@sap/cds-dk 10.1.2 → 10.2.1

package/node_modules/@sap/cds/libx/odata/middleware/read.js

@@ -3,6 +3,7 @@ const cds = require('../../../')
 const querystring = require('node:querystring')
 
 const { validateIfNoneMatch, getPreferReturnHeader } = require('../utils')
+const handle_ieee754 = require('../utils/ieee754')
 const getODataMetadata = require('../utils/metadata')
 const postProcess = require('../utils/postProcess')
 const getODataResult = require('../utils/result')
@@ -190,6 +191,9 @@ const _handleArrayOfQueriesFactory = adapter => {
           { context: mainOdataContext },
           { isCollection: !req._query[0].SELECT.one, property: req._query[0]._propertyAccess }
         )
+
+        handle_ieee754(req, result)
+
         res.send(result)
       })
       .catch(err => {
@@ -300,6 +304,8 @@ module.exports = adapter => {
 
         if (!result) cds.error(404)
 
+        handle_ieee754(req, result)
+
         res.send(result)
       })
       .catch(err => {

package/node_modules/@sap/cds/libx/odata/middleware/update.js

@@ -2,6 +2,7 @@ const cds = require('../../../')
 const { UPDATE } = cds.ql
 
 const { getPreferReturnHeader, isStream } = require('../utils')
+const handle_ieee754 = require('../utils/ieee754')
 const getODataMetadata = require('../utils/metadata')
 const postProcess = require('../utils/postProcess')
 const readAfterWrite4 = require('../utils/readAfterWrite')
@@ -101,7 +102,7 @@ module.exports = adapter => {
     }
 
     // query
-    const query = UPDATE.entity(from).with(data)
+    const query = UPDATE.entity(from).data(data)
 
     // cdsReq.headers should contain merged headers of envelope and subreq
     // REVISIT: this overrides the merging mechanism in cds.Request which is meant to handle this centrally !!
@@ -149,6 +150,9 @@ module.exports = adapter => {
 
         const metadata = getODataMetadata(_propertyAccess ? req._query : query, { result })
         result = getODataResult(result, metadata, { property: _propertyAccess })
+
+        handle_ieee754(req, result)
+
         res.send(result)
       })
       .catch(err => {

package/node_modules/@sap/cds/libx/odata/parse/afterburner.js

@@ -1037,13 +1037,13 @@ module.exports = (cqn, model, namespace, protocol) => {
   // target <=> endpoint entity, all navigation refs must be resolvable accordingly
   if (cds.env.effective.odata.structs) _resolveAliasesInNavigation(cqn, target)
 
-  // Add default aggregation function (and alias)
-  _processColumns(cqn, current, protocol)
-
   if (target && !returns_target) {
     // validate whether only known properties are used in query options
     _validateQuery(cqn.SELECT, target, model)
   }
 
+  // Add default aggregation function (and alias)
+  _processColumns(cqn, current, protocol)
+
   return cqn
 }

package/node_modules/@sap/cds/libx/odata/parse/multipartToJson.js

@@ -117,7 +117,7 @@ const _parseStream = async function* (body, boundary) {
         .toString()
         .replace(/^--(.*)$/gm, (_, g) => `HEAD /${g} HTTP/1.1${g.slice(-2) === '--' ? CRLF : ''}`)
         // correct content-length for non-HEAD requests is inserted below
-        .replace(/content-length: \d+\r\n/gim, '') // if content-length is given it should be taken
+        .replace(/content-length:[ \t]*\d+\r\n/gim, '') // if content-length is given it should be taken
         .replaceAll(/^(?:(GET|PUT|POST|PATCH|DELETE)).*(?:\r?\n(?!\r?\n).*)*/gim, block => {
           return block.replaceAll(/ \$/g, ' /$')
         })

package/node_modules/@sap/cds/libx/odata/utils/ieee754.js

@@ -0,0 +1,20 @@
+const cds = require('../../../lib')
+
+// Does the bound db serialize Int64/Decimal as strings? sqlite/postgres only under
+// features.ieee754compatible; HANA and 3rd-party adapters always. Fixed after bootstrap.
+let _asStrings
+function providedAsStrings() {
+  _asStrings ??= cds.db?.kind in { sqlite: 1, postgres: 1 } ? !!cds.env.features.ieee754compatible : true
+  return _asStrings
+}
+
+// Label every JSON response IEEE754Compatible=true (OData JSON Format §4.1); call right before
+// res.send so non-JSON/204 exits ($count, $value, return=minimal) stay bare. A custom handler
+// that already set Content-Type wins — force means force, but an explicit handler is more explicit.
+module.exports = function handle_ieee754(req, result) {
+  if (cds.env.odata.ieee754compatible === false) return //> opt-out
+  if (req.res.get('Content-Type')) return //> set by custom handler
+  if (result == null || !providedAsStrings()) return
+
+  req.res.set('Content-Type', 'application/json; charset=utf-8; IEEE754Compatible=true')
+}

package/node_modules/@sap/cds/libx/queue/TaskRunner.js

@@ -4,6 +4,26 @@ const QUEUED = 'queued'
 const PLANNED = 'planned'
 const CALLBACKS = 'callbacks'
 
+// Node's setTimeout delay is a 32-bit signed int; delays > MAX_TIMEOUT_MS emit a
+// TimeoutOverflowWarning and fire almost immediately. Chain segments so the callback
+// fires at the correct time. Returns a handle with cancel() that always clears the
+// currently-active segment — not just the first — so re-plans work at any point in the chain.
+const MAX_TIMEOUT_MS = 2 ** 31 - 1
+const _setLongTimeout = (cb, delay) => {
+  const deadline = Date.now() + delay
+  const handle = {}
+  const schedule = () => {
+    // Re-derive the step from the absolute deadline each segment, so lateness in one
+    // segment (process suspension, blocked event loop) doesn't compound across the chain.
+    const remaining = deadline - Date.now()
+    const step = Math.min(Math.max(remaining, 0), MAX_TIMEOUT_MS)
+    const t = setTimeout(remaining > MAX_TIMEOUT_MS ? schedule : cb, step).unref()
+    handle.cancel = () => clearTimeout(t)
+  }
+  schedule()
+  return handle
+}
+
 module.exports = class TaskRunner {
   constructor() {
     this.states = new Map()
@@ -49,11 +69,8 @@ module.exports = class TaskRunner {
     const newDate = Date.now() + waitingTime
     const alreadyPlanned = this._getStateProp(PLANNED, { name, tenant })
     if (!alreadyPlanned || alreadyPlanned.date > newDate) {
-      if (alreadyPlanned) clearInterval(alreadyPlanned.timer)
-      const timer = setTimeout(
-        () => (this._setStateProp(PLANNED, undefined, { name, tenant }), cb()),
-        waitingTime
-      ).unref()
+      if (alreadyPlanned) alreadyPlanned.timer.cancel()
+      const timer = _setLongTimeout(() => (this._setStateProp(PLANNED, undefined, { name, tenant }), cb()), waitingTime)
       this._setStateProp(PLANNED, { date: newDate, timer }, { name, tenant })
     }
   }

package/node_modules/@sap/cds/libx/queue/api.js

@@ -4,7 +4,7 @@ const LOG = cds.log('queue')
 let impl
 const _getImpl = () => {
   if (!impl) {
-    if (cds.env.requires.scheduling) {
+    if (cds.requires.scheduling) {
       LOG._debug && LOG.debug('Using scheduling-based event queue processing')
       impl = require('./processing')
     } else {

package/node_modules/@sap/cds/libx/queue/index.js

@@ -295,7 +295,9 @@ const _processTasks = (target, tenant, _opts = {}) => {
                 if (task.msg.queue?.every && (!task.msg.queue?.task || _cnt > 0)) {
                   const _m = { ...task.msg }
                   _m._fromSend = task.msg instanceof cds.Request
-                  await INSERT.into(tasksEntity).entries(create_task(target, _m, task.context, task.srvName, opts, true))
+                  await INSERT.into(tasksEntity).entries(
+                    create_task(target, _m, task.context, task.srvName, opts, true)
+                  )
                   // re-trigger the drain to schedule the new occurrence
                   _setWaitingTime(0)
                 }

package/node_modules/@sap/cds/libx/queue/processing.js

@@ -579,6 +579,11 @@ exports.queued = function queued(srv, opts) {
     // REVISIT: why is req.context preferred and when would they differ?
     const context = req.context || cds.context
 
+    // In MT apps, scheduling without a tenant is ambiguous — require explicit tenant context
+    if (cds.requires.multitenancy && !context.tenant) {
+      throw new Error(`Cannot schedule task without tenant context in multitenant app`)
+    }
+
     // persistent queue
     if (queueOpts.kind === 'persistent-queue' && _hasPersistentQueue(context.tenant)) {
       const scheduler = await cds.connect.to(SCHEDULER_SERVICE)

package/node_modules/@sap/cds/libx/rest/RestAdapter.js

@@ -74,6 +74,7 @@ class RestAdapter extends HttpAdapter {
           let def = req._operation || cds.infer.target(req._query)
           const defs = srv.model.definitions
           if (typeof def === 'string') def = defs[def] || defs[def.split(':$:')[0]].actions[def.split(':$:')[1]]
+          if (req._operation) def = def?.returns?.items ?? def?.returns
           if (def) postProcessData(result, srv, def)
         }
 

package/node_modules/@sap/cds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "10.1.1",
+  "version": "10.2.2",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [
@@ -29,7 +29,7 @@
     "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=22.12"
   },
   "dependencies": {
     "@sap/cds-compiler": "^7",

package/node_modules/@sap/cds/server.js

@@ -46,6 +46,7 @@ module.exports = async function cds_server (options) {
   if (o.static)    app.use (express.static (o.static))  //> defaults to ./app
   if (o.favicon)   app.use ('/favicon.ico', o.favicon)  //> if none in ./app
   if (o.index)     app.get ('/',o.index)                //> if none in ./app
+  if (o.index)     app.use ('/.cap', express.static (__dirname+'/app'))
 
   // load and prepare models
   const csn = await cds.load(o.from||'*',o); o.from = false

package/node_modules/@sap/cds/srv/ucl-service.cds

@@ -9,6 +9,7 @@ type State : String enum {
 @path    : '/ucl/spii/v1'
 @requires: 'any'
 @impl    : '@sap/cds/srv/ucl-service.js'
+@ORD.Extensions: { visibility : 'private' }
 service UCLService {
   @open
   @cds.persistence.skip

package/node_modules/@sap/cds-compiler/CHANGELOG.md

@@ -15,6 +15,67 @@ might use a deprecated flag only for a limited period of time.
 
 
 
+## Version 7.2.1 - 2026-10-20
+
+### Bug Fixes
+
+- **sql:**
+  + Render draft_admin_integrity constraint as `NOT VALIDATED`.
+  + Relax error for message `name-duplicate-artifact-exists` to warning.
+
+
+
+## Version 7.2.0 - 2026-10-16
+
+### Features
+
+- **compiler:**
+  + `parse.cdl`, `parse.cql` and `parse.expr` now convert all input to a string, allowing to pass e.g. a Buffer.
+  + Duplicate annotation values are now accepted if they have the same enum symbol
+    or the same scalar literal value.
+  + In a service annotated with `@cds.autoexpose: false`, entities which are annotated with `@cds.autoexpose`
+    won't be auto-exposed (unless the model entity is also a composition target).
+- **odata:** Update OData vocabulary `Common`: add experimental term `ExpandAfterConcatSupported`.
+- **sql:**
+  + Render referential constraints for `DraftAdministrativeData` for effecient draft cleanup
+    (to be activated with option `draft_admin_integrity`).
+  + Wrap predicates in `GROUP BY`, `ORDER BY` and in stored calculated element expressions
+    in a `CASE` statement for SAP HANA.
+
+### Bug Fixes
+
+- **compiler:**
+  + Elements and actions are now preserved when generating CDL for extensions with includes.
+- **odata:** Annotations on scalar types defined outside a service were silently dropped from OData V4
+    EDMX. Such types now are explicitly exposed as TypeDefinition with their annotations preserved.
+- **sql:**
+  + Raise an error for associations that are nested in virtual structured elements.
+  + Detect duplicate SQL names also for entities annotated with `cds.persistence.exists`.
+  + Omit `ORDER BY` and `GROUP BY` clauses that expand to no columns.
+  + Avoid unnecessary parentheses when rendering nested set operations for SQLite.
+  + Correctly render boolean OData functions as predicates in conditions for SAP HANA.
+
+### Improvements
+
+- **compiler:**
+  + Issue a warning if the same source element is projected multiple times under different names.
+  + Improve messages for problematic extensions.
+  + Avoid duplicate messages when trying to extend unknown definitions.
+  + When reporting a message about flawed uses of `...` in an annotation value, also provide a message id.
+- **odata:**
+  + For annotation expressions that are simple references, set `=` to the stringified reference in OData CSN.
+
+
+
+## Version 7.1.2 - 2026-10-12
+
+### Bug Fixes
+
+- **compiler:** don't issue error with competing includes extensions
+- **sql:** resolve named-argument refs to their FROM subquery alias
+
+
+
 ## Version 7.1.1 - 2026-09-08
 
 ### Bug Fixes
@@ -168,6 +229,28 @@ might use a deprecated flag only for a limited period of time.
     (for the message IDs `type-missing-argument`, `type-unexpected-argument`, `ref-unsupported-type`, and `ref-unexpected-args`).
 
 
+## Version 6.9.6 - 2026-10-12
+
+### Bug Fixes
+
+- **compiler:** don't issue error with competing includes extensions
+- **sql:**
+  + allow projection views for not-null elements with defaults
+  + Ensure to.sql.migration works with complex models
+  + resolve named-argument refs to their FROM subquery alias
+
+
+
+## Version 6.9.5 - 2026-09-08
+
+### Bug Fixes
+
+- **effective:**
+  + Fix dump in flattening for actions with entity parameters.
+  + Ensure consistent handling of reference-like annotation expressions during flattening.
+- **sql:** Add missing `@hierarchy` columns to localized convenience views.
+
+
 ## Version 6.9.4 - 2026-07-29
 
 ### Bug Fixes

package/node_modules/@sap/cds-compiler/bin/cdsse.js

@@ -59,7 +59,7 @@ function complete( err, buf ) {
   const off = offset( buf );
   if (!off)                     // outside buffer range
     return usage();
-  let hasId = false;
+  let hasId;
   if (off.prefix !== off.cursor) { // with keyword/name prefix
     // tokensAt( buf, off.cursor, false ); // list symbolAtCursor
     hasId = tokensAt( buf, off.prefix, off.col, false );