@sap/cds-dk 10.1.2 → 10.2.0

package/CHANGELOG.md

@@ -6,6 +6,43 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 10.2.0 - 2026-10-21
+
+### Added
+
+- `cds build --for` now accepts a comma-separated list of build task types.
+- `cds bind` now offers to renew service keys with expired X.509 client credentials before resolving hybrid bindings.
+- `cds add` now supports `--workspace <folder>` to add features to a project in a workspace folder.
+- `cds add react` and `cds add vue` now generate TypeScript applications in TypeScript projects, unless overridden with `--ts` or `--js`.
+- `cds add react` and `cds add vue` now register generated UIs under `app/*` as npm workspaces in the root `package.json`.
+- `cds add react` now generates strict, typechecked Vite applications with access to `#cds-models`.
+- `cds init` includes `.cds/` in its `.gitignore`.
+- `.target` in the cds REPL cql mode now shows the current target when invoked with no args.
+- `cds add data` now generates one record per enum value for code lists with an enum key, matching all code list keys. These rows are kept even when generating headers only.
+- `cds init` uses CAP Java 5.2.0
+
+### Fixed
+
+- `cds add http` now uses parenthesized key predicates for string-keyed `PATCH` and `DELETE` URLs, avoiding `404` responses.
+- `cds add data --keys-only` now keeps managed association foreign-key columns populated, preserving referential integrity in the generated placeholder rows.
+- `cds deploy --to hana` no longer saves an existing profile binding again on every deployment.
+- `cds add workzone-standard` enables HTML5 runtime discovery for single-tenant Destination service instances.
+- `cds add xsuaa --plan` now changes only the XSUAA plan for Cloud Foundry and Kyma, preserving the service name and keys.
+- `cds build` now creates HANA migration tables when another workspace's folder name is a prefix of the current project's folder name.
+- `cds watch` and generated UI watch scripts now ignore Vite source folders handled by hot module replacement.
+- `cds up` and Application Frontend MTA builds now reuse npm workspace installations for UI modules.
+- `cds add react` and `cds add vue` now generate relative frontend asset paths for deployment below any URL.
+- `cds add react` and `cds add vue` now support standalone App Router deployment through the HTML5 Application Repository.
+- `cds init` now hints to select a Node.js or Java runtime when none is specified.
+- `cds add extension` now configures the extension project to run on port 4006 by default.
+- `cds build` now minifies the model before compilation for `nodejs` and `java` build tasks if `cds.env.build.minify` is set to `true`. Enabling this option might lead to compilation errors if e.g. model types are used in custom code that are not otherwise referenced in the cds model.
+- `cds add extension` now declares `@cap-js/sqlite` as an `optionalDependency`, avoiding failures on `cds push`.
+- `cds add multitenancy` now uses `@sap/cds-mtxs` version 4 for Java projects, avoiding dependency conflicts with `@sap/cds` version 10.
+- `cds repl --run ...` now works even if cds-dk is only globally installed.
+- `cds build --ws-pack` no longer fails when the project is mounted at a single-level Linux path such as `/app`. The `isRoot` guard now correctly distinguishes the filesystem root (`/`) from paths like `/app` where `path.parse` returns the same `root` and `dir` but a non-empty `base`.
+- `cds upgrade` now uses `npm upgrade` instead of `npm install`, correctly upgrading multiple interconnected packages at once.
+- `cds login` sanitizes HTML in browser login error responses to prevent reflected cross-site scripting.
+
 ## Version 10.1.2 - 2026-09-17
 
 ### Fixed
@@ -34,6 +71,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Added
 
+- `cds login` supports browser-based single sign-on with SAP Cloud Identity Services (IAS) via the OAuth 2.0 Authorization Code (PKCE) flow. Use `--no-browser` to print the URL instead, or `--port` to set the loopback port.
+- `cds add ams` generates an `ExtensionDeveloper` policy (`ams/dcl/extensibility/extensionDeveloper.dcl`) for extensibility projects and wires `@sap/ams` into the MTX sidecar, so IAS-authenticated developers can be authorized for `cds push`/`pull`.
 - `cds add hana-serverless` sets up SAP HANA Cloud serverless as the database, provisioning one HDI container per tenant through the serverless Tenant API.
 - `cds add ai` now supports a `--plan` option to set the AI Core service plan in `mta.yaml` (default: `standard`).
 - `cds add data` now supports a `--keys-only` option that, together with `--records`, fills only key columns in the generated CSV files and leaves all other columns empty.
@@ -45,6 +84,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Fixed
 
+- `cds up` now forwards `BP_DEPENDENCY_MIRROR_*` variables to Paketo buildpacks.
 - `cds add data` now generates values across the full `@assert.range` when the range lies outside the default `[0,100]`, instead of emitting the lower bound for every record (integers) or exceeding the upper bound (decimals).
 - `cds add data` now generates varying `Time` values instead of the same fixed `22:59:53` for every record.
 - `cds add data` now honors `@assert.range` on `Double` elements instead of generating values across the default `[0,100]` regardless of the annotation.
@@ -54,6 +94,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `cds add data` no longer crashes with `Invalid time value` when a `Date` element has a single-day `@assert.range`.
 - `cds add data` now generates varied dates within `@assert.range` bounds on `Date`, `DateTime` and `Timestamp` elements when the range lies entirely outside the default `2000-2024` window, instead of emitting the same out-of-range value for every record.
 - `cds add data` now honors open-interval and infinity `@assert.range` bounds (such as `[(0),_]` or `[(5),(10)]`) on numeric and date elements, instead of ignoring them and generating values across the default range.
+- `cds add data` no longer includes excluded bounds when generating scaled decimals for open `@assert.range` intervals.
 - `cds add data` now generates the exact day for `Date` elements regardless of the local timezone, instead of occasionally emitting the day before the intended date.
 - `cds add data` now generates multiple distinct rows for link entities whose key consists of two or more associations, instead of collapsing them to a single row.
 - `cds add data` now writes the foreign-key column for to-one compositions into the parent CSV, instead of leaving the parent unlinked to its generated child.

package/bin/add.js

@@ -17,8 +17,8 @@ for (const plugin of [...fromDk, ...fromPlugins.keys()]) {
 
 const byShortcut = (a, b) => (b.short ? 1 : 0) - (a.short ? 1 : 0)
 
-const options = ['--for', '--package', ...Object.values(conf).flatMap(p => p.options).sort(byShortcut).map(o => o.key), '--java:mvn']
-const shortcuts = ['-4', '-p', ...Object.values(conf).flatMap(p => p.options).sort(byShortcut).map(o => o.short)]
+const options = ['--for', '--package', '--workspace', ...Object.values(conf).flatMap(p => p.options).sort(byShortcut).map(o => o.key), '--java:mvn']
+const shortcuts = ['-4', '-p', undefined, ...Object.values(conf).flatMap(p => p.options).sort(byShortcut).map(o => o.short)]
 const flags = ['--force', ...Object.values(conf).flatMap(p => p.flags).map(o => o.key)]
 DEBUG?.('cli config ', { options, shortcuts, flags })
 
@@ -54,6 +54,10 @@ ${cds.cli.command !== 'completion' && require('../lib/init').help()}
 
       Pull a package from your configured npm registry.
 
+    *--workspace* <folder>
+
+      Add features to the project in the given workspace folder.
+
 
 # FEATURE OPTIONS
 
@@ -71,6 +75,7 @@ ${Object.entries(conf).flatMap(([pluginName, { options, flags }]) => {
   *cds add* multitenancy hana xsuaa
   *cds add* multitenancy,hana,xsuaa
   *cds add* data --filter my.namespace.MyEntity
+  *cds add* hana --workspace bookshop
   *cds add* mta
   *cds add* kyma
 

package/bin/bind.js

@@ -5,11 +5,9 @@ module.exports = Object.assign(cds_bind, {
     staticCompletions: () => ({
         '--on':          ['cf', 'k8s'],
         '--for':         ['development', 'production', 'hybrid'],
-        '-4':            ['development', 'production', 'hybrid'],
         '--out':         FILE(),
         '--output-file': FILE(),
         '--credentials': FILE('json'),
-        '-c':            FILE('json'),
     }),
     options: ['--to', '--for', '--on', '--kind', '--out', '--to-app-services', '--credentials', '--output-file'],
     flags: ['--exec', '--no-create-service-key'],

package/bin/bindings.js

@@ -0,0 +1,35 @@
+module.exports = Object.assign ( run, {
+options: ['--as'],
+staticCompletions: () => ({
+  '--as': ['json', 'yaml'],
+}),
+help: `
+# SYNOPSIS
+
+    *cds bindings* <code snippet>
+
+    Reads and prints the information about locally running CAP services
+    from ~/.cds/services.json file. This is particularly useful for agents
+    to access that information without requesting for approval to directly
+    accessing the file in the user's home directory.
+
+# EXAMPLES
+
+    cds bindings
+    cds bindings --as json
+`})
+
+const cds = require('../lib/cds')
+const YAML = cds.utils.yaml
+
+// support the like of cds -e "<...>" as in node.js --> pretty helpful for quick test setups
+async function run (_, { as }) {
+  const { inspect } = require('util'); inspect.defaultOptions = { depth: null, colors: true }
+  const bindings = await cds.service.bindings
+  return console.log ((
+    as === 'yaml' ? YAML.stringify(bindings) :
+    as === 'json' ? JSON.stringify(bindings,null,2) :
+    !process.stdout.isTTY ? YAML.stringify(bindings) :
+    bindings
+  ))
+}

package/bin/build.js

@@ -1,12 +1,13 @@
-const { DIR } = require('./completion');
+const { DIR, FILE } = require('./completion');
 
 module.exports = Object.assign(build, {
     staticCompletions: () => ({
-        '--for':      ['hana', 'helm', 'java', 'mtx', 'mtx-extension', 'mtx-sidecar', 'nodejs'],
-        '--log-level':['debug', 'info', 'warn', 'error'],
-        '--project':  DIR(),
-        '--dest':     DIR(),
-        '--src':      DIR(),
+        '--for':           ['hana', 'helm', 'java', 'mtx', 'mtx-extension', 'mtx-sidecar', 'nodejs'],
+        '--log-level':     ['debug', 'info', 'warn', 'error'],
+        '--project':       DIR(),
+        '--dest':          DIR(),
+        '--src':           DIR(),
+        '--options-model': FILE('cds,json', { dirs: true }),
     }),
     options: ['--project', '--src', '--dest', '--for', '--opts', '--log-level', '--options-model'],
     shortcuts: ['-in', '-s', '-o', '-4'],
@@ -31,6 +32,9 @@ module.exports = Object.assign(build, {
 
         For example, the 'hana' build task will create SAP HANA artifacts.
 
+        Multiple build tasks can be selected by providing a comma-separated list,
+        e.g. *--for nodejs,mtx-sidecar*.
+
     *-s | --src* <folder>
 
         The module folder to build using the build task defined by option '--for'.
@@ -109,6 +113,7 @@ module.exports = Object.assign(build, {
    *cds* build
    *cds* build --production --log-level info
    *cds* build --for hana
+   *cds* build --for nodejs,mtx-sidecar
    *cds* build --for java --src service1
    *cds* build --for java --dest ../srv/target --opts model=[db/model,srv,schema]
 `})

package/bin/compile/index.js

@@ -2,6 +2,7 @@ const { FILE, DIR } = require('../completion');
 
 module.exports = Object.assign ( compile, {
   staticCompletions: () => ({
+    '--from':                ['cdl', 'json', 'yaml'],
     '--to':                  ['json', 'yml', 'edm', 'edmx', 'edmx-v2', 'edmx-v4', 'sql', 'hdbtable', 'hana', 'cdl', 'xsuaa', 'openapi', 'asyncapi'],
     '--for':                 ['odata', 'sql'],
     '--dialect':             ['sqlite', 'h2', 'postgres', 'hana'],