@sap/cds-dk 8.9.11 → 8.9.13

package/CHANGELOG.md

@@ -7,6 +7,19 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 8.9.13 - 2029-01-09
+
+### Fixed
+
+- CVE-2025-15284: update `express` to fix vulnerability with `qs` <6.14.1
+
+## Version 8.9.12 - 2025-12-16
+
+### Fixed
+
+- `cds import` generates the on condition for a composition when the corresponding OData navigation property targets a collection, is contained (`$ContainsTarget` in OData EDM) and has a backlink (`$Partner` in OData EDM).
+- `cds import` now considers OData contained navigation properties as compositions instead of associations.
+
 ## Version 8.9.11 - 2025-11-21
 
 ### Fixed

package/lib/build/provider/hana/template/package.json

@@ -1,7 +1,7 @@
 {
   "name": "deploy",
   "dependencies": {
-    "hdb": "^0",
+    "hdb": "^2.0.0",
     "@sap/hdi-deploy": "^5"
   },
   "engines": {

package/lib/import/odata/ParserContext.js

@@ -38,6 +38,7 @@ module.exports = class ParserContext {
         this.schemaAliasToNamespace = {};
         this.schemaToSchemaDataIndex = {};
         this.schemaToPrimarySchema = {};
+        this.schemaDetails = {};
         this.vocabNamespaceToAlias = {};
         this.entityToBoundActions = {};
         this.entityToBoundFunctions = {};

package/lib/import/odata/v4parser.js

@@ -615,7 +615,7 @@ function _generateStructuredDataTypeCsn(dataType, propertyObject, isPrimaryKey,
 
 function _parseAssociationProperty(foreignReference, associationNode, parserContext) {
     const associationProperty = {};
-    associationProperty.type = (associationNode.$OnDelete === 'Cascade') ? 'cds.Composition' : 'cds.Association';
+    associationProperty.type = (associationNode.$OnDelete === 'Cascade' || associationNode.$ContainsTarget) ? 'cds.Composition' : 'cds.Association';
 
     let schemaName = associationNode.$Type.substring(0, associationNode.$Type.lastIndexOf('.'));
 
@@ -623,6 +623,11 @@ function _parseAssociationProperty(foreignReference, associationNode, parserCont
         schemaName = parserContext.schemaAliasToNamespace[schemaName];
     }
 
+    if (associationNode.$ContainsTarget) {
+        parserContext.schemaDetails[schemaName] ??= {}
+        parserContext.schemaDetails[schemaName].containment = true
+    }
+
     let resolvedEntityName;
     let entityTypeMapping = (
         parserContext.entityToEntitySetMap?.get(associationNode.$Type) ||
@@ -657,9 +662,18 @@ function _parseAssociationProperty(foreignReference, associationNode, parserCont
     } else {
         associationProperty.cardinality.max = 1;
     }
-    // Convert managed associations and compositions in unmanaged with empty key to avoid
+
+    // Generate on condition in case $Partner exists, as that indicates a backlink with which the 
+    // condition can be generated.
+    // If not given convert managed associations and compositions in unmanaged with empty key to avoid
     // "generation" of keys, that do not exist in the external service.
-    if (common.checkForEmptyKeys(associationProperty, "V4")) {
+    if (associationNode.$Partner && associationProperty.type === 'cds.Composition') {
+        associationProperty.on = [
+            {ref: [foreignReference, associationNode.$Partner]},
+            '=',
+            {ref: ['$self']}
+        ]
+    } else if (common.checkForEmptyKeys(associationProperty, "V4")) {
         associationProperty.keys = [];
     }
     _captureAnnotationWithinElement(associationNode, associationProperty, parserContext);
@@ -1634,12 +1648,43 @@ function _generateCSN(edmxAsJson, ignorePersistenceSkip, parserContext, importer
         csn.definitions[parserContext.primarySchema].kind = 'service';
         csn.definitions[parserContext.primarySchema]['@cds.external'] = true;
 
+        if (parserContext.schemaDetails[parserContext.primarySchema]?.containment) {
+            csn.definitions[parserContext.primarySchema]['@odata.containment'] = true;
+        }
+
         // Step 8: parse entity container contents and their annotations
         let schemaData = schemaDataList[parserContext.schemaToSchemaDataIndex[parserContext.primarySchema]];
         let entityContainerElements = schemaData[parserContext.entityContainerName];
         csn.definitions = Object.assign(_parseEntityContainer(csn.definitions, entityContainerElements, parserContext), csn.definitions);
     }
 
+
+    // Step 9: 2. Step for generating $ContainsTarget & $Partner links
+    // The containing composition is already generated. Now the Keys: [] has to be removed
+    // on the backlink association because per OData spec, OData does not expose the foreign key fields 
+    // used by the backlink and thus it is save to assume they must be generated for proper mocking
+    // 
+    // This happens after Step 8 because that adjusts the names of entity container entities where 
+    // entity type and entity set differ in naming
+    for (const entity in csn.definitions) {
+        if (entity.type !== 'entity') continue;
+
+        const containingCompositions = Object.keys(csn.definitions[entity].elements).filter(e => 
+            csn.definitions[entity].elements[e].type === 'cds.Composition' && 
+            csn.definitions[entity].elements[e].on
+        );
+        for (const comp of containingCompositions) {
+            const compTarget = csn.definitions[csn.definitions[entity].elements[comp].target];
+            const backLink = Object.keys(compTarget.elements).find(e => 
+                compTarget.elements[e].type === 'cds.Association' && 
+                compTarget.elements[e].target === entity
+            )
+            if (compTarget.elements[backLink].keys) {
+                delete compTarget.elements[backLink].keys
+            }
+        }
+    }
+
     return JSON.stringify(csn, null, 4);
 }
 

package/lib/init/template/hana/files/db/package.json

@@ -1,7 +1,7 @@
 {
   "name": "deploy",
   "dependencies": {
-    "hdb": "^0",
+    "hdb": "^2.0.0",
     "@sap/hdi-deploy": "^5"
   },
   "engines": {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.9.11",
+  "version": "8.9.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "8.9.11",
+      "version": "8.9.13",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -18,8 +18,8 @@
         "@sap/hdi-deploy": "^5",
         "axios": "^1",
         "eslint": "^9",
-        "express": "^4.17.3",
-        "hdb": "^0",
+        "express": "^4.22.1",
+        "hdb": "^0 || ^2",
         "livereload-js": "^4.0.1",
         "mustache": "^4.0.1",
         "node-watch": ">=0.7",
@@ -54,7 +54,7 @@
       }
     },
     "node_modules/@cap-js/openapi": {
-      "version": "1.2.3",
+      "version": "1.3.1",
       "license": "Apache-2.0",
       "dependencies": {
         "pluralize": "^8.0.0"
@@ -76,7 +76,7 @@
       }
     },
     "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.0",
+      "version": "4.9.1",
       "license": "MIT",
       "dependencies": {
         "eslint-visitor-keys": "^3.4.3"
@@ -141,7 +141,7 @@
       }
     },
     "node_modules/@eslint/eslintrc": {
-      "version": "3.3.1",
+      "version": "3.3.3",
       "license": "MIT",
       "dependencies": {
         "ajv": "^6.12.4",
@@ -150,7 +150,7 @@
         "globals": "^14.0.0",
         "ignore": "^5.2.0",
         "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.0",
+        "js-yaml": "^4.1.1",
         "minimatch": "^3.1.2",
         "strip-json-comments": "^3.1.1"
       },
@@ -162,7 +162,7 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.39.1",
+      "version": "9.39.2",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -230,7 +230,7 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "8.9.7",
+      "version": "8.9.8",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": "^5",
@@ -260,7 +260,7 @@
       }
     },
     "node_modules/@sap/cds-compiler": {
-      "version": "5.9.12",
+      "version": "5.9.14",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "antlr4": "4.9.3"
@@ -344,11 +344,11 @@
       }
     },
     "node_modules/@sap/hdi-deploy": {
-      "version": "5.5.1",
+      "version": "5.6.0",
       "license": "See LICENSE file",
       "dependencies": {
         "@sap/hdi": "^4.8.0",
-        "@sap/xsenv": "^5.2.0",
+        "@sap/xsenv": "^6.0.0",
         "async": "^3.2.6",
         "dotenv": "^16.4.5",
         "handlebars": "^4.7.8",
@@ -371,15 +371,15 @@
       }
     },
     "node_modules/@sap/xsenv": {
-      "version": "5.6.1",
+      "version": "6.0.0",
       "license": "SEE LICENSE IN LICENSE file",
       "dependencies": {
-        "debug": "4.4.0",
+        "debug": "4.4.1",
         "node-cache": "^5.1.2",
         "verror": "1.10.1"
       },
       "engines": {
-        "node": "^18.0.0 || ^20.0.0  || ^22.0.0"
+        "node": "^20.0.0  || ^22.0.0 || ^24.0.0"
       }
     },
     "node_modules/@types/estree": {
@@ -547,21 +547,21 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.3",
+      "version": "1.20.4",
       "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
+        "bytes": "~3.1.2",
         "content-type": "~1.0.5",
         "debug": "2.6.9",
         "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "on-finished": "2.4.1",
-        "qs": "6.13.0",
-        "raw-body": "2.5.2",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.14.0",
+        "raw-body": "~2.5.3",
         "type-is": "~1.6.18",
-        "unpipe": "1.0.0"
+        "unpipe": "~1.0.0"
       },
       "engines": {
         "node": ">= 0.8",
@@ -731,14 +731,14 @@
       }
     },
     "node_modules/cookie": {
-      "version": "0.7.1",
+      "version": "0.7.2",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
     "node_modules/cookie-signature": {
-      "version": "1.0.6",
+      "version": "1.0.7",
       "license": "MIT"
     },
     "node_modules/core-util-is": {
@@ -758,7 +758,7 @@
       }
     },
     "node_modules/debug": {
-      "version": "4.4.0",
+      "version": "4.4.1",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -921,7 +921,7 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.39.1",
+      "version": "9.39.2",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
@@ -930,7 +930,7 @@
         "@eslint/config-helpers": "^0.4.2",
         "@eslint/core": "^0.17.0",
         "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "9.39.1",
+        "@eslint/js": "9.39.2",
         "@eslint/plugin-kit": "^0.4.1",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
@@ -1017,7 +1017,7 @@
       }
     },
     "node_modules/esquery": {
-      "version": "1.6.0",
+      "version": "1.7.0",
       "license": "BSD-3-Clause",
       "dependencies": {
         "estraverse": "^5.1.0"
@@ -1066,37 +1066,37 @@
       }
     },
     "node_modules/express": {
-      "version": "4.21.2",
+      "version": "4.22.1",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "1.20.3",
-        "content-disposition": "0.5.4",
+        "body-parser": "~1.20.3",
+        "content-disposition": "~0.5.4",
         "content-type": "~1.0.4",
-        "cookie": "0.7.1",
-        "cookie-signature": "1.0.6",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
         "debug": "2.6.9",
         "depd": "2.0.0",
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "finalhandler": "1.3.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
         "merge-descriptors": "1.0.3",
         "methods": "~1.1.2",
-        "on-finished": "2.4.1",
+        "on-finished": "~2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "0.1.12",
+        "path-to-regexp": "~0.1.12",
         "proxy-addr": "~2.0.7",
-        "qs": "6.13.0",
+        "qs": "~6.14.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
-        "send": "0.19.0",
-        "serve-static": "1.16.2",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
         "setprototypeof": "1.2.0",
-        "statuses": "2.0.1",
+        "statuses": "~2.0.1",
         "type-is": "~1.6.18",
         "utils-merge": "1.0.1",
         "vary": "~1.1.2"
@@ -1165,15 +1165,15 @@
       }
     },
     "node_modules/finalhandler": {
-      "version": "1.3.1",
+      "version": "1.3.2",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
-        "on-finished": "2.4.1",
+        "on-finished": "~2.4.1",
         "parseurl": "~1.3.3",
-        "statuses": "2.0.1",
+        "statuses": "~2.0.2",
         "unpipe": "~1.0.0"
       },
       "engines": {
@@ -1413,27 +1413,48 @@
       }
     },
     "node_modules/hdb": {
-      "version": "0.19.12",
+      "version": "2.26.4",
       "license": "Apache-2.0",
       "dependencies": {
-        "iconv-lite": "^0.4.18"
+        "iconv-lite": "0.7.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "optionalDependencies": {
+        "lz4-wasm-nodejs": "0.9.2"
+      }
+    },
+    "node_modules/hdb/node_modules/iconv-lite": {
+      "version": "0.7.0",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
       "engines": {
-        "node": ">= 0.12"
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/http-errors": {
-      "version": "2.0.0",
+      "version": "2.0.1",
       "license": "MIT",
       "dependencies": {
-        "depd": "2.0.0",
-        "inherits": "2.0.4",
-        "setprototypeof": "1.2.0",
-        "statuses": "2.0.1",
-        "toidentifier": "1.0.1"
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
       },
       "engines": {
         "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/iconv-lite": {
@@ -1598,6 +1619,11 @@
       "version": "4.6.2",
       "license": "MIT"
     },
+    "node_modules/lz4-wasm-nodejs": {
+      "version": "0.9.2",
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
       "license": "MIT",
@@ -1941,10 +1967,10 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.13.0",
+      "version": "6.14.1",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.6"
+        "side-channel": "^1.1.0"
       },
       "engines": {
         "node": ">=0.6"
@@ -1961,13 +1987,13 @@
       }
     },
     "node_modules/raw-body": {
-      "version": "2.5.2",
+      "version": "2.5.3",
       "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "unpipe": "1.0.0"
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
       },
       "engines": {
         "node": ">= 0.8"
@@ -2038,8 +2064,11 @@
       "license": "MIT"
     },
     "node_modules/sax": {
-      "version": "1.4.3",
-      "license": "BlueOak-1.0.0"
+      "version": "1.4.4",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=11.0.0"
+      }
     },
     "node_modules/semver": {
       "version": "7.7.3",
@@ -2052,22 +2081,22 @@
       }
     },
     "node_modules/send": {
-      "version": "0.19.0",
+      "version": "0.19.2",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
         "depd": "2.0.0",
         "destroy": "1.2.0",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
         "mime": "1.6.0",
         "ms": "2.1.3",
-        "on-finished": "2.4.1",
+        "on-finished": "~2.4.1",
         "range-parser": "~1.2.1",
-        "statuses": "2.0.1"
+        "statuses": "~2.0.2"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -2084,21 +2113,14 @@
       "version": "2.0.0",
       "license": "MIT"
     },
-    "node_modules/send/node_modules/encodeurl": {
-      "version": "1.0.2",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
     "node_modules/serve-static": {
-      "version": "1.16.2",
+      "version": "1.16.3",
       "license": "MIT",
       "dependencies": {
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.19.0"
+        "send": "~0.19.1"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -2240,7 +2262,7 @@
       }
     },
     "node_modules/statuses": {
-      "version": "2.0.1",
+      "version": "2.0.2",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -2435,7 +2457,7 @@
       "optional": true
     },
     "node_modules/ws": {
-      "version": "8.18.3",
+      "version": "8.19.0",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -2471,13 +2493,16 @@
       }
     },
     "node_modules/yaml": {
-      "version": "2.8.1",
+      "version": "2.8.2",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
       },
       "engines": {
         "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
       }
     },
     "node_modules/yocto-queue": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.9.11",
+  "version": "8.9.13",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [
@@ -26,8 +26,8 @@
     "@sap/hdi-deploy": "^5",
     "axios": "^1",
     "eslint": "^9",
-    "express": "^4.17.3",
-    "hdb": "^0",
+    "express": "^4.22.1",
+    "hdb": "^0 || ^2",
     "livereload-js": "^4.0.1",
     "mustache": "^4.0.1",
     "node-watch": ">=0.7",