@sap/cds-dk 8.9.15 → 8.9.17

package/CHANGELOG.md

@@ -7,6 +7,19 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 8.9.17 - 2026-04-02
+
+### Fixed
+
+- Dependency updates, e.g. for CVE-2026-33937.
+
+## Version 8.9.16 - 2026-03-12
+
+### Fixed
+
+- `cds import` now correctly imports views with parameters
+- `cds import` now correctly handles OData referential constraints
+
 ## Version 8.9.15 - 2026-02-27
 
 ### Fixed

package/lib/import/odata/v4parser.js

@@ -407,7 +407,7 @@ function _validateAnnotationNamespace(annotationTerm, vocabNamespaceToAlias) {
     if (aliasOrNamespace === "cds") {
         return
     }
-    
+
     for (let alias of Object.values(known_vocabularies)) {
         if (alias === aliasOrNamespace) {
             return;
@@ -673,6 +673,19 @@ function _parseAssociationProperty(foreignReference, associationNode, parserCont
             '=',
             {ref: ['$self']}
         ]
+    } else if (associationNode.$ReferentialConstraint) {
+        associationProperty.on = []
+        for (const constraint in associationNode.$ReferentialConstraint) {
+            if (associationProperty.on.length) {
+                associationProperty.on.push('and')
+            }
+            associationProperty.on.push(
+                { ref: [foreignReference, associationNode.$ReferentialConstraint[constraint]] },
+                '=',
+                { ref: [constraint] }
+            )
+        }
+
     } else if (common.checkForEmptyKeys(associationProperty, "V4")) {
         associationProperty.keys = [];
     }
@@ -719,52 +732,63 @@ function _parsePropertyContent(csnObj, elementObj, parserContext) {
     const isPrimaryKey = true;
     let dataType, isPrimitiveType, keySet = [];
 
-    Object.keys(elementObj).forEach(objKey => {
-        const contentKind = elementObj[objKey].$Kind;
-        contentObj = elementObj[objKey];
-
-        if ((objKey.indexOf('@') === -1) && (objKey.indexOf('.') === -1)) {
-            if (contentObj instanceof Object) {
-                if (contentObj.$Type) {
-                    dataType = contentObj.$Type;
-                    isPrimitiveType = dataType.startsWith('Edm') ? true : false;
-                }
-                if (objKey === '$Key') {
-                    keySet.push(...elementObj.$Key);
-                }
-                // primitive datatypes
-                else if (isPrimitiveType) {
-                    if (edmPrimitiveTypes.includes(dataType)) {
-                        csnObj.elements[objKey] = _generatePrimitiveDataTypeCsn(contentObj,
-                            (keySet.includes(objKey) ? isPrimaryKey : !isPrimaryKey),
-                            parserContext
-                        );
-                    } else {
-                        throw new Error(messages.INVALID_DATATYPE + `'${dataType}' in element: '${objKey}'`)
+    const sortedElements = Object.keys(elementObj)
+        .sort((ele1, ele2) => {
+            if (elementObj[ele1]?.$Kind === elementObj[ele2]?.$Kind) {
+                return 0
+            } else if (elementObj[ele1]?.$Kind === 'NavigationProperty') {
+                return 1
+            } else if (elementObj[ele2]?.$Kind === 'NavigationProperty') {
+                return -1
+            }
+            return 0
+        })
+    sortedElements.forEach(objKey => {
+            const contentKind = elementObj[objKey].$Kind;
+            contentObj = elementObj[objKey];
+
+            if ((objKey.indexOf('@') === -1) && (objKey.indexOf('.') === -1)) {
+                if (contentObj instanceof Object) {
+                    if (contentObj.$Type) {
+                        dataType = contentObj.$Type;
+                        isPrimitiveType = dataType.startsWith('Edm') ? true : false;
                     }
-                }
-                // structured datatypes
-                else if (!isPrimitiveType && !(contentKind === 'NavigationProperty')) {
-                    const dataKind = _checkIsStructureTypeAndReturnDataKind(dataType, contentObj, 'property', parserContext);
-
-                    if (['EnumType', 'TypeDefinition'].includes(dataKind)) {
-                        csnObj.elements[objKey] = _generateStructuredDataTypeCsn(dataType, contentObj,
-                            (keySet.includes(dataType) ? isPrimaryKey : !isPrimaryKey),
-                            dataKind, 'property', parserContext
-                        );
+                    if (objKey === '$Key') {
+                        keySet.push(...elementObj.$Key);
                     }
-                    else {
-                        csnObj.elements[objKey] = _generateStructuredDataTypeCsn(dataType, contentObj,
-                            !isPrimaryKey, dataKind, 'property', parserContext
-                        );
+                    // primitive datatypes
+                    else if (isPrimitiveType) {
+                        if (edmPrimitiveTypes.includes(dataType)) {
+                            csnObj.elements[objKey] = _generatePrimitiveDataTypeCsn(contentObj,
+                                (keySet.includes(objKey) ? isPrimaryKey : !isPrimaryKey),
+                                parserContext
+                            );
+                        } else {
+                            throw new Error(messages.INVALID_DATATYPE + `'${dataType}' in element: '${objKey}'`)
+                        }
+                    }
+                    // structured datatypes
+                    else if (!isPrimitiveType && !(contentKind === 'NavigationProperty')) {
+                        const dataKind = _checkIsStructureTypeAndReturnDataKind(dataType, contentObj, 'property', parserContext);
+
+                        if (['EnumType', 'TypeDefinition'].includes(dataKind)) {
+                            csnObj.elements[objKey] = _generateStructuredDataTypeCsn(dataType, contentObj,
+                                (keySet.includes(objKey) ? isPrimaryKey : !isPrimaryKey),
+                                dataKind, 'property', parserContext
+                            );
+                        }
+                        else {
+                            csnObj.elements[objKey] = _generateStructuredDataTypeCsn(dataType, contentObj,
+                                !isPrimaryKey, dataKind, 'property', parserContext
+                            );
+                        }
+                    }
+                    else if (contentKind === 'NavigationProperty') {
+                        csnObj.elements[objKey] = _parseAssociationProperty(objKey, elementObj[objKey], parserContext);
                     }
-                }
-                else if (contentKind === 'NavigationProperty') {
-                    csnObj.elements[objKey] = _parseAssociationProperty(objKey, elementObj[objKey], parserContext);
                 }
             }
-        }
-    });
+        });
 }
 
 function _addBlobElement() {
@@ -1433,7 +1457,7 @@ function _collectBoundActionFunction(isAction, currNamespace, elementName, eleme
 
         // binding parameter type should be within the available namespaces in the scope of a document.
         if (entityTypeNamespace !== schemaName && entityTypeNamespace !== parserContext.schemaAliasToNamespace[schemaName]) {
-            
+
             // checking if the namespace is available in other schema of the document
             if (parserContext.schemaToSchemaDataIndex.hasOwnProperty(schemaName)) {
                 entityTypeNamespace = schemaName;
@@ -1603,8 +1627,7 @@ function _preProcess(edmxAsJson, parserContext, importerContext) {
         parserContext.entityToEntitySetMap._.size === 0 &&
         parserContext.entityToSingletonMap._.size === 0 &&
         parserContext.actionToActionImportMap._.size === 0 &&
-        parserContext.functionToFunctionImportMap._.size === 0)
-    {
+        parserContext.functionToFunctionImportMap._.size === 0) {
         parserContext.mockServerUc = false;
     }
 
@@ -1666,22 +1689,57 @@ function _generateCSN(edmxAsJson, ignorePersistenceSkip, parserContext, importer
     // 
     // This happens after Step 8 because that adjusts the names of entity container entities where 
     // entity type and entity set differ in naming
-    for (const entity in csn.definitions) {
-        if (entity.type !== 'entity') continue;
-
-        const containingCompositions = Object.keys(csn.definitions[entity].elements).filter(e => 
-            csn.definitions[entity].elements[e].type === 'cds.Composition' && 
-            csn.definitions[entity].elements[e].on
+    for (const [eName, entity] of Object.entries(csn.definitions)) {
+        if (entity.kind !== 'entity') continue;
+        const containingCompositions = Object.keys(entity.elements).filter(e =>
+            entity.elements[e].type === 'cds.Composition' &&
+            entity.elements[e].on
         );
         for (const comp of containingCompositions) {
-            const compTarget = csn.definitions[csn.definitions[entity].elements[comp].target];
-            const backLink = Object.keys(compTarget.elements).find(e => 
-                compTarget.elements[e].type === 'cds.Association' && 
-                compTarget.elements[e].target === entity
+            const compTarget = csn.definitions[entity.elements[comp].target];
+            const backLink = Object.keys(compTarget.elements).find(e =>
+                compTarget.elements[e].type === 'cds.Association' &&
+                compTarget.elements[e].target === eName
             )
-            if (compTarget.elements[backLink].keys) {
+            const entityKeys = Object.keys(entity.elements).filter(ele => entity.elements[ele].key)
+            if (compTarget.elements[backLink]?.keys && !entityKeys.some(key => compTarget.elements[backLink + '_' + key])) {
                 delete compTarget.elements[backLink].keys
             }
+
+            // 3. View with parameters handling. In OData if the entity has a Composition Set with a backlink Parameters and every
+            // other element is a key, its a View with Parameters. Import it as such to ensure proper outbound handling
+            if (
+                comp === 'Set' && backLink === 'Parameters' && 
+                Object.keys(entity.elements).filter(e => entity.elements[e].key).length + 1 === Object.keys(entity.elements).length
+            ) {
+                const actualEntity = csn.definitions[entity.elements[comp].target];
+                const actualEntityName = entity.elements[comp].target
+                // Adjust entity so that the current elements are parameters, remove Set, remove key flags
+                delete entity.elements[comp];
+                entity.params = {}
+                for (const ele in entity.elements) {
+                    delete entity.elements[ele].key;
+                    entity.params[ele] = entity.elements[ele];
+                }
+                delete entity.elements
+                // Move compTarget out of service
+                // Get rid of service prefix
+                let nameWithoutService = eName.split(parserContext.primarySchema).pop();
+                // Get rid of leading dot
+                nameWithoutService = nameWithoutService.substring(1, nameWithoutService.length)
+                csn.definitions[nameWithoutService] = actualEntity;
+                delete csn.definitions[actualEntityName];
+                delete csn.definitions[nameWithoutService].elements['Parameters'];
+                // Adjust entity to * query from compTarget
+                entity.query = {
+                    SELECT: {
+                        from: {
+                            ref: [nameWithoutService]
+                        },
+                        columns: ["*"]
+                    }
+                }
+            }
         }
     }
 

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.9.15",
+  "version": "8.9.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "8.9.15",
+      "version": "8.9.17",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -54,7 +54,7 @@
       }
     },
     "node_modules/@cap-js/openapi": {
-      "version": "1.3.1",
+      "version": "1.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "pluralize": "^8.0.0"
@@ -109,12 +109,12 @@
       }
     },
     "node_modules/@eslint/config-array": {
-      "version": "0.21.1",
+      "version": "0.21.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@eslint/object-schema": "^2.1.7",
         "debug": "^4.3.1",
-        "minimatch": "^3.1.2"
+        "minimatch": "^3.1.5"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -141,7 +141,7 @@
       }
     },
     "node_modules/@eslint/eslintrc": {
-      "version": "3.3.4",
+      "version": "3.3.5",
       "license": "MIT",
       "dependencies": {
         "ajv": "^6.14.0",
@@ -151,7 +151,7 @@
         "ignore": "^5.2.0",
         "import-fresh": "^3.2.1",
         "js-yaml": "^4.1.1",
-        "minimatch": "^3.1.3",
+        "minimatch": "^3.1.5",
         "strip-json-comments": "^3.1.1"
       },
       "engines": {
@@ -162,7 +162,7 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.39.3",
+      "version": "9.39.4",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -230,7 +230,7 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "8.9.8",
+      "version": "8.9.9",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": "^5",
@@ -476,12 +476,12 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.13.5",
+      "version": "1.14.0",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.15.11",
         "form-data": "^4.0.5",
-        "proxy-from-env": "^1.1.0"
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/balanced-match": {
@@ -580,7 +580,7 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
+      "version": "1.1.13",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -921,22 +921,22 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.39.3",
+      "version": "9.39.4",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
-        "@eslint/config-array": "^0.21.1",
+        "@eslint/config-array": "^0.21.2",
         "@eslint/config-helpers": "^0.4.2",
         "@eslint/core": "^0.17.0",
-        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "9.39.3",
+        "@eslint/eslintrc": "^3.3.5",
+        "@eslint/js": "9.39.4",
         "@eslint/plugin-kit": "^0.4.1",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.4.2",
         "@types/estree": "^1.0.6",
-        "ajv": "^6.12.4",
+        "ajv": "^6.14.0",
         "chalk": "^4.0.0",
         "cross-spawn": "^7.0.6",
         "debug": "^4.3.2",
@@ -955,7 +955,7 @@
         "is-glob": "^4.0.0",
         "json-stable-stringify-without-jsonify": "^1.0.1",
         "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.2",
+        "minimatch": "^3.1.5",
         "natural-compare": "^1.4.0",
         "optionator": "^0.9.3"
       },
@@ -1217,7 +1217,7 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
+      "version": "3.4.2",
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
@@ -1354,7 +1354,7 @@
       }
     },
     "node_modules/handlebars": {
-      "version": "4.7.8",
+      "version": "4.7.9",
       "license": "MIT",
       "dependencies": {
         "minimist": "^1.2.5",
@@ -1755,7 +1755,7 @@
       "license": "MIT"
     },
     "node_modules/node-abi": {
-      "version": "3.87.0",
+      "version": "3.89.0",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1883,11 +1883,11 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.12",
+      "version": "0.1.13",
       "license": "MIT"
     },
     "node_modules/picomatch": {
-      "version": "2.3.1",
+      "version": "2.3.2",
       "license": "MIT",
       "engines": {
         "node": ">=8.6"
@@ -1947,11 +1947,14 @@
       }
     },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "license": "MIT"
+      "version": "2.1.0",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/pump": {
-      "version": "3.0.3",
+      "version": "3.0.4",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -2064,7 +2067,7 @@
       "license": "MIT"
     },
     "node_modules/sax": {
-      "version": "1.4.4",
+      "version": "1.6.0",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
@@ -2457,7 +2460,7 @@
       "optional": true
     },
     "node_modules/ws": {
-      "version": "8.19.0",
+      "version": "8.20.0",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -2493,7 +2496,7 @@
       }
     },
     "node_modules/yaml": {
-      "version": "2.8.2",
+      "version": "2.8.3",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "8.9.15",
+  "version": "8.9.17",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [