@sap/cds-dk 8.2.1 → 8.2.2

package/CHANGELOG.md

@@ -7,6 +7,16 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 8.2.2 - 2024-09-17
+
+### Fixed
+
+- BDSA-2024-6188: vulnerability with express.js 4.19.2
+- `cds import --out` copies the given metadata file to the correct output folder. CLI options are propagated to the `cds.import` API.
+- `cds add sample` no longer creates a irregular whitespace in `admin-service.js`.
+- `cds login` now correctly fetches tokens again with client credentials (or hints at invalid credentials).
+- `cds add handler` can now also be called from the `srv` dir.
+
 ## Version 8.2.1 - 2024-09-05
 
 ### Fixed

package/lib/import/common.js

@@ -17,7 +17,7 @@ let optionsMapping = {
 };
 
 let apiOptions = ['includeNamespaces', 'keepNamespace', 'beta'];
-let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config'];
+let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config', 'destination'];
 
 async function generateEDMX2JSON(edmx) {
     let cjson = convert.xml2json(edmx, {
@@ -155,7 +155,7 @@ async function preProcess(file, options, cwd) {
     return srcFilePath;
 }
 
-async function processOptions(cliOptions, odataOptions) {
+async function processOptions(cliOptions, options) {
     // maps to renaming of variables
     for (let [key, value] of Object.entries(optionsMapping)) {
         if (cliOptions[key]) {
@@ -165,9 +165,18 @@ async function processOptions(cliOptions, odataOptions) {
     }
     // segregating cli/odata options
     apiOptions.forEach(function (item) {
-        odataOptions[item] = cliOptions[item];
-        delete cliOptions[item];
+        if (cliOptions[item]) {
+            options[item] = cliOptions[item];
+            delete cliOptions[item];
+        }
+    });
+    // forward cli options to api options
+    commonOptions.forEach(function (item) {
+        if (cliOptions[item]) {
+            options[item] = cliOptions[item];
+        }
     });
+    
     // reads cli options from environment
     readEnvVariables(cliOptions, true);
 }
@@ -361,8 +370,7 @@ async function postProcess(filePath, options, csn, cwd) {
         config.credentials = { destination: options.destination };
     }
 
-    const external = path.resolve(cwd, 'srv/external');
-    const destFilePath = path.join(external, path.basename(filePath));
+    const destFilePath = path.resolve(cwd, options.out ? path.join(options.out, path.basename(filePath)) : path.join('srv/external/', path.basename(filePath)));
     if (options.out) options.out = _validateAndComputeOutputFilePath(options.out, options.as, destFilePath);
     const kind = options.inputFileKind;
     const result = await _getResult(csn, options.as, options.out || destFilePath.replace(/\.[^.]+$/, ''), options.force, kind);

package/lib/init/mvn.js

@@ -1,5 +1,4 @@
 const util = require('util')
-const path = require('path');
 const { exec } = require('child_process')
 const execAsync = util.promisify(exec)
 
@@ -105,11 +104,11 @@ module.exports.init = async function (projectName, options = cds.cli.options) {
 
 module.exports.generate = async function (feature, options = cds.cli.options) {
     const command = this.generateMvnParams(feature, options)
-    const cwd = options.cwd
+    const cwd = options.cwd ?? cds.root
 
     try {
         console.log(`Executing command: `, term.highlight('mvn ' + command.join(' ')))
-        await cmd.spawnCommand('mvn', command, { cwd: cwd ?? path.join(cds.root, 'srv') })
+        await cmd.spawnCommand('mvn', command, { cwd: cwd })
         return command
     } catch (err) {
         if (err.code === 'ENOENT' && err.path === 'mvn') {
@@ -125,7 +124,7 @@ module.exports.generateMvnParams = function (feature, options = cds.cli.options)
     const { 'java:mvn': javaMvn, force, filter, out } = options
     if (javaMvn) _scan(javaMvn).forEach(([k,v]) => params.set(k,v))
     const archVersion = params.get(`-DarchetypeVersion`) ?? ''
-    params.set(`cds:${archVersion}:generate`)
+    params.set(`com.sap.cds:cds-maven-plugin:${archVersion}:generate`)
 
     switch (feature) {
         case 'handler':

package/lib/init/template/sample/files/nodejs/admin-service.js

@@ -9,8 +9,8 @@ module.exports = class AdminService extends cds.ApplicationService { init(){
    */
   this.before ('NEW', Books.drafts, async (req) => {
     if (req.data.ID) return
-    const { ID:id1 } = await SELECT.one.from(Books).columns('max(ID) as ID')
-    const { ID:id2 } = await SELECT.one.from(Books.drafts).columns('max(ID) as ID')
+    const { ID:id1 } = await SELECT.one.from(Books).columns('max(ID) as ID')
+    const { ID:id2 } = await SELECT.one.from(Books.drafts).columns('max(ID) as ID')
     req.data.ID = Math.max(id1||0, id2||0) + 1
   })
   return super.init()

package/lib/mtx/settings_manager.js

@@ -13,7 +13,7 @@ const Question = require('./util/question');
 const { httpSchema, httpsSchema, schemaRegex, localhostRegex } = require('./util/urls');
 const { capitalize } = require('./util/strings');
 
-const LOG = cds.log('cli'), DEBUG = cds.debug('cli');
+const DEBUG = cds.debug('cli');
 
 const { ParamCollection, Persistence } = require('./params');
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.2.1",
+  "version": "8.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "8.2.1",
+      "version": "8.2.2",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -139,7 +139,7 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.9.1",
+      "version": "9.10.0",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -152,6 +152,16 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.1.0",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "license": "Apache-2.0",
@@ -204,7 +214,7 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "8.2.1",
+      "version": "8.2.2",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": ">=5.1",
@@ -278,7 +288,7 @@
       }
     },
     "node_modules/@sap/eslint-plugin-cds": {
-      "version": "3.0.4",
+      "version": "3.0.5",
       "license": "See LICENSE file",
       "dependencies": {
         "@sap/cds": ">=7",
@@ -314,7 +324,7 @@
       }
     },
     "node_modules/@sap/hdi-deploy": {
-      "version": "5.2.2",
+      "version": "5.2.3",
       "hasInstallScript": true,
       "license": "See LICENSE file",
       "dependencies": {
@@ -482,7 +492,7 @@
       "optional": true
     },
     "node_modules/better-sqlite3": {
-      "version": "11.2.1",
+      "version": "11.3.0",
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -492,7 +502,7 @@
       }
     },
     "node_modules/big.js": {
-      "version": "6.2.1",
+      "version": "6.2.2",
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -521,7 +531,7 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.2",
+      "version": "1.20.3",
       "license": "MIT",
       "dependencies": {
         "bytes": "3.1.2",
@@ -532,7 +542,7 @@
         "http-errors": "2.0.0",
         "iconv-lite": "0.4.24",
         "on-finished": "2.4.1",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "raw-body": "2.5.2",
         "type-is": "~1.6.18",
         "unpipe": "1.0.0"
@@ -824,7 +834,7 @@
       "license": "MIT"
     },
     "node_modules/encodeurl": {
-      "version": "1.0.2",
+      "version": "2.0.0",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -870,14 +880,15 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.9.1",
+      "version": "9.10.0",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.11.0",
         "@eslint/config-array": "^0.18.0",
         "@eslint/eslintrc": "^3.1.0",
-        "@eslint/js": "9.9.1",
+        "@eslint/js": "9.10.0",
+        "@eslint/plugin-kit": "^0.1.0",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.3.0",
         "@nodelib/fs.walk": "^1.2.8",
@@ -900,7 +911,6 @@
         "is-glob": "^4.0.0",
         "is-path-inside": "^3.0.3",
         "json-stable-stringify-without-jsonify": "^1.0.1",
-        "levn": "^0.4.1",
         "lodash.merge": "^4.6.2",
         "minimatch": "^3.1.2",
         "natural-compare": "^1.4.0",
@@ -1015,35 +1025,35 @@
       }
     },
     "node_modules/express": {
-      "version": "4.19.2",
+      "version": "4.21.0",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.2",
+        "body-parser": "1.20.3",
         "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
         "cookie": "0.6.0",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.2.0",
+        "finalhandler": "1.3.1",
         "fresh": "0.5.2",
         "http-errors": "2.0.0",
-        "merge-descriptors": "1.0.1",
+        "merge-descriptors": "1.0.3",
         "methods": "~1.1.2",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.7",
+        "path-to-regexp": "0.1.10",
         "proxy-addr": "~2.0.7",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
-        "send": "0.18.0",
-        "serve-static": "1.15.0",
+        "send": "0.19.0",
+        "serve-static": "1.16.2",
         "setprototypeof": "1.2.0",
         "statuses": "2.0.1",
         "type-is": "~1.6.18",
@@ -1117,11 +1127,11 @@
       }
     },
     "node_modules/finalhandler": {
-      "version": "1.2.0",
+      "version": "1.3.1",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
@@ -1173,7 +1183,7 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.8",
+      "version": "1.15.9",
       "funding": [
         {
           "type": "individual",
@@ -1554,8 +1564,11 @@
       }
     },
     "node_modules/merge-descriptors": {
-      "version": "1.0.1",
-      "license": "MIT"
+      "version": "1.0.3",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
     },
     "node_modules/methods": {
       "version": "1.1.2",
@@ -1795,7 +1808,7 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.7",
+      "version": "0.1.10",
       "license": "MIT"
     },
     "node_modules/picomatch": {
@@ -1863,7 +1876,7 @@
       "license": "MIT"
     },
     "node_modules/pump": {
-      "version": "3.0.0",
+      "version": "3.0.2",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1879,10 +1892,10 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.11.0",
+      "version": "6.13.0",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.4"
+        "side-channel": "^1.0.6"
       },
       "engines": {
         "node": ">=0.6"
@@ -2037,7 +2050,7 @@
       }
     },
     "node_modules/send": {
-      "version": "0.18.0",
+      "version": "0.19.0",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -2069,18 +2082,25 @@
       "version": "2.0.0",
       "license": "MIT"
     },
+    "node_modules/send/node_modules/encodeurl": {
+      "version": "1.0.2",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/send/node_modules/ms": {
       "version": "2.1.3",
       "license": "MIT"
     },
     "node_modules/serve-static": {
-      "version": "1.15.0",
+      "version": "1.16.2",
       "license": "MIT",
       "dependencies": {
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.18.0"
+        "send": "0.19.0"
       },
       "engines": {
         "node": ">= 0.8.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.2.1",
+  "version": "8.2.2",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [