tx; skip if the guarded delete removed nothing
+                // (the singleton was unscheduled/rescheduled concurrently)
+                if (task.msg.queue?.every && (!task.msg.queue?.task || _cnt > 0)) {
+                  const _m = { ...task.msg }
+                  _m._fromSend = task.msg instanceof cds.Request
+                  await INSERT.into(tasksEntity).entries(create_task(target, _m, task.context, task.srvName, opts, true))
+                  // re-trigger the drain to schedule the new occurrence
+                  _setWaitingTime(0)
+                }
               }
               return result
             })
@@ -353,7 +385,7 @@ const _processTasks = (target, tenant, _opts = {}) => {
         if (each.updateData.lastError && typeof each.updateData.lastError !== 'string') {
           each.updateData.lastError = inspect(each.updateData.lastError)
         }
-        each.updateData.lastAttemptTimestamp = cds.context.timestamp
+        each.updateData.lastAttemptTimestamp = cds.context?.timestamp ?? new Date()
         queries.push(UPDATE(tasksEntity).where({ ID: each.ID }).set(each.updateData))
       }
 
@@ -409,11 +441,11 @@ const _processTasks = (target, tenant, _opts = {}) => {
           }
         }
 
-        // handle `every`
-        if (task.msg.queue?.every) {
+        // handle `every` — !legacyLocking recreates in the success tx above; the legacyLocking path
+        // (deferred delete) recreates here, using a read-back to detect a concurrent unschedule/reschedule
+        if (task.msg.queue?.every && opts.legacyLocking) {
           const _m = { ...task.msg }
           if (task.msg.queue.task) {
-            // Read from database as the singleton task might have been modified/deleted in the meantime
             const dbTask = await SELECT.one(tasksEntity).where({ ID: task.ID })
             if (!dbTask) continue //> was unscheduled -> no next occurrence
             Object.assign(_m, JSON.parse(dbTask.msg))
@@ -425,6 +457,8 @@ const _processTasks = (target, tenant, _opts = {}) => {
       }
       // invoke failed handlers (only if max attempts is reached)
       for (const task of toBeUpdated) {
+        // skip dead-lettered messages whose service is not served/registered (see above)
+        if (!cds.services[task.srvName]) continue
         if (
           !task.msg.event.endsWith('/#succeeded') &&
           !task.msg.event.endsWith('/#failed') &&

package/node_modules/@sap/cds/libx/queue/processing.js

@@ -25,10 +25,15 @@ const $service = Symbol('service')
 const MAX_WAITING_TIME = 1480000
 const CAPATTEMPTS = Math.ceil(Math.log(MAX_WAITING_TIME / 1000 + 1) / Math.log(1.5))
 
+const _timestampPlusOneMS = ts => new Date(ts.getTime() + 1).toISOString()
+
 let _processableTasksQuery = {}
 
-const _addParamFalse = w => {
-  if (w.xpr) return w.xpr.map(xpr => _addParamFalse(xpr))
+const _inlineLiterals = w => {
+  if (w.xpr) return w.xpr.map(xpr => _inlineLiterals(xpr))
+  // also recurse into function args (e.g. `startswith(target, '<appid>')`) so a literal arg isn't
+  // bound as a `?` and shift the positional binding of the query's real params
+  if (w.args) return (Array.isArray(w.args) ? w.args : Object.values(w.args)).map(a => _inlineLiterals(a))
   if (w.val === undefined) return w
   w.param = false
   return w
@@ -50,9 +55,14 @@ const _getProcessableTasksQuery = ({ maxAttempts, chunkSize }, queueName) => {
 
   const appid = cds.env.appid
 
+  // also match pre-`appid` rows: `appid IS NULL` with `target` starting with `appid` (the former app prefix)
+  const targetCondition = appid
+    ? `(appid = '${appid}' AND target = '${queueName}') OR (appid IS NULL AND startswith(target, '${appid}') = true)`
+    : `target = '${queueName}'`
+
   const sql = `
     SELECT ID FROM ${entity.name}
-    WHERE ${appid ? `appid = '${appid}' AND ` : ''}target = '${queueName}'
+    WHERE (${targetCondition})
       AND attempts < ${maxAttempts}
       AND (status is NULL OR lastAttemptTimestamp < ?)
       AND (${attemptConditions.join(' OR ')})
@@ -61,10 +71,9 @@ const _getProcessableTasksQuery = ({ maxAttempts, chunkSize }, queueName) => {
 
   _processableTasksQuery[queueName] = cds.ql(sql)
   _processableTasksQuery[queueName].SELECT.limit.rows.param = false
-  _processableTasksQuery[queueName].SELECT.where.map(w => _addParamFalse(w))
+  _processableTasksQuery[queueName].SELECT.where.map(w => _inlineLiterals(w))
   _processableTasksQuery[queueName].SELECT.columns = Object.keys(entity.elements).map(k => ({ ref: [k] }))
-  _processableTasksQuery[queueName].forUpdate()
-  _processableTasksQuery[queueName].SELECT.forUpdate.ignoreLocked = true
+  _processableTasksQuery[queueName].forUpdate({ ignoreLocked: true })
 
   return _processableTasksQuery[queueName]
 }
@@ -101,10 +110,9 @@ const _getFlushTasksQuery = ({ maxAttempts, chunkSize }, queueName) => {
       ORDER BY timestamp ASC, ID ASC
       LIMIT ${chunkSize}`)
     _flushTasksQuery[queueName].SELECT.limit.rows.param = false
-    _flushTasksQuery[queueName].SELECT.where.map(w => _addParamFalse(w))
+    _flushTasksQuery[queueName].SELECT.where.map(w => _inlineLiterals(w))
     _flushTasksQuery[queueName].SELECT.columns = Object.keys(entity.elements).map(k => ({ ref: [k] }))
-    _flushTasksQuery[queueName].forUpdate()
-    _flushTasksQuery[queueName].SELECT.forUpdate.ignoreLocked = true
+    _flushTasksQuery[queueName].forUpdate({ ignoreLocked: true })
   }
   return _flushTasksQuery[queueName]
 }
@@ -257,8 +265,13 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
           const user = new cds.User.Privileged(userId)
           context.user = user
 
-          // The latter is for backwards compatibility where `service` was not stored and `target` was the service name
-          const srvName = _msg.service || _task.target
+          // older messages have no `service`; the name is encoded in `target` as `<appid><serviceName>`
+          let srvName = _msg.service
+          if (!srvName) {
+            srvName = _task.target
+            const appid = cds.env.appid
+            if (appid && srvName.startsWith(appid)) srvName = srvName.slice(appid.length)
+          }
           delete _msg.service
 
           const fromSend = _msg._fromSend
@@ -301,6 +314,15 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
 
       try {
         const _handleWithErr = async task => {
+          if (!cds.services[task.srvName]) {
+            // service not served/registered: unrecoverable, so dead-letter it (attempts -> maxAttempts)
+            // instead of crashing the app or blocking the queue
+            LOG.error(`No service '${task.srvName}' found for a queued message; treating as unrecoverable.`)
+            task[$error] = new Error(`No service '${task.srvName}' found`)
+            task.updateData = { attempts: opts.maxAttempts }
+            toBeUpdated.push(task)
+            return
+          }
           const service = cds.unqueued(await cds.connect.to(task.srvName))
           try {
             if (task.msg.query) {
@@ -330,12 +352,18 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
                   .where({ msg: { like: `%"tenant":"${task.msg.data.tenant}"%` } })
                   .where({ msg: { like: `%"target":"${task.msg.data.target}"%` } })
               } else {
-                await DELETE.from(OUTBOX).where({ ID: task.ID })
+                const _delete = DELETE.from(OUTBOX).where({ ID: task.ID })
+                // guard on the selected row's timestamp so a concurrent unschedule/reschedule is
+                // serialized against the recurrence recreated below
+                if (task.msg.queue?.task)
+                  _delete.where({ timestamp: { '<': _timestampPlusOneMS(new Date(task._task.timestamp)) } })
+                const _deleted = await _delete
+                const _cnt = typeof _deleted === 'number' ? _deleted : (_deleted?.affected ?? 0)
 
                 // For atomicity: create follow-up tasks in same transaction as delete
                 const follow_ups = []
 
-                // #succeeded callback (only if not already a callback event)
+                // #succeeded callback — always owed once the in-flight execution completed
                 if (!task.msg.event.endsWith('/#succeeded') && !task.msg.event.endsWith('/#failed')) {
                   const succeededMsg = _newMsgForCallbackFrom(task.msg)
                   succeededMsg.event = succeededMsg.event + '/#succeeded'
@@ -352,8 +380,9 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
                   }
                 }
 
-                // Next recurrence for .every() tasks
-                if (task.msg.queue?.every) {
+                // next occurrence — only if the guarded delete removed the row (else it was unscheduled/
+                // rescheduled concurrently); non-singletons always recreate
+                if (task.msg.queue?.every && (!task.msg.queue?.task || _cnt > 0)) {
                   const _m = { ...task.msg }
                   _m._fromSend = task.msg instanceof cds.Request
                   const next_iteration_task = create_task(queueName, _m, task.context, task.srvName, opts, true)
@@ -423,7 +452,7 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
             if (each.updateData.lastError && typeof each.updateData.lastError !== 'string') {
               each.updateData.lastError = inspect(each.updateData.lastError)
             }
-            each.updateData.lastAttemptTimestamp = cds.context.timestamp
+            each.updateData.lastAttemptTimestamp = cds.context?.timestamp ?? new Date().toISOString()
             follow_up_tasks.push(Object.assign({}, each._task, each.updateData))
             afters.add(waitingTime(each.updateData.attempts))
           }
@@ -441,6 +470,8 @@ const _processTasks = (queueName, tenant, _opts = {}) => {
 
           // Create #failed callbacks (only if max attempts is reached)
           for (const task of toBeUpdated) {
+            // skip dead-lettered messages whose service is not served/registered (see above)
+            if (!cds.services[task.srvName]) continue
             if (
               !is_t0 &&
               !task.msg.event.endsWith('/#succeeded') &&

package/node_modules/@sap/cds/libx/queue/utils.js

@@ -51,6 +51,9 @@ const create_task = (queueName, msg, context, serviceName, queueOpts, reoccurren
     appid: cds.env.appid,
     target: cds.env.appid ? queueName : targetName(queueName, queueOpts),
     timestamp,
+    // reset status so re-submitting a task that is currently being processed (UPSERT over its
+    // 'processing' row) yields a processable row again instead of a stuck one
+    status: null,
     msg: JSON.stringify(_msg)
   }
 

package/node_modules/@sap/cds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "10.1.0",
+  "version": "10.1.1",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds/tasks/enterprise-messaging-deploy.js

@@ -19,11 +19,19 @@ const xsuaaSrv = Object.keys(vcap_services)
 if (!xsuaaSrv)
   throw new Error('You need to provide credentials of service `XSUAA` in environment variable `VCAP_SERVICES`')
 const tokenStore = {}
-const oa2 = {
-  client: xsuaaSrv.credentials.clientid,
-  secret: xsuaaSrv.credentials.clientsecret,
-  endpoint: xsuaaSrv.credentials.url
-}
+const xsuaaCreds = xsuaaSrv.credentials
+const oa2 =
+  xsuaaCreds['credential-type'] === 'x509'
+    ? {
+        client: xsuaaCreds.clientid,
+        endpoint: xsuaaCreds.certurl,
+        mTLS: { cert: xsuaaCreds.certificate, key: xsuaaCreds.key }
+      }
+    : {
+        client: xsuaaCreds.clientid,
+        secret: xsuaaCreds.clientsecret,
+        endpoint: xsuaaCreds.url
+      }
 
 const main = async () => {
   // use authorizedRequest to fire against deploy endpoint

package/node_modules/@sap/cds-compiler/CHANGELOG.md

@@ -15,6 +15,21 @@ might use a deprecated flag only for a limited period of time.
 
 
 
+## Version 7.1.1 - 2026-09-08
+
+### Bug Fixes
+
+- **effective:**
+  + Fix dump in flattening for actions with entity parameters.
+  + Ensure consistent handling of reference-like annotation expressions during flattening.
+- **sql:**
+  + Add missing `@hierarchy` columns to localized convenience views.
+  + Avoid crash on mixin backlink with renamed target element.
+  + The generated SQL for a reference `assoc.elem` where `assoc` is an association defined with duplicate backlink comparisons with `$self` is now more likely
+    to be correct. Usually, there is an error for the definition of such an `assoc`, but the corresponding message can be downgraded to a warning.
+
+
+
 ## Version 7.1.0 - 2026-08-27
 
 ### Features

package/node_modules/@sap/cds-compiler/lib/compiler/resolve.js

@@ -1189,9 +1189,13 @@ function resolve( model ) {
       const backlinkPath = itemIsPath ? item : right;
       const last = backlinkPath.path[backlinkPath.path.length - 1];
       if (assoc.$backlink) {
-        const location = combinedLocation( item.path[0], right.path[right.path.length - 1] );
-        message( 'ref-duplicate-self-comparison', [ location, assoc ], { id: '$self' },
-                 'Duplicate comparison with a bare $(ID) reference in an ON-condition' );
+        if (!assoc.on.$inferred) {
+          const location = combinedLocation( item.path[0], right.path[right.path.length - 1] );
+          message( 'ref-duplicate-self-comparison', [ location, assoc ], { id: '$self' },
+                   'Duplicate comparison with a bare $(ID) reference in an ON-condition' );
+        }
+        if (last?._artifact !== assoc.$backlink._origin)
+          setLink( assoc.$backlink, '_origin', null );
         return;
       }
       const backlinkRef = last?._artifact;

package/node_modules/@sap/cds-compiler/lib/model/csnUtils.js

@@ -8,6 +8,7 @@ const {
   applyTransformationsOnNonDictionary,
   applyTransformationsOnDictionary,
   mergeTransformers,
+  isSimpleAnnoExprRef,
 } = require('../transform/db/applyTransformations');
 const { isBuiltinType, isAnnotationExpression, primaryExprProperties } = require('../base/builtins');
 const { ModelError, CompilerAssertion } = require('../base/error');
@@ -1512,6 +1513,7 @@ module.exports = {
   applyTransformationsOnNonDictionary,
   applyTransformationsOnDictionary,
   mergeTransformers,
+  isSimpleAnnoExprRef,
   setDependencies,
   isPersistedOnDatabase,
   isPersistedAsView,

package/node_modules/@sap/cds-compiler/lib/transform/db/applyTransformations.js

@@ -423,6 +423,17 @@ function mergeTransformers( transformers, that ) {
   return remapped;
 }
 
+/**
+ * Return true if the annotation expression ref node is a simple reference:
+ * all ref steps are plain strings, and the node has neither `param` nor `cast`.
+ *
+ * @param {object} annotation An annotation expression node (has `ref`, optionally `param`, `cast`)
+ * @returns {boolean}
+ */
+function isSimpleAnnoExprRef(annotation) {
+  return annotation.ref && annotation.ref.every(s => typeof s === 'string') && !annotation.param && !annotation.cast;
+}
+
 module.exports = {
   mergeTransformers,
   transformExpression,
@@ -430,6 +441,7 @@ module.exports = {
   applyTransformations,
   applyTransformationsOnNonDictionary,
   applyTransformationsOnDictionary,
+  isSimpleAnnoExprRef,
 };
 
 

package/node_modules/@sap/cds-compiler/lib/transform/db/associations.js

@@ -5,6 +5,7 @@ const {
   applyTransformationsOnNonDictionary,
   applyTransformations,
   implicitAs,
+  isSimpleAnnoExprRef,
 } = require('../../model/csnUtils');
 
 /**
@@ -138,7 +139,7 @@ function getFKAccessFinalizer( csn, options, csnUtils, pathDelimiter, processOnI
         const annoAfter = JSON.stringify(obj[anno]);
         if (annoBefore !== annoAfter &&
             (options.transformation !== 'effective' || obj[anno]['=']) &&
-            !(obj[anno].ref && obj[anno].ref.every(s => typeof s === 'string')))
+            !(obj[anno].ref && isSimpleAnnoExprRef(obj[anno])))
           obj[anno]['='] = true;
       });
   }
@@ -251,10 +252,11 @@ function getFKAccessFinalizer( csn, options, csnUtils, pathDelimiter, processOnI
                     else {
                       refOwner.ref = [ ...ref.slice(0, i), newFkName ];
                     }
-                    if (ctx?.annoExpr === refOwner)
-                      ctx.annoExpr['='] = refOwner.ref.every(s => typeof s === 'string')
+                    if (ctx?.annoExpr === refOwner) {
+                      ctx.annoExpr['='] = isSimpleAnnoExprRef(refOwner)
                         ? refOwner.ref.join('.')
                         : true;
+                    }
                   }
                 }
                 else {