@sap/cds-dk 8.2.0 → 8.2.2

package/CHANGELOG.md

@@ -7,6 +7,23 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 8.2.2 - 2024-09-17
+
+### Fixed
+
+- BDSA-2024-6188: vulnerability with express.js 4.19.2
+- `cds import --out` copies the given metadata file to the correct output folder. CLI options are propagated to the `cds.import` API.
+- `cds add sample` no longer creates a irregular whitespace in `admin-service.js`.
+- `cds login` now correctly fetches tokens again with client credentials (or hints at invalid credentials).
+- `cds add handler` can now also be called from the `srv` dir.
+
+## Version 8.2.1 - 2024-09-05
+
+### Fixed
+
+- Update `@sap/hdi-deploy` to fix CVE-2024-4067 with `micromatch` 4.0.7
+- `cds add` plugins now correctly parse flags (options with `type: 'boolean'`) if not used as the last argument.
+
 ## Version 8.2.0 - 2024-09-02
 
 ### Added

package/bin/cds.js

@@ -60,7 +60,11 @@ const cli = {
           cds.cli = { command: 'add' }
           await cds.plugins
           for (const [, Plugin] of cds.add.registered) {
-            task.options.push(...Object.keys((new Plugin).options()).map(key => '--'+key))
+            const all = Object.entries((new Plugin).options())
+            const flags   = all.filter(([,f]) => f.type === 'boolean')
+            const options = all.filter(([,o]) => o.type !== 'boolean')
+            task.options.push(...options.map(([key]) => '--'+key))
+            task.flags.push(...flags.map(([key]) => '--'+key))
           }
         }
         const args = this.args(task, argv)

package/lib/import/common.js

@@ -17,7 +17,7 @@ let optionsMapping = {
 };
 
 let apiOptions = ['includeNamespaces', 'keepNamespace', 'beta'];
-let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config'];
+let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config', 'destination'];
 
 async function generateEDMX2JSON(edmx) {
     let cjson = convert.xml2json(edmx, {
@@ -155,7 +155,7 @@ async function preProcess(file, options, cwd) {
     return srcFilePath;
 }
 
-async function processOptions(cliOptions, odataOptions) {
+async function processOptions(cliOptions, options) {
     // maps to renaming of variables
     for (let [key, value] of Object.entries(optionsMapping)) {
         if (cliOptions[key]) {
@@ -165,9 +165,18 @@ async function processOptions(cliOptions, odataOptions) {
     }
     // segregating cli/odata options
     apiOptions.forEach(function (item) {
-        odataOptions[item] = cliOptions[item];
-        delete cliOptions[item];
+        if (cliOptions[item]) {
+            options[item] = cliOptions[item];
+            delete cliOptions[item];
+        }
+    });
+    // forward cli options to api options
+    commonOptions.forEach(function (item) {
+        if (cliOptions[item]) {
+            options[item] = cliOptions[item];
+        }
     });
+    
     // reads cli options from environment
     readEnvVariables(cliOptions, true);
 }
@@ -322,18 +331,21 @@ async function _updatePackageJson(dest, services, kind, cwd, config) {
     const package_json = path.resolve(cwd, 'package.json');
     const conf = await exists(package_json) ? require(package_json) : {};
     const requires = ['cds', 'requires'].reduce((p, n) => p[n] || (p[n] = {}), conf);
-    if (kind !== 'rest') {
+    if (kind !== 'rest' && kind !== 'rfc') {
         kind = (kind === "V2") ? 'odata-v2' : 'odata';
     }
     let package_json_updated = false;
     for (let service of services) {
-        // always update from given config data - e.g. delta imports may want to add service configuration data
+        // existing service configuration data can be updated, e.g. in case of delta imports
         const model = path.relative(cwd, dest).replace(/\\/g, '/'); // cds env must not be platform specific
-        cds.env.requires[service] = requires[service] = { kind: kind, model, ...config };
-        await write(package_json, JSON.stringify(conf, null, '  '));
-        package_json_updated = true;
+        const serviceConfig = { kind, model, ...config }
+        if (!requires[service] || JSON.stringify(serviceConfig) !== JSON.stringify(requires[service])) {
+            cds.env.requires[service] = requires[service] = serviceConfig;
+            package_json_updated = true;
+        }
     }
     if (package_json_updated) {
+        await write(package_json, JSON.stringify(conf, null, '  '));
         console.log(`[cds] - updated ./package.json`);
     }
 }
@@ -358,8 +370,7 @@ async function postProcess(filePath, options, csn, cwd) {
         config.credentials = { destination: options.destination };
     }
 
-    const external = path.resolve(cwd, 'srv/external');
-    const destFilePath = path.join(external, path.basename(filePath));
+    const destFilePath = path.resolve(cwd, options.out ? path.join(options.out, path.basename(filePath)) : path.join('srv/external/', path.basename(filePath)));
     if (options.out) options.out = _validateAndComputeOutputFilePath(options.out, options.as, destFilePath);
     const kind = options.inputFileKind;
     const result = await _getResult(csn, options.as, options.out || destFilePath.replace(/\.[^.]+$/, ''), options.force, kind);

package/lib/init/mvn.js

@@ -1,5 +1,4 @@
 const util = require('util')
-const path = require('path');
 const { exec } = require('child_process')
 const execAsync = util.promisify(exec)
 
@@ -105,11 +104,11 @@ module.exports.init = async function (projectName, options = cds.cli.options) {
 
 module.exports.generate = async function (feature, options = cds.cli.options) {
     const command = this.generateMvnParams(feature, options)
-    const cwd = options.cwd
+    const cwd = options.cwd ?? cds.root
 
     try {
         console.log(`Executing command: `, term.highlight('mvn ' + command.join(' ')))
-        await cmd.spawnCommand('mvn', command, { cwd: cwd ?? path.join(cds.root, 'srv') })
+        await cmd.spawnCommand('mvn', command, { cwd: cwd })
         return command
     } catch (err) {
         if (err.code === 'ENOENT' && err.path === 'mvn') {
@@ -125,7 +124,7 @@ module.exports.generateMvnParams = function (feature, options = cds.cli.options)
     const { 'java:mvn': javaMvn, force, filter, out } = options
     if (javaMvn) _scan(javaMvn).forEach(([k,v]) => params.set(k,v))
     const archVersion = params.get(`-DarchetypeVersion`) ?? ''
-    params.set(`cds:${archVersion}:generate`)
+    params.set(`com.sap.cds:cds-maven-plugin:${archVersion}:generate`)
 
     switch (feature) {
         case 'handler':

package/lib/init/template/sample/files/nodejs/admin-service.js

@@ -9,8 +9,8 @@ module.exports = class AdminService extends cds.ApplicationService { init(){
    */
   this.before ('NEW', Books.drafts, async (req) => {
     if (req.data.ID) return
-    const { ID:id1 } = await SELECT.one.from(Books).columns('max(ID) as ID')
-    const { ID:id2 } = await SELECT.one.from(Books.drafts).columns('max(ID) as ID')
+    const { ID:id1 } = await SELECT.one.from(Books).columns('max(ID) as ID')
+    const { ID:id2 } = await SELECT.one.from(Books.drafts).columns('max(ID) as ID')
     req.data.ID = Math.max(id1||0, id2||0) + 1
   })
   return super.init()

package/lib/mtx/settings_manager.js

@@ -13,7 +13,7 @@ const Question = require('./util/question');
 const { httpSchema, httpsSchema, schemaRegex, localhostRegex } = require('./util/urls');
 const { capitalize } = require('./util/strings');
 
-const LOG = cds.log('cli'), DEBUG = cds.debug('cli');
+const DEBUG = cds.debug('cli');
 
 const { ParamCollection, Persistence } = require('./params');
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.2.0",
+  "version": "8.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "8.2.0",
+      "version": "8.2.2",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -43,7 +43,7 @@
       }
     },
     "node_modules/@cap-js/db-service": {
-      "version": "1.12.0",
+      "version": "1.12.1",
       "license": "SEE LICENSE",
       "optional": true,
       "dependencies": {
@@ -139,7 +139,7 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.9.1",
+      "version": "9.10.0",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -152,6 +152,16 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.1.0",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "license": "Apache-2.0",
@@ -204,7 +214,7 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "8.2.0",
+      "version": "8.2.2",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": ">=5.1",
@@ -278,7 +288,7 @@
       }
     },
     "node_modules/@sap/eslint-plugin-cds": {
-      "version": "3.0.4",
+      "version": "3.0.5",
       "license": "See LICENSE file",
       "dependencies": {
         "@sap/cds": ">=7",
@@ -314,16 +324,16 @@
       }
     },
     "node_modules/@sap/hdi-deploy": {
-      "version": "5.2.1",
+      "version": "5.2.3",
       "hasInstallScript": true,
       "license": "See LICENSE file",
       "dependencies": {
         "@sap/hdi": "4.5.2",
         "@sap/xsenv": "5.2.0",
-        "async": "3.2.5",
+        "async": "3.2.6",
         "dotenv": "16.4.5",
         "handlebars": "4.7.8",
-        "micromatch": "4.0.7"
+        "micromatch": "4.0.8"
       },
       "engines": {
         "node": "^18.0.0 || ^20.0.0"
@@ -442,7 +452,7 @@
       }
     },
     "node_modules/async": {
-      "version": "3.2.5",
+      "version": "3.2.6",
       "license": "MIT"
     },
     "node_modules/asynckit": {
@@ -482,7 +492,7 @@
       "optional": true
     },
     "node_modules/better-sqlite3": {
-      "version": "11.2.1",
+      "version": "11.3.0",
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -492,7 +502,7 @@
       }
     },
     "node_modules/big.js": {
-      "version": "6.2.1",
+      "version": "6.2.2",
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -521,7 +531,7 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.2",
+      "version": "1.20.3",
       "license": "MIT",
       "dependencies": {
         "bytes": "3.1.2",
@@ -532,7 +542,7 @@
         "http-errors": "2.0.0",
         "iconv-lite": "0.4.24",
         "on-finished": "2.4.1",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "raw-body": "2.5.2",
         "type-is": "~1.6.18",
         "unpipe": "1.0.0"
@@ -824,7 +834,7 @@
       "license": "MIT"
     },
     "node_modules/encodeurl": {
-      "version": "1.0.2",
+      "version": "2.0.0",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -870,14 +880,15 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.9.1",
+      "version": "9.10.0",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.11.0",
         "@eslint/config-array": "^0.18.0",
         "@eslint/eslintrc": "^3.1.0",
-        "@eslint/js": "9.9.1",
+        "@eslint/js": "9.10.0",
+        "@eslint/plugin-kit": "^0.1.0",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.3.0",
         "@nodelib/fs.walk": "^1.2.8",
@@ -900,7 +911,6 @@
         "is-glob": "^4.0.0",
         "is-path-inside": "^3.0.3",
         "json-stable-stringify-without-jsonify": "^1.0.1",
-        "levn": "^0.4.1",
         "lodash.merge": "^4.6.2",
         "minimatch": "^3.1.2",
         "natural-compare": "^1.4.0",
@@ -1015,35 +1025,35 @@
       }
     },
     "node_modules/express": {
-      "version": "4.19.2",
+      "version": "4.21.0",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.2",
+        "body-parser": "1.20.3",
         "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
         "cookie": "0.6.0",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.2.0",
+        "finalhandler": "1.3.1",
         "fresh": "0.5.2",
         "http-errors": "2.0.0",
-        "merge-descriptors": "1.0.1",
+        "merge-descriptors": "1.0.3",
         "methods": "~1.1.2",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.7",
+        "path-to-regexp": "0.1.10",
         "proxy-addr": "~2.0.7",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
-        "send": "0.18.0",
-        "serve-static": "1.15.0",
+        "send": "0.19.0",
+        "serve-static": "1.16.2",
         "setprototypeof": "1.2.0",
         "statuses": "2.0.1",
         "type-is": "~1.6.18",
@@ -1117,11 +1127,11 @@
       }
     },
     "node_modules/finalhandler": {
-      "version": "1.2.0",
+      "version": "1.3.1",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
@@ -1173,7 +1183,7 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.6",
+      "version": "1.15.9",
       "funding": [
         {
           "type": "individual",
@@ -1554,8 +1564,11 @@
       }
     },
     "node_modules/merge-descriptors": {
-      "version": "1.0.1",
-      "license": "MIT"
+      "version": "1.0.3",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
     },
     "node_modules/methods": {
       "version": "1.1.2",
@@ -1565,7 +1578,7 @@
       }
     },
     "node_modules/micromatch": {
-      "version": "4.0.7",
+      "version": "4.0.8",
       "license": "MIT",
       "dependencies": {
         "braces": "^3.0.3",
@@ -1795,7 +1808,7 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.7",
+      "version": "0.1.10",
       "license": "MIT"
     },
     "node_modules/picomatch": {
@@ -1863,7 +1876,7 @@
       "license": "MIT"
     },
     "node_modules/pump": {
-      "version": "3.0.0",
+      "version": "3.0.2",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1879,10 +1892,10 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.11.0",
+      "version": "6.13.0",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.4"
+        "side-channel": "^1.0.6"
       },
       "engines": {
         "node": ">=0.6"
@@ -2037,7 +2050,7 @@
       }
     },
     "node_modules/send": {
-      "version": "0.18.0",
+      "version": "0.19.0",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -2069,18 +2082,25 @@
       "version": "2.0.0",
       "license": "MIT"
     },
+    "node_modules/send/node_modules/encodeurl": {
+      "version": "1.0.2",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/send/node_modules/ms": {
       "version": "2.1.3",
       "license": "MIT"
     },
     "node_modules/serve-static": {
-      "version": "1.15.0",
+      "version": "1.16.2",
       "license": "MIT",
       "dependencies": {
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.18.0"
+        "send": "0.19.0"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -2434,7 +2454,7 @@
       }
     },
     "node_modules/yaml": {
-      "version": "2.5.0",
+      "version": "2.5.1",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.2.0",
+  "version": "8.2.2",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [