@sap/cds-dk 10.1.0 → 10.1.2

package/node_modules/@sap/cds-compiler/lib/transform/db/flattening.js

@@ -11,7 +11,7 @@ const { isBuiltinType, isMagicVariable } = require('../../base/builtins');
 const transformUtils = require('../transformUtils');
 const { csnRefs } = require('../../base/csnRefs');
 const { setProp, forEach } = require('../../utils/objectUtils');
-const { transformExpression } = require('./applyTransformations');
+const { transformExpression, isSimpleAnnoExprRef } = require('./applyTransformations');
 const { cloneCsnNonDict } = require('../../base/cloneCsn');
 const { EdmTypeFacetNames } = require('../../edm/EdmPrimitiveTypeDefinitions');
 const { adaptAnnotationsRefs } = require('../odata/adaptAnnotationRefs');
@@ -246,7 +246,8 @@ function getStructStepsFlattener( csn, options, messageFunctions, resolved, path
         adaptRefs.push((...args) => {
           const refChanged = fn(...args);
           if (refChanged && annotation['='])
-            annotation['='] = true;
+            // For simple refs (all-string steps, no param/cast), = contains the string representation of the ref.
+            annotation['='] = isSimpleAnnoExprRef(annotation) ? annotation.ref.join('.') : true;
         });
       }
       else {
@@ -664,7 +665,7 @@ function handleManagedAssociationsAndCreateForeignKeys( csn, options, messageFun
         }
 
         if (options.transformation === 'effective') {
-          adaptAnnotationsRefs(fks, csnUtils, messageFunctions, eltPath);
+          adaptAnnotationsRefs(fks, csnUtils, messageFunctions, eltPath, options);
           const validAnnoNames = Object.keys(element).filter(pn => pn[0] === '@' && findAnnotationExpression(element, pn));
           fks.forEach(fk => copyAnnotations(element, fk[1], false, {}, validAnnoNames));
         }

package/node_modules/@sap/cds-compiler/lib/transform/effective/flattening.js

@@ -53,6 +53,18 @@ function flattenRefs(csn, options, csnUtils, messageFunctions) {
   const refFlattener = getStructStepsFlattener(csn, options, messageFunctions, resolved, '_', adaptRefs);
 
   forEachDefinition(csn, (def, defName) => {
+    // Unbound actions/functions/events: only flatten annotation expressions, not params.
+    // Their params may carry $self on-conditions that cannot be resolved without a query context.
+    if (def.kind === 'action' || def.kind === 'function' || def.kind === 'event') {
+      forEachMemberRecursively(def, (member, memberName, prop, path) => {
+        Object.keys(member).filter(pn => pn.startsWith('@') && member[pn]).forEach((pn) => {
+          transformAnnotationExpression(member, pn, [ refFlattener ], path);
+          adaptRefs.forEach(fn => fn());
+          adaptRefs.length = 0;
+        });
+      }, [ 'definitions', defName ]);
+      return;
+    }
     applyTransformationsOnNonDictionary(csn.definitions, defName, refFlattener, { processAnnotations: true, skipDict: { actions: 1 } }, [ 'definitions' ]);
 
     adaptRefs.forEach(fn => fn());
@@ -97,8 +109,12 @@ function flattenRefs(csn, options, csnUtils, messageFunctions) {
   });
 
   cleanup.forEach((obj) => {
-    if (obj.ref && obj.ref[0] === '$self')
+    // strip leading $self from ref array and (if it is a string) from '='
+    if (obj.ref && obj.ref[0] === '$self') {
       obj.ref.shift();
+      if (typeof obj['='] === 'string' && obj['='].startsWith('$self.'))
+        obj['='] = obj['='].slice('$self.'.length);
+    }
   });
 }
 

package/node_modules/@sap/cds-compiler/lib/transform/effective/main.js

@@ -103,6 +103,25 @@ function effectiveCsn( model, options, messageFunctions ) {
 
   resolveTypesInActionsAfterFlattening(csnUtils);
 
+  // Rewrite association keys in unbound action/function params to use flattened names.
+  // Not needed for bound actions: their params are reached via the parent entity and handled by flattenFKs in managedToUnmanaged.
+  forEachDefinition(csn, (def) => {
+    if (def.kind !== 'action' && def.kind !== 'function')
+      return;
+    if (!def.params)
+      return;
+    for (const param of Object.values(def.params)) {
+      if (!param.elements)
+        continue;
+      for (const element of Object.values(param.elements)) {
+        if (element.keys)
+          element.keys.forEach((key) => {
+            key.ref = [ key.ref.join('_') ];
+          });
+      }
+    }
+  });
+
   processCalculatedElementsInEntities(csn, options);
   // invalidate csnRef caches after flattening
   transformerUtils.csnUtils = getUtils(csn, 'init-all');

package/node_modules/@sap/cds-compiler/lib/transform/fioriTreeViews.js

@@ -16,7 +16,7 @@ const { isBuiltinType } = require('../base/builtins');
  *  - the foreign key is of scalar type
  * Otherwise, appropriate warnings/errors are raised.
  */
-function generateFioriTreeViewAnnotationsAndFields(def, defName, messageFunctions, csnUtils, transformers, options) {
+function generateFioriTreeViewAnnotationsAndFields(def, defName, messageFunctions, csnUtils, transformers, options, csn) {
   const { error, warning } = messageFunctions;
   const { isAssociation } = csnUtils;
   const { setAnnotation, addElement, createScalarElement } = transformers;
@@ -157,6 +157,17 @@ function generateFioriTreeViewAnnotationsAndFields(def, defName, messageFunction
   }
 
   function addHierarchyFields(def, defName) {
+    addHierarchyFieldsTo(def, defName);
+
+    // The localized convenience view is a stand-in for the annotated view at
+    // runtime, so it must carry the same hierarchy columns. It is generated
+    // before this transform runs, hence it is augmented here explicitly.
+    const localizedView = csn?.definitions?.[`localized.${ defName }`];
+    if (localizedView)
+      addHierarchyFieldsTo(localizedView, `localized.${ defName }`);
+  }
+
+  function addHierarchyFieldsTo(def, defName) {
     // add elements in elements dictionary
     const limitedDescendantCount = createScalarElement('LimitedDescendantCount', 'cds.Integer');
     limitedDescendantCount.LimitedDescendantCount['@Core.Computed'] = true;

package/node_modules/@sap/cds-compiler/lib/transform/forRelationalDB.js

@@ -367,7 +367,7 @@ function transformForRelationalDBWithCsn(csn, options, messageFunctions) {
     findAndMarkSqlServiceArtifacts(artifact, artifactName);
     if (artifact.$dummyService)
       createServiceDummy(artifact, artifactName, csn, messageFunctions);
-    generateFioriTreeViews(artifact, artifactName, messageFunctions, csnUtils, { setAnnotation, addElement, createScalarElement }, options);
+    generateFioriTreeViews(artifact, artifactName, messageFunctions, csnUtils, { setAnnotation, addElement, createScalarElement }, options, csn);
   }, transformViews ]);
 
   // TODO: Could we maybe merge this with the final applyTransformations?

package/node_modules/@sap/cds-compiler/lib/transform/odata/adaptAnnotationRefs.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { transformAnnotationExpression, implicitAs } = require('../../model/csnUtils');
+const { transformAnnotationExpression, implicitAs, isSimpleAnnoExprRef } = require('../../model/csnUtils');
 
 /**
  * Used during annotating of foreign keys.
@@ -13,10 +13,10 @@ const { transformAnnotationExpression, implicitAs } = require('../../model/csnUt
  * @param {object} messageFunctions
  * @param {CSN.Path} elementPath
  */
-function adaptAnnotationsRefs(generatedForeignKeys, csnUtils, { error }, elementPath) {
+function adaptAnnotationsRefs(generatedForeignKeys, csnUtils, { error }, elementPath, options) {
   if (Array.isArray(generatedForeignKeys?.[0])) {
     // ensure we are always called with an array of objects. TODO: Cleanup fk creation in for.effective to create array of objects
-    adaptAnnotationsRefs(remapToArrayOfObjects(generatedForeignKeys), csnUtils, { error }, elementPath);
+    adaptAnnotationsRefs(remapToArrayOfObjects(generatedForeignKeys), csnUtils, { error }, elementPath, options);
   }
   else {
     const reportedErrorsForAnnoPath = {};
@@ -49,8 +49,14 @@ function adaptAnnotationsRefs(generatedForeignKeys, csnUtils, { error }, element
               if (gfkForRef.length === 1) {
                 ref[0] = gfkForRef[0].prefix;
 
-                if (ctx?.annoExpr?.['='])
-                  ctx.annoExpr['='] = true;
+                if (ctx?.annoExpr?.['=']) {
+                  // TODO: Apply the same fix for OData once the OData behavior is aligned;
+                  //       when done, the `options` parameter can be removed from this function.
+                  if (options?.transformation === 'effective')
+                    ctx.annoExpr['='] = isSimpleAnnoExprRef(ctx.annoExpr) ? ctx.annoExpr.ref.join('.') : true;
+                  else
+                    ctx.annoExpr['='] = true;
+                }
               }
               else {
                 // check if the annotation reference points to a structure that has been expanded,

package/node_modules/@sap/cds-compiler/lib/transform/translateAssocsToJoins.js

@@ -612,7 +612,7 @@ function translateAssocsToJoins(model, inputOptions = {}) {
           args.push({
             op: { val: '=' },
             args: [ constructPathNode( [ srcAlias, prefixFK(assoc.$elementPrefix, assoc.$flatSrcFKs[i]) ] ),
-              constructPathNode( [ tgtAlias, assoc.$flatTgtFKs[i] ] ) ],
+              constructPathNode( [ tgtAlias, resolveTgtFKToAlias(assoc.$flatTgtFKs[i], tgtAlias) ] ) ],
           });
         }
         return parenthesise((args.length > 1 ? { op: { val: 'and' }, args } : args[0] ));
@@ -808,7 +808,19 @@ function translateAssocsToJoins(model, inputOptions = {}) {
         const assocSource = assoc._main;
         if (assoc.kind === 'mixin' && (i > 0 || fwdTarget !== assocSource) && fwdOrigin.kind !== 'mixin') {
           const tas = Object.values(env.lead.$tableAliases);
-          const j = tas.findIndex(ta => ta._artifact === fwdOrigin.target._artifact);
+          // The backlink association's target may be reached through a view
+          // over it, whose alias is not the target artifact itself; fall back
+          // to the alias whose `_origin` chain reaches the target.
+          let j = tas.findIndex(ta => ta._artifact === fwdOrigin.target._artifact);
+          if (j < 0) {
+            j = tas.findIndex((ta) => {
+              for (let a = ta._artifact; a; a = a._origin) {
+                if (a === fwdOrigin.target._artifact)
+                  return true;
+              }
+              return false;
+            });
+          }
           if (j >= 0 && tas[j].$QA) {
             newTgtAlias.id = tas[j].$QA.name.id;
             newTgtAlias._artifact = tas[j]._effectiveType;
@@ -1061,6 +1073,21 @@ function translateAssocsToJoins(model, inputOptions = {}) {
         const backlink = backlinkAssoc.$backlink;
         return backlink && (backlink.foreignKeys || backlink.on) ? backlink : fwdAssoc;
       }
+
+      // Resolve the target foreign key to the alias of the target table.
+      // If the target foreign key is not found in the scope of the target alias,
+      // try to find it in the origin chain of the foreign key artifact.
+      function resolveTgtFKToAlias( fk, tgtAlias ) {
+        const env = tgtAlias && (tgtAlias._effectiveType || tgtAlias._artifact);
+        const scope = env && env.elements;
+        if (!scope || !fk || scope[fk.id] || !fk._artifact || !fk._artifact._origin)
+          return fk;
+        for (let o = fk._artifact._origin; o; o = o._origin) {
+          if (o.name && scope[o.name.id])
+            return { id: o.name.id, _artifact: fk._artifact, acc: fk.acc };
+        }
+        return fk;
+      }
     } // createOnCondition
   } // createJoinQA
 

package/node_modules/@sap/cds-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "7.1.0",
+  "version": "7.1.1",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",

package/node_modules/@sap/cds-mtxs/CHANGELOG.md

@@ -6,6 +6,39 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 4.1.0 - 2026-09-04
+
+### Added
+
+- Beta: Multitenant provisioning now supports HANA Cloud serverless, resolving one HDI container per tenant through the serverless Tenant API.
+- Beta: The MTX job service can now use native javascript workers to make the MTX sidecar more responsive while jobs (e. g. tenant upgrade) are running.
+Native workers can be enabled by `nativeWorkers` in the jobs configuration, e. g.
+  ```jsonc
+  "cds.xt.SaasProvisioningService":  {
+        "jobs": {
+          "nativeWorkers": true,
+          "workerSize": 3,
+          "clusterSize": 3
+        }
+      },
+  ```
+  - With configuration `cds.requires['cds.xt.SaasProvisioning'].upgrade.skipAlreadyUpgraded: true` or `cds.requires['cds.xt.SmsProvisioning'].upgrade.skipAlreadyUpgraded: true`,
+already upgraded tenants are skipped when running an upgrade of all tenants (`tenants: ['*']`). Tenants are considered as already upgraded if the last upgrade was run after the
+last deployment of the application.
+
+### Fixed
+
+- `SmsProvisioningService` certificate check is now better aligned with the Java implementation.
+- Extension validation checks have been refined.
+- `POST /-/cds/model-provider/getEdmx` now checks the requested service name more exactly.
+- Callback url for Saas Registry and Subscription Manager is now determined in a more robust way.
+
+## Version 4.0.4 - 2026-08-21
+
+### Fixed
+
+- Version bump
+
 ## Version 4.0.3 - 2026-08-21
 
 ### Added
@@ -20,6 +53,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 - HANA credential health-check now detects the available driver via `require.resolve()` instead of reading `package.json`, fixing `MODULE_NOT_FOUND` for apps that follow the "Plug & Play" guidance and don't declare `hdb` or `@sap/hana-client` directly.
 - Tenant upgrade now reports a clear per-tenant `422` error when a stored extension is incompatible with the changed base model, instead of aborting with an uncaught compilation error.
+- `cds-mtx-migrate` now runs more robust with uncommon model configurations.
 
 ## Version 4.0.2 - 2026-08-07
 

package/node_modules/@sap/cds-mtxs/bin/cds-mtx-migrate.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 /* eslint-disable no-console */
 
+const cds = require('@sap/cds')
+const { _import, isfile, local, path } = cds.utils
+
 async function run(param, options) {
     const { dry, genTenantList, syncTenantList, cleanup, directory, tag, tagRule } = options
     const skipVerification = options['skip-verification'] || options.skipVerification
@@ -26,7 +29,6 @@ async function run(param, options) {
         _handleError(`The migration from @sap/cds-mtx to @sap/cds-mtxs has been removed. Only --init-tenant-list and --sync-tenant-list are still supported.`)
     }
 
-    const cds = require('@sap/cds')
     const { syncTenantList: synchronizeTenantList, _hasMtEnv } = require('../lib/migration/migration')
 
     async function cds_mtx_migrate(tenants, options) {
@@ -45,11 +47,20 @@ async function run(param, options) {
             services.push('@sap/cds-mtxs/srv/extensibility-service')
         }
 
-        await cds.connect.to('db')
-        await cds.serve(services)
-        cds.env.requires.multitenancy = cds.env.requires.multitenancy || true // needed for current sidecar config that only enables services
+        await _local_server_js()
+        cds.emit ('bootstrap')
+        const model = await cds.load([...services, '@sap/cds-mtxs/db/extensions'])
+        cds.model = cds.compile.for.nodejs(model)
+        const d = 'cds.xt.DeploymentService'
+        const unserved = !cds.services[d]
+        if (unserved) {
+            await cds.serve(services)
+        }
+        await cds.plugins
+
+        await cds.emit('served', cds.services)
 
-        await cds.emit('served')
+        cds.env.requires.multitenancy ??= true // needed for current sidecar config that only enables services
 
         if (genTenantList) {
             const tenantListResult = await synchronizeTenantList(tenantList, options)
@@ -73,6 +84,16 @@ async function run(param, options) {
     await cds_mtx_migrate(param, options).catch(console.error)
 }
 
+// copied from cds.serve
+async function _local_server_js() {
+    const _local = file => isfile(file) || isfile (path.join(cds.env.folders.srv,file))
+    const cli_js = process.env.CDS_TYPESCRIPT && _local('cli.ts') || _local('cli.js')
+    if (cli_js) {
+      console.log ('[cds] - loading server from', { file: local(cli_js) })
+      await _import(cli_js)
+    }
+  }
+
 function getParameterValue(options, parameter) {
    const index = options.indexOf(parameter)
    const value = (index > -1) ? options[index + 1] : undefined

package/node_modules/@sap/cds-mtxs/bin/cds-mtx.js

@@ -78,6 +78,9 @@ async function cds_mtx(cmd, tenant, body) {
             cds.db.disconnect(cds.env.requires.multitenancy.t0 ?? 't0')
             for (const t of connectedTenants) cds.db.disconnect(t)
         }
+        if (isCli) {
+            await cds.exit()
+        }
     }
 }
 

package/node_modules/@sap/cds-mtxs/lib/utils.js

@@ -104,14 +104,15 @@ function authUrl(baseUrl, subdomain, pathname) {
   return u
 }
 
-async function token(credentials, { query = {}, form = {}, subdomain } = {}) {
+async function token(credentials, { query = {}, form = {}, subdomain, path = '/oauth/token' } = {}) {
   const { clientid, clientsecret, certurl, url, certificate, key } = credentials ?? {}
   if (!form.grant_type) throw cds.error('grant_type is required', { status: 400 })
-  const u = authUrl(certurl || url, subdomain, '/oauth/token')
+  const u = authUrl(certurl || url, subdomain, path)
   Object.entries(query).forEach(([k, v]) => u.searchParams.append(k, v))
   const body = new URLSearchParams({ client_id: clientid, ...form })
   const headers = { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' }
   let raw
+  const _fail = (statusCode, respBody) => new Error(`token request to ${u.origin}${u.pathname} for client ${clientid} failed (${statusCode}): ${respBody}`, { status: statusCode })
   if (certificate) {
     raw = await new Promise((resolve, reject) => {
       const req = require('node:https').request({
@@ -126,7 +127,7 @@ async function token(credentials, { query = {}, form = {}, subdomain } = {}) {
         res.on('data', x => chunks.push(x))
         res.on('end', () => {
           if (res.statusCode >= 200 && res.statusCode < 300) resolve(Buffer.concat(chunks).toString())
-          else reject(new Error(Buffer.concat(chunks).toString(), { status: res.statusCode }))
+          else reject(_fail(res.statusCode, Buffer.concat(chunks).toString()))
         })
       })
       req.on('error', reject)
@@ -176,7 +177,7 @@ async function fetchResiliently(url, req, { retriesLeft = maxRetries, maxRetryAf
     const data = contentType.includes('application/json') ? await res.json() : await res.text()
 
     if (!res.ok) {
-      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause].filter(Boolean).join(' – ')
+      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause, typeof data?.details === 'object' ? JSON.stringify(data.details) : data?.details].filter(Boolean).join(' – ')
       if (res.status === 429 && res.headers.get('retry-after')) msg += ` – retry after ${res.headers.get('retry-after')}`
       throw Object.assign(new Error(msg), { status, statusText, headers, code: data?.error?.code })
     }

package/node_modules/@sap/cds-mtxs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-mtxs",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "description": "SAP Cloud Application Programming Model - Multitenancy library",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds-mtxs/srv/cf/abstract-provisioning-service.js

@@ -5,6 +5,7 @@ const { fetchResiliently, token } = require('../../lib/utils')
 const DeploymentService = 'cds.xt.DeploymentService'
 const JobsService = 'cds.xt.JobsService'
 const Tenants = 'cds.xt.Tenants'
+const { SKIPPED_DB } = require('../jobs-service')
 
 // we need to run in multitenancy mode for t0 ops
 if (!cds.env.requires.multitenancy) cds.env.requires.multitenancy = true
@@ -112,9 +113,9 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     )).map(({ ID, metadata, createdAt, modifiedAt }) => ({ subscribedTenantId: ID, ...this._toMetadataJson(metadata, ID), createdAt, modifiedAt }))
   }
 
-  async _getTenants() {
+  async _getTenants(options) {
     const ds = await cds.connect.to(DeploymentService)
-    const all = await ds.getTenants()
+    const all = await ds.getTenants(options)
     if (cds.env.requires[this.name]?.upgrade?.ignoreNonExistingContainers) {
       const containers = await ds.getContainers()
       return all.filter(t => containers.includes(t))
@@ -129,9 +130,37 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const all = tenantIds.includes('*')
     const sharedGenDir = !main.requires.extensibility
     if (sharedGenDir) options.skipResources ??= sharedGenDir
-    const tenants = all ? await this._getTenants() : tenantIds
+
+    // Merge static upgrade config with dynamic options (dynamic takes precedence)
+    const upgradeConfig = cds.env.requires[this.name]?.upgrade
+    if (upgradeConfig) {
+      options.upgrade = cds.utils.merge({ ...upgradeConfig }, options.upgrade)
+    }
+
+    // Determine skipAfter: from explicit option or derived from package.json mtime
+    let skipAfter = options?.upgrade?.skipAfter
+    if (!skipAfter && options?.upgrade?.skipAlreadyUpgraded) {
+      const { stat } = require('fs/promises')
+      const { mtime } = await stat(cds.root + '/package.json')
+      skipAfter = mtime.toISOString()
+    }
+
+    const tenantsOptions = skipAfter ? { skipAfter } : undefined
+    let tenants
+    let skipped = []
+    if (all) {
+      tenants = await this._getTenants(tenantsOptions)
+    } else if (skipAfter) {
+      const upgradeable = await this._getTenants(tenantsOptions)
+      tenants = tenantIds.filter(t => upgradeable.includes(t))
+      // Requested tenants filtered out by skipAfter are considered already upgraded.
+      skipped = tenantIds.filter(t => !upgradeable.includes(t))
+    } else {
+      tenants = tenantIds
+    }
+
     const { isSync } = this._parseHeaders(cds.context.http?.req.headers)
-    if (!tenants.length && isSync) return
+    if (!tenants.length && !skipped.length && isSync) return
     if (sharedGenDir && cds.requires.db.kind === 'hana') { // REVISIT: Ideally part of HANA plugin
       const { resources4, csvs4, directory4 } = require('../plugins/hana')
       const out = await directory4('base', true)
@@ -141,13 +170,26 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const { 'cds.xt.DeploymentService': ds } = cds.services
     const js = await cds.connect.to(JobsService)
     const { clusterSize = 3 } = js._config()
-    const dbToTenants = (clusterSize > 1 && ds) ? await ds.tenantsByDb(tenants) : [new Set(tenants)]
-    LOG.info('upgrading', { tenants })
+    const dbToTenants = (tenants.length && clusterSize > 1 && ds) ? await ds.tenantsByDb(tenants) : [new Set(tenants)]
+    // Skipped tenants go into a separate pseudo-db cluster so JobsService records them (and their
+    // tasks) as FINISHED without upgrading.
+    let clusters = dbToTenants
+    if (skipped.length) {
+      // Normalize array-form to a db-id-keyed object so skipped tenants get their own cluster.
+      clusters = { ...dbToTenants }
+      // Drop skipped tenants from regular clusters (some tenantsByDb impls ignore the tenant list).
+      const skippedSet = new Set(skipped)
+      for (const db of Object.keys(clusters)) {
+        clusters[db] = new Set([...clusters[db]].filter(t => tenants.includes(t) && !skippedSet.has(t)))
+      }
+      clusters[SKIPPED_DB] = skippedSet
+    }
+    LOG.info('upgrading', { tenants, skipped })
 
 
     return await new Promise((resolve, reject) => {
       const tx = js.tx({ tenant: cds.context.tenant, user: new cds.User.Privileged() })
-      const job = tx.enqueue(DeploymentService, 'upgrade', dbToTenants, { options }, async error => {
+      const job = tx.enqueue(DeploymentService, 'upgrade', clusters, { options }, async error => {
         if (error) {
           await this._sendCallback('FAILED', `Tenant upgrade failed with error '${error}'`)
           if (isSync) reject(new Error(error))
@@ -303,4 +345,17 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const cred = s?.credentials ?? multitenancy?.credentials ?? {}
     return cred
   }
+
+  _resolveCallbackUrl(callbackPath, baseUrl) {
+    if (!callbackPath || !baseUrl) return undefined
+    if (typeof callbackPath !== 'string' || !/^\/(?![/\\])/.test(callbackPath) || callbackPath.includes('\\')) {
+      throw cds.error(`Invalid callback path: ${callbackPath}`, { status: 400 })
+    }
+    const base = new URL(baseUrl)
+    const resolved = new URL(callbackPath, base)
+    if (resolved.origin !== base.origin) {
+      throw cds.error(`Invalid callback path: ${callbackPath}`, { status: 400 })
+    }
+    return resolved.toString()
+  }
 }

package/node_modules/@sap/cds-mtxs/srv/cf/saas-provisioning-service.js

@@ -28,7 +28,7 @@ module.exports = class SaasProvisioningService extends require('./abstract-provi
   _parseHeaders(headers) {
     const { prefer, status_callback, mtx_status_callback } = headers ?? {}
     const { saas_registry_url } = this._getCredentials()
-    const callbackUrl = mtx_status_callback ?? (status_callback && saas_registry_url && new URL(status_callback, saas_registry_url).toString())
+    const callbackUrl = mtx_status_callback ?? this._resolveCallbackUrl(status_callback, saas_registry_url)
     return {
       callbackUrl,
       isCustomCallback: !!mtx_status_callback,

package/node_modules/@sap/cds-mtxs/srv/cf/sms-provisioning-service.js

@@ -53,7 +53,7 @@ module.exports = class SmsProvisioningService extends require('./abstract-provis
     _parseHeaders(headers) {
         const { prefer, status_callback } = headers ?? {}
         const { subscription_manager_url } = this._getCredentials()
-        const callbackUrl = (status_callback && subscription_manager_url && new URL(status_callback, subscription_manager_url).toString())
+        const callbackUrl = this._resolveCallbackUrl(status_callback, subscription_manager_url)
         return {
             callbackUrl,
             isSync: !(prefer?.includes('respond-async') || callbackUrl)
@@ -102,11 +102,31 @@ module.exports = class SmsProvisioningService extends require('./abstract-provis
         const isIssuerValid = isValid(callback_certificate_issuer, cert.issuer)
         const isSubjectValid = isValid(callback_certificate_subject, cert.subject)
 
+        function parseDN(dn) {
+            // Node's X509Certificate.issuer/subject uses newline as RDN separator.
+            // Each line is a single "attribute=value" pair. Multiple lines with the
+            // same attribute (e.g. multiple OU= entries) are all collected into an array.
+            const fields = {}
+            for (const line of dn.split('\n')) {
+                const eq = line.indexOf('=')
+                if (eq === -1) continue
+                const attr = line.slice(0, eq).trim().toUpperCase()
+                const val = line.slice(eq + 1).trim()
+                if (fields[attr]) fields[attr].push(val)
+                else fields[attr] = [val]
+            }
+            return fields
+        }
+
         function isValid(expected, fromCert) {
+            const certFields = parseDN(fromCert)
             return Object.entries(JSON.parse(expected)).every(([k, v]) => {
                 if (v === '*') return true
-                if (Array.isArray(v)) return v.some(v => fromCert.includes(`${k}=${v}`))
-                else return fromCert.includes(`${k}=${v}`)
+                const certVals = certFields[k.toUpperCase()] ?? []
+                // For array expected values every element must be present in the cert.
+                // For a scalar expected value the cert must contain that exact value.
+                if (Array.isArray(v)) return v.every(allowed => certVals.includes(allowed))
+                else return certVals.includes(v)
             })
         }
 

package/node_modules/@sap/cds-mtxs/srv/extensibility/compat/update.js

@@ -1,9 +1,15 @@
 const cds = require('@sap/cds')
+const { path } = cds.utils
 module.exports = (srv) => {
     // mainly normalizing the input
     srv.before(['UPDATE', 'UPSERT'], 'Extensions', req => { // must be synchronous to be handled first
         const { csn: extension, i18n: bundles, csvs: csvData } = req.data
 
+        // reject file names with path components (path traversal, see DbAdapter.put)
+        for (const files of [bundles, csvData]) {
+            if (Array.isArray(files)) files.forEach(_assertPlainFileName)
+        }
+
         // Validation of extension
         if (!extension) throw new cds.error({ message: 'Property "extension" is missing', code: 400 })
         if (Array.isArray(extension)) {
@@ -41,6 +47,15 @@ module.exports = (srv) => {
         req.data.csn = extCsn
     })
 
+    // rejects a FILE name that is not a plain file name (prevents path traversal)
+    const _assertPlainFileName = function (file) {
+        const name = file?.name
+        if (typeof name !== 'string' || !name.length) return
+        if (path.isAbsolute(name) || name.includes('/') || name.includes('\\') || path.basename(name) !== name) {
+            throw new cds.error({ message: `Invalid file name: "${name}"`, code: 400 })
+        }
+    }
+
     const _isCSN = str => str.substring(0, 1) === '{'
 
     const _mergeCSN = function (extension, merged) {

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/annotations.js

@@ -143,8 +143,8 @@ module.exports = class AnnotationsChecker {
          // get element permissions from allowlist
         const kind = this._getExtendedKind(fullCsn, extCsn, entityOrService)
         const permissions = allowList.getPermission(kind, entityOrService)
-        // check if annotation is allowed
-        if (permissions && permissions.annotations && permissions.annotations.includes(annotationName)) return null
+        // skip only this annotation; keep checking the remaining ones on the same element
+        if (permissions && permissions.annotations && permissions.annotations.includes(annotationName)) continue
 
         const fn = checkedExtensionAnnotations.get(annotationName) ?? _createGenericAnnotationWarning
         const warning = fn(annotationName, annotation);

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/config.js

@@ -2,6 +2,8 @@ const EXTENSION_ALLOWLIST = 'extension-allowlist'
 
 const PROTECTED_NAMESPACES = ['cds.xt']
 
+module.exports.PROTECTED_NAMESPACES = PROTECTED_NAMESPACES
+
 const BUILT_IN_NAMESPACES = ['cds.core', 'cds.outbox'] //> cds.outbox for legacy apps
 
 module.exports.isBuiltIn = (name) => {

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/index.js

@@ -4,6 +4,7 @@ const { deduplicateMessages } = require('@sap/cds-compiler')
 const NamespaceChecker = require('./namespace')
 const AnnotationsChecker = require('./annotations')
 const AllowlistChecker = require('./allowlist')
+const ProtectedNamespaceChecker = require('./protected-namespace')
 
 const customLinters = []
 
@@ -39,6 +40,7 @@ module.exports.lint = (extCsn, fullCsn, env = cds.env, cloneExt = false) => {
   const reflectedFullCsn = cds.reflect(fullCsn)
   const compileBaseDir = cds.root
   const messages = [
+    ...new ProtectedNamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new NamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new AnnotationsChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options, extCsn),
     ...new AllowlistChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options)