@sap/cds-dk 8.2.1 → 8.2.3

package/CHANGELOG.md

@@ -7,6 +7,26 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 8.2.3 - 2024-09-25
+
+### Fixed
+
+- In `cds.cli.command`, commands now show up in the correct case.
+- `cds add` plugins don't throw a `TypeError` if `cds.cli.options` is `undefined`.
+- `cds watch` no longer ignores `*git/` folders, but only `.git/`.
+- `cds import` updates `package.json` file in `srv` folder if existing. The `srv` folder name is determined by `cds.env.folders.srv` config or parameter `--out`.
+- `cds import` doesn't change existing service configuration data. Now, `destination` credentials are only saved for the `production` profile.
+
+## Version 8.2.2 - 2024-09-17
+
+### Fixed
+
+- BDSA-2024-6188: vulnerability with express.js 4.19.2
+- `cds import --out` copies the given metadata file to the correct output folder. CLI options are propagated to the `cds.import` API.
+- `cds add sample` no longer creates a irregular whitespace in `admin-service.js`.
+- `cds login` now correctly fetches tokens again with client credentials (or hints at invalid credentials).
+- `cds add handler` can now also be called from the `srv` dir.
+
 ## Version 8.2.1 - 2024-09-05
 
 ### Fixed

package/bin/cds.js

@@ -33,6 +33,10 @@ const cli = {
     if (cmd in this.Shortcuts) cmd = process.argv[2] = this.Shortcuts[cmd]
     if (argv.some(a => this.Shortcuts[a]==='help'))  return this.help (cmd)
 
+    // normalize command case (but not the shortcuts above) so that checks against `cds.cli.command` work
+    if (cmd === process.argv[2]) cmd = process.argv[2] = cmd.toLowerCase()
+    else if (cmd) cmd = cmd.toLowerCase()
+
     const cds = require('../lib') // make sure to load cds-dk API for plugins
     DEBUG?.(`[cds] - @sap/cds ${cds.version} loaded: ${cds.home}`)
 
@@ -69,11 +73,7 @@ const cli = {
         }
         const args = this.args(task, argv)
         args[0].push(...appendArgs)
-        cds.cli = {
-          command: cmd,
-          argv: args[0],
-          options: args[1],
-        }
+        cds.cli = { command: cmd, argv: args[0], options: args[1] }
 
         if (args[1]?.['resolve-bindings']) await _resolveBindings({ silent: cmd === 'env' })
 

package/bin/watch.js

@@ -56,7 +56,7 @@ const fs = require ('fs')
 
 const extDefaults = 'cds,csn,csv,ts,mjs,cjs,js,json,properties,edmx,xml,env'
 const ignore = RegExp(
-  `(.git|node_modules|_out|@types|@cds-models)\\${sep}` +
+  `(\\.git|node_modules|_out|@types|@cds-models)\\${sep}` +
   `|app(\\${sep}.+)?\\${sep}(` +
     `(webapp|dist|target)\\${sep}|` +
     `tsconfig\\.json$|` +

package/lib/import/common.js

@@ -17,7 +17,7 @@ let optionsMapping = {
 };
 
 let apiOptions = ['includeNamespaces', 'keepNamespace', 'beta'];
-let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config'];
+let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config', 'destination'];
 
 async function generateEDMX2JSON(edmx) {
     let cjson = convert.xml2json(edmx, {
@@ -155,7 +155,7 @@ async function preProcess(file, options, cwd) {
     return srcFilePath;
 }
 
-async function processOptions(cliOptions, odataOptions) {
+async function processOptions(cliOptions, options) {
     // maps to renaming of variables
     for (let [key, value] of Object.entries(optionsMapping)) {
         if (cliOptions[key]) {
@@ -165,9 +165,18 @@ async function processOptions(cliOptions, odataOptions) {
     }
     // segregating cli/odata options
     apiOptions.forEach(function (item) {
-        odataOptions[item] = cliOptions[item];
-        delete cliOptions[item];
+        if (cliOptions[item]) {
+            options[item] = cliOptions[item];
+            delete cliOptions[item];
+        }
+    });
+    // forward cli options to api options
+    commonOptions.forEach(function (item) {
+        if (cliOptions[item]) {
+            options[item] = cliOptions[item];
+        }
     });
+
     // reads cli options from environment
     readEnvVariables(cliOptions, true);
 }
@@ -303,10 +312,10 @@ async function _write(result, service, cwd) {
     extension = dest.substring(dest.lastIndexOf('.'));
     dest = dest.replace(extension, '');
      if (service.length > 1){
-        using = `using { ${service.join(', ')}} from './${path.relative('srv', dest).replace(/\\/g, '/')}'`;
+        using = `using { ${service.join(', ')}} from './${path.relative(cds.env.folders.srv, dest).replace(/\\/g, '/')}'`;
      }
      else{
-        using = `using { ${service} as external } from './${path.relative('srv', dest).replace(/\\/g, '/')}'`;
+        using = `using { ${service} as external } from './${path.relative(cds.env.folders.srv, dest).replace(/\\/g, '/')}'`;
      }
     using = require('../util/term').info(using);
     message = `[cds] - imported API to ${path.relative(cwd, dest)}
@@ -318,21 +327,36 @@ ${using}
     console.log(message);
 }
 
-async function _updatePackageJson(dest, services, kind, cwd, config) {
-    const package_json = path.resolve(cwd, 'package.json');
-    const conf = await exists(package_json) ? require(package_json) : {};
+async function _updatePackageJson(dest, services, kind, cwd, config, destination) {
+    // try to find package.json in the srv folder
+    let package_json = _findPackageJson(path.resolve(cwd, dest), cwd);
+    let conf = {};
+    if (package_json) {
+        conf = JSON.parse(await read(package_json, "utf-8"));
+    } else {
+        package_json = path.resolve(cwd, 'package.json');
+    }
     const requires = ['cds', 'requires'].reduce((p, n) => p[n] || (p[n] = {}), conf);
     if (kind !== 'rest' && kind !== 'rfc') {
         kind = (kind === "V2") ? 'odata-v2' : 'odata';
     }
+    // add destination configuration
+    if (!config && destination) {
+        config = { "[production]": { credentials: { destination } } };
+    }
+
     let package_json_updated = false;
     for (let service of services) {
         // existing service configuration data can be updated, e.g. in case of delta imports
         const model = path.relative(cwd, dest).replace(/\\/g, '/'); // cds env must not be platform specific
         const serviceConfig = { kind, model, ...config }
-        if (!requires[service] || JSON.stringify(serviceConfig) !== JSON.stringify(requires[service])) {
+        if (!requires[service]) {
             cds.env.requires[service] = requires[service] = serviceConfig;
             package_json_updated = true;
+        } else {
+            if (JSON.stringify(serviceConfig) !== JSON.stringify(requires[service])) {
+                console.warn(`Service '${service}' already exists in ./package.json with a different configuration, skipping update.\n`);
+            }
         }
     }
     if (package_json_updated) {
@@ -341,6 +365,21 @@ async function _updatePackageJson(dest, services, kind, cwd, config) {
     }
 }
 
+function _findPackageJson(dir, cwd) {
+    const packageJsonPath = path.join(dir, 'package.json');
+    if (fs.existsSync(packageJsonPath)) {
+        return packageJsonPath;
+    }
+    if (dir === cwd) {
+        return null;
+    }
+    const parentDir = path.dirname(dir);
+    if (parentDir === dir) {
+        return null;
+    }
+    return _findPackageJson(parentDir, cwd);
+}
+
 function _parseValidJsonConfig(config) {
     try {
         if (config) {
@@ -354,20 +393,12 @@ function _parseValidJsonConfig(config) {
 async function postProcess(filePath, options, csn, cwd) {
     const services = _getServiceNames(csn);
     let config = _parseValidJsonConfig(options.config);
-    
-    // add destination configuration
-    if (options.destination) {
-        config ??= {};
-        config.credentials = { destination: options.destination };
-    }
-
-    const external = path.resolve(cwd, 'srv/external');
-    const destFilePath = path.join(external, path.basename(filePath));
+    const destFilePath = path.resolve(cwd, options.out ? path.join(options.out, path.basename(filePath)) : path.join(cds.env.folders.srv, 'external', path.basename(filePath)));
     if (options.out) options.out = _validateAndComputeOutputFilePath(options.out, options.as, destFilePath);
     const kind = options.inputFileKind;
     const result = await _getResult(csn, options.as, options.out || destFilePath.replace(/\.[^.]+$/, ''), options.force, kind);
     const written = options.dry || await _write(result, services, cwd);
-    const registered = options.dry || options.no_save || await _updatePackageJson(result[1].replace(/\.[^.]+$/, ''), services, kind, cwd, config);
+    const registered = options.dry || options.no_save || await _updatePackageJson(result[1].replace(/\.[^.]+$/, ''), services, kind, cwd, config, options.destination);
     if (!options.dry && !options.no_copy)
         await _copyToSrvExternal(filePath, destFilePath, cwd);
     if (options.dry) return console.log(result[0]);

package/lib/init/mvn.js

@@ -1,5 +1,4 @@
 const util = require('util')
-const path = require('path');
 const { exec } = require('child_process')
 const execAsync = util.promisify(exec)
 
@@ -105,11 +104,11 @@ module.exports.init = async function (projectName, options = cds.cli.options) {
 
 module.exports.generate = async function (feature, options = cds.cli.options) {
     const command = this.generateMvnParams(feature, options)
-    const cwd = options.cwd
+    const cwd = options.cwd ?? cds.root
 
     try {
         console.log(`Executing command: `, term.highlight('mvn ' + command.join(' ')))
-        await cmd.spawnCommand('mvn', command, { cwd: cwd ?? path.join(cds.root, 'srv') })
+        await cmd.spawnCommand('mvn', command, { cwd: cwd })
         return command
     } catch (err) {
         if (err.code === 'ENOENT' && err.path === 'mvn') {
@@ -125,7 +124,7 @@ module.exports.generateMvnParams = function (feature, options = cds.cli.options)
     const { 'java:mvn': javaMvn, force, filter, out } = options
     if (javaMvn) _scan(javaMvn).forEach(([k,v]) => params.set(k,v))
     const archVersion = params.get(`-DarchetypeVersion`) ?? ''
-    params.set(`cds:${archVersion}:generate`)
+    params.set(`com.sap.cds:cds-maven-plugin:${archVersion}:generate`)
 
     switch (feature) {
         case 'handler':

package/lib/init/projectReader.js

@@ -13,7 +13,7 @@ module.exports = new class ProjectReader {
 
     #setPackageInfo() {
         // 1. Use project name and static default values
-        this.appVersion = cds.cli.options.add?.has('java') ? '1.0.0-SNAPSHOT' : '1.0.0'
+        this.appVersion = cds.cli.options?.add?.has('java') ? '1.0.0-SNAPSHOT' : '1.0.0'
         this.appName = this.appId = basename(cds.root)
         this.appDescription = 'A simple CAP project.'
 

package/lib/init/template/sample/files/nodejs/admin-service.js

@@ -9,8 +9,8 @@ module.exports = class AdminService extends cds.ApplicationService { init(){
    */
   this.before ('NEW', Books.drafts, async (req) => {
     if (req.data.ID) return
-    const { ID:id1 } = await SELECT.one.from(Books).columns('max(ID) as ID')
-    const { ID:id2 } = await SELECT.one.from(Books.drafts).columns('max(ID) as ID')
+    const { ID:id1 } = await SELECT.one.from(Books).columns('max(ID) as ID')
+    const { ID:id2 } = await SELECT.one.from(Books.drafts).columns('max(ID) as ID')
     req.data.ID = Math.max(id1||0, id2||0) + 1
   })
   return super.init()

package/lib/mtx/settings_manager.js

@@ -13,7 +13,7 @@ const Question = require('./util/question');
 const { httpSchema, httpsSchema, schemaRegex, localhostRegex } = require('./util/urls');
 const { capitalize } = require('./util/strings');
 
-const LOG = cds.log('cli'), DEBUG = cds.debug('cli');
+const DEBUG = cds.debug('cli');
 
 const { ParamCollection, Persistence } = require('./params');
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.2.1",
+  "version": "8.2.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "8.2.1",
+      "version": "8.2.3",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -99,7 +99,7 @@
       }
     },
     "node_modules/@eslint-community/regexpp": {
-      "version": "4.11.0",
+      "version": "4.11.1",
       "license": "MIT",
       "engines": {
         "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
@@ -139,7 +139,7 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.9.1",
+      "version": "9.10.0",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -152,6 +152,16 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.1.0",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "license": "Apache-2.0",
@@ -204,7 +214,7 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "8.2.1",
+      "version": "8.2.3",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": ">=5.1",
@@ -278,7 +288,7 @@
       }
     },
     "node_modules/@sap/eslint-plugin-cds": {
-      "version": "3.0.4",
+      "version": "3.0.5",
       "license": "See LICENSE file",
       "dependencies": {
         "@sap/cds": ">=7",
@@ -292,13 +302,13 @@
       }
     },
     "node_modules/@sap/hdi": {
-      "version": "4.5.2",
+      "version": "4.6.0",
       "license": "See LICENSE file",
       "dependencies": {
-        "async": "3.2.3"
+        "async": "^3.2.3"
       },
       "engines": {
-        "node": ">=12 <=20"
+        "node": ">=18 <=20"
       },
       "peerDependencies": {
         "@sap/hana-client": "^2 >= 2.5",
@@ -314,16 +324,16 @@
       }
     },
     "node_modules/@sap/hdi-deploy": {
-      "version": "5.2.2",
+      "version": "5.3.1",
       "hasInstallScript": true,
       "license": "See LICENSE file",
       "dependencies": {
-        "@sap/hdi": "4.5.2",
-        "@sap/xsenv": "5.2.0",
-        "async": "3.2.6",
-        "dotenv": "16.4.5",
-        "handlebars": "4.7.8",
-        "micromatch": "4.0.8"
+        "@sap/hdi": "^4.6.0",
+        "@sap/xsenv": "^5.2.0",
+        "async": "^3.2.6",
+        "dotenv": "^16.4.5",
+        "handlebars": "^4.7.8",
+        "micromatch": "^4.0.8"
       },
       "engines": {
         "node": "^18.0.0 || ^20.0.0"
@@ -341,16 +351,12 @@
         }
       }
     },
-    "node_modules/@sap/hdi/node_modules/async": {
-      "version": "3.2.3",
-      "license": "MIT"
-    },
     "node_modules/@sap/xsenv": {
-      "version": "5.2.0",
+      "version": "5.3.0",
       "license": "SEE LICENSE IN LICENSE file",
       "dependencies": {
-        "debug": "4.3.5",
-        "node-cache": "^5.1.0",
+        "debug": "4.3.7",
+        "node-cache": "^5.1.2",
         "verror": "1.10.1"
       },
       "engines": {
@@ -482,7 +488,7 @@
       "optional": true
     },
     "node_modules/better-sqlite3": {
-      "version": "11.2.1",
+      "version": "11.3.0",
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -492,7 +498,7 @@
       }
     },
     "node_modules/big.js": {
-      "version": "6.2.1",
+      "version": "6.2.2",
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -521,7 +527,7 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.2",
+      "version": "1.20.3",
       "license": "MIT",
       "dependencies": {
         "bytes": "3.1.2",
@@ -532,7 +538,7 @@
         "http-errors": "2.0.0",
         "iconv-lite": "0.4.24",
         "on-finished": "2.4.1",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "raw-body": "2.5.2",
         "type-is": "~1.6.18",
         "unpipe": "1.0.0"
@@ -724,10 +730,10 @@
       }
     },
     "node_modules/debug": {
-      "version": "4.3.5",
+      "version": "4.3.7",
       "license": "MIT",
       "dependencies": {
-        "ms": "2.1.2"
+        "ms": "^2.1.3"
       },
       "engines": {
         "node": ">=6.0"
@@ -824,7 +830,7 @@
       "license": "MIT"
     },
     "node_modules/encodeurl": {
-      "version": "1.0.2",
+      "version": "2.0.0",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -870,14 +876,15 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.9.1",
+      "version": "9.10.0",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.11.0",
         "@eslint/config-array": "^0.18.0",
         "@eslint/eslintrc": "^3.1.0",
-        "@eslint/js": "9.9.1",
+        "@eslint/js": "9.10.0",
+        "@eslint/plugin-kit": "^0.1.0",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.3.0",
         "@nodelib/fs.walk": "^1.2.8",
@@ -900,7 +907,6 @@
         "is-glob": "^4.0.0",
         "is-path-inside": "^3.0.3",
         "json-stable-stringify-without-jsonify": "^1.0.1",
-        "levn": "^0.4.1",
         "lodash.merge": "^4.6.2",
         "minimatch": "^3.1.2",
         "natural-compare": "^1.4.0",
@@ -1015,35 +1021,35 @@
       }
     },
     "node_modules/express": {
-      "version": "4.19.2",
+      "version": "4.21.0",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.2",
+        "body-parser": "1.20.3",
         "content-disposition": "0.5.4",
         "content-type": "~1.0.4",
         "cookie": "0.6.0",
         "cookie-signature": "1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.2.0",
+        "finalhandler": "1.3.1",
         "fresh": "0.5.2",
         "http-errors": "2.0.0",
-        "merge-descriptors": "1.0.1",
+        "merge-descriptors": "1.0.3",
         "methods": "~1.1.2",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.7",
+        "path-to-regexp": "0.1.10",
         "proxy-addr": "~2.0.7",
-        "qs": "6.11.0",
+        "qs": "6.13.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
-        "send": "0.18.0",
-        "serve-static": "1.15.0",
+        "send": "0.19.0",
+        "serve-static": "1.16.2",
         "setprototypeof": "1.2.0",
         "statuses": "2.0.1",
         "type-is": "~1.6.18",
@@ -1117,11 +1123,11 @@
       }
     },
     "node_modules/finalhandler": {
-      "version": "1.2.0",
+      "version": "1.3.1",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "on-finished": "2.4.1",
         "parseurl": "~1.3.3",
@@ -1173,7 +1179,7 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.8",
+      "version": "1.15.9",
       "funding": [
         {
           "type": "individual",
@@ -1554,8 +1560,11 @@
       }
     },
     "node_modules/merge-descriptors": {
-      "version": "1.0.1",
-      "license": "MIT"
+      "version": "1.0.3",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
     },
     "node_modules/methods": {
       "version": "1.1.2",
@@ -1636,7 +1645,7 @@
       "optional": true
     },
     "node_modules/ms": {
-      "version": "2.1.2",
+      "version": "2.1.3",
       "license": "MIT"
     },
     "node_modules/mustache": {
@@ -1667,7 +1676,7 @@
       "license": "MIT"
     },
     "node_modules/node-abi": {
-      "version": "3.67.0",
+      "version": "3.68.0",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1795,7 +1804,7 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.7",
+      "version": "0.1.10",
       "license": "MIT"
     },
     "node_modules/picomatch": {
@@ -1863,7 +1872,7 @@
       "license": "MIT"
     },
     "node_modules/pump": {
-      "version": "3.0.0",
+      "version": "3.0.2",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1879,10 +1888,10 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.11.0",
+      "version": "6.13.0",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.4"
+        "side-channel": "^1.0.6"
       },
       "engines": {
         "node": ">=0.6"
@@ -2037,7 +2046,7 @@
       }
     },
     "node_modules/send": {
-      "version": "0.18.0",
+      "version": "0.19.0",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -2069,18 +2078,21 @@
       "version": "2.0.0",
       "license": "MIT"
     },
-    "node_modules/send/node_modules/ms": {
-      "version": "2.1.3",
-      "license": "MIT"
+    "node_modules/send/node_modules/encodeurl": {
+      "version": "1.0.2",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
     },
     "node_modules/serve-static": {
-      "version": "1.15.0",
+      "version": "1.16.2",
       "license": "MIT",
       "dependencies": {
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.18.0"
+        "send": "0.19.0"
       },
       "engines": {
         "node": ">= 0.8.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.2.1",
+  "version": "8.2.3",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [