@sap/cds-dk 9.0.4 → 9.0.6

package/CHANGELOG.md

@@ -6,6 +6,24 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.0.6 - 2025-06-18
+
+### Changed
+
+- `cds build` now adds an `engines.node = ">=20"` entry to the effective _package.json_ iff it is missing from the project's _package.json_ to avoid engine confusion when deploying to Cloud Foundry
+
+## Version 9.0.5 - 2025-06-06
+
+### Changed
+
+- `cds init` uses latest Maven Java archetype version 4.0.2 for creating Java projects.
+
+### Fixed
+
+- `cds build` for extensions now filters built-in entities such as `cds.outbox.Messages` to fix the extension upload with `cds push`.
+- `cds add data` now correctly works for nested structured properties.
+- `cds add data/http` no longer create decimal numbers with too many precision places
+
 ## Version 9.0.4 - 2025-05-28
 
 ### Changed
@@ -95,6 +113,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `cds add multitenancy` requires the `srv-api` instead of the `mtx-api` for Java projects.
 
 
+## Version 8.9.5 - 2025-06-05
+
+### Fixed
+
+- Bump `tar-fs` to address CVE-2024-12905.
+- `cds add data` now correctly works for nested structured properties.
+- Help text of `cds debug`.
+
 ## Version 8.9.4 - 2025-05-26
 
 ### Changed

package/bin/cds.js

@@ -106,7 +106,7 @@ const cli = {
   },
 
   load (cmd,_default) {
-    return /[\\/.-@]/.test(cmd) && _default && _default(true) // like `cds ./srv` or `cds @capire/bookshop`
+    return /[\\/.\-@]/.test(cmd) && _default && _default(true) // like `cds ./srv` or `cds @capire/bookshop`
     || /cds/i.test(cmd) && _dieForUnknownCommand (cmd)  // cds cds
     || _require ('./'+cmd)  // cds-dk commands
     || _default && _default()

package/bin/debug.js

@@ -15,7 +15,7 @@ module.exports = Object.assign(debug, {
     Cloud Foundry space (check with 'cf target').
     SSH access to the app is required (check with 'cf ssh-enabled').
 
-    If no <app> is given, the app in the current working is started
+    If no <app> is given, the app in the current working directory is started
     (with 'cds watch --debug' for Node.js and 'mvn spring-boot:run' for Java).
 
 # OPTIONS

package/bin/help.js

@@ -13,7 +13,6 @@ module.exports = exports = Object.assign (help, {formatHelp, handleCompletion, h
     *i* | *init*        jump-start cds-based projects
     *a* | *add*         add a feature to an existing project
     * * | *gen*         generate models/data using a descriptive prompt [beta]
-    *y* | *bind*        bind application to remote services
     *m* | *import*      add models from external sources
     *c* | *compile*     compile cds models to different outputs
     *p* | *parse*       parses given cds models
@@ -23,8 +22,9 @@ module.exports = exports = Object.assign (help, {formatHelp, handleCompletion, h
     *r* | *repl*        read-eval-event loop
     *e* | *env*         inspect effective configuration
     *b* | *build*       prepare for deployment
-    *d* | *deploy*      deploy to databases or cloud
-    * * | *up*          build and deploy your application
+    *d* | *deploy*      deploy to databases
+    * * | *up*          build and deploy your application to the cloud
+    *y* | *bind*        bind application to remote services
     * * | *debug*       debug your application
     * * | *subscribe*   subscribe a tenant to a multitenant SaaS app
     * * | *unsubscribe* unsubscribe a tenant from a multitenant SaaS app

package/lib/build/provider/fiori/index.js

@@ -1,7 +1,7 @@
 const path = require('path')
 const cds = require('../../../cds')
 const EdmxBuildPlugin = require('../edmxBuildPlugin')
-const URL = require('url')
+const { URL } = require('node:url')
 const { getProperty, relativePaths } = require('../../util')
 const { OUTPUT_MODE, OUTPUT_MODE_RESULT, BUILD_TASK_FIORI, CDS_CONFIG_PATH_SEP, OUTPUT_MODE_FILESYSTEM } = require('../../constants')
 const DEBUG = cds.debug('cli|build')
@@ -52,7 +52,7 @@ class FioriBuildPlugin extends EdmxBuildPlugin {
             appModelGroups.set(appFolder, appModels)
         }
 
-        // ensure edmx is cached as build result 
+        // ensure edmx is cached as build result
         const buildOption = this.context.options[OUTPUT_MODE]
         this.context.options[OUTPUT_MODE] |= OUTPUT_MODE_RESULT
 
@@ -159,8 +159,8 @@ class FioriBuildPlugin extends EdmxBuildPlugin {
     }
 
     _strippedUrlPath(urlString) {
-        const url = URL.parse(urlString)
-        return url.pathname.replace(/^(\/|\\)/, '').replace(/(\/|\\)$/, '') // strip leading and trailing slash or backslash)
+        const url = new URL(urlString, 'http://dummy.base') // need dummy base to parse relative URLs correctly
+        return url.pathname.replace(/^(\/|\\)/, '').replace(/(\/|\\)$/, '') // strip leading and trailing slash or backslash
     }
 }
 

package/lib/build/provider/mtx-extension/index.js

@@ -8,6 +8,8 @@ const { FOLDER_GEN, EXTENSION_POINT_VALIDATION } = require('../../constants')
 const { BuildError, BuildMessage } = require('../../util')
 const DEBUG = cds.debug('cli|build')
 
+const BUILT_IN_NAMESPACES = ['cds.core', 'cds.outbox', 'cds.xt']
+
 class MtxExtensionBuildPlugin extends InternalBuildPlugin {
     init() {
         super.init()
@@ -48,6 +50,16 @@ class MtxExtensionBuildPlugin extends InternalBuildPlugin {
                 if (extensionModel.requires) {
                     extensionModel.requires.length = 0
                 }
+                if (extensionModel.definitions) {
+                    for (const [name] of Object.entries(extensionModel.definitions)) {
+                        for (const namespace of BUILT_IN_NAMESPACES) {
+                            if (name.startsWith(`${namespace}.`)) {
+                                delete extensionModel.definitions[name]
+                                break
+                            }
+                        }
+                    }
+                }
             }
         }
 

package/lib/build/provider/nodejs/index.js

@@ -9,6 +9,7 @@ const { OUTPUT_MODE, OUTPUT_MODE_FILESYSTEM, ODATA_VERSION_V2, FOLDER_GEN, CONTE
     OPTION_WS_PACK} = require('../../constants')
 const { WARNING } = EdmxBuildPlugin
 const LOG = cds.log('cli|build'), DEBUG = cds.debug('cli|build')
+const NODE_ENGINE_VERSION = '>=20'
 
 /**
  * @param {T | T[]} x
@@ -62,6 +63,23 @@ class NodejsBuildPlugin extends EdmxBuildPlugin {
         if (this.isStagingBuild() && this.hasBuildOption(OUTPUT_MODE, OUTPUT_MODE_FILESYSTEM)) {
             const srcSrv = this.task.src === cds.root ? path.resolve(this.task.src, cds.env.folders.srv) : this.task.src
             await this._copyNativeContent(cds.root, srcSrv, destRoot, destSrv)
+            try {
+                // add minimal node engine to effective package.json.
+                // CloudFoundry uses this entry to choose the node engine in buildpack and may
+                // fall back to an outdated version if this entry is missing.
+                const packageJsonPath = path.join(destRoot, 'package.json')
+                const packageJsonContent = require(packageJsonPath)
+                if (!Object.hasOwn(packageJsonContent, 'engines') || !Object.hasOwn(packageJsonContent.engines, 'node')) {
+                    DEBUG?.(`Amending package.json with node engine version ${NODE_ENGINE_VERSION}`)
+                    packageJsonContent.engines = packageJsonContent.engines ?? {}
+                    packageJsonContent.engines.node = NODE_ENGINE_VERSION
+                    await this.write(JSON.stringify(packageJsonContent, 0, 2)).to(packageJsonPath)
+                }
+            } catch (e) {
+                DEBUG?.(e)
+                // silently ignore package json not being found
+                if (e.code !== 'MODULE_NOT_FOUND') throw e
+            }
             if (this.context.options[OPTION_WS_PACK]) {
                 await this._packWorkspaceDependencies(destRoot)
             }

package/lib/init/constants.js

@@ -5,7 +5,7 @@ module.exports = {
     COMMAND_ADD: 'add',
 
     JAVA_LTS_VERSIONS: [17, 21],
-    MAVEN_ARCHETYPE_VERSION: '3.10.1',
+    MAVEN_ARCHETYPE_VERSION: '4.0.2',
 
     OPTIONS: Object.freeze({
         COMPLETION: 'completion',

package/lib/init/template/data/as-csv.js

@@ -40,10 +40,11 @@ module.exports = async (data={}, csn, { headerOnly=false, separator=',' }={}) =>
             record.push(...Object.values(value))
           }
           else if (element.is_struct && element.type !== 'cds.Map') {
+            const {headers: structHeaders, records: structRecords} = resolveStruct(value, name);
             if (i === 0) {
-              header.push(...Object.keys(value).map(structField => name + '_' + structField))
+              header.push(...structHeaders)
             }
-            record.push(...Object.values(value))
+            record.push(...structRecords)
           }
           else {
             if (i === 0)  header.push(name)
@@ -62,13 +63,28 @@ module.exports = async (data={}, csn, { headerOnly=false, separator=',' }={}) =>
 
       data[entity.name] = res
 
-      function escape(value) {
-        if (typeof value === 'string' && (value.includes('"') || value.includes(separator))) {
-          return `"${value.replace(/"/g, '""')}"` // escape double quotes, then quote the value
-        }
-        return value
-      }
     })
+    function escape(value) {
+      if (typeof value === 'string' && (value.includes('"') || value.includes(separator))) {
+        return `"${value.replace(/"/g, '""')}"` // escape double quotes, then quote the value
+      }
+      return value
+    }
+
+    function resolveStruct(v, prefix) {
+      return Object.entries(v).reduce((acc, [key, val]) => {
+        //structs can be within structs
+        if (typeof val === 'object') {
+          const {headers, records} = resolveStruct(val, prefix + '_' + key);
+          acc.headers = acc.headers.concat(headers);
+          acc.records = acc.records.concat(records);
+        } else {
+          acc.headers.push(prefix + '_' + key);
+          acc.records.push(val);
+        }
+        return acc;
+      }, {headers: [], records: []});
+    }
   }
   return data
 }

package/lib/init/template/data/as-json.js

@@ -228,10 +228,10 @@ function dataForField(element, artifact, csn, record, data, parent, depth, refer
       return randomIntInRange(range)
     }
     case 'cds.hana.REAL':
-    case 'cds.Decimal': {
-      const prec  = element.precision ? Math.min(Math.pow(10, element.precision), Number.MAX_SAFE_INTEGER) : 100
-      const range = { from: 0, to: prec }
+    case 'cds.Decimal': { // Decimal(9,5), Decimal(9), Decimal(precision:5)
       const scale = element.scale ?? (element.precision ? 0 : 2) // scale is 0 if only precision is given
+      const prec  = element.precision ? Math.min(Math.pow(10, element.precision-scale), Number.MAX_SAFE_INTEGER) : 100
+      const range = { from: 0, to: prec }
       annotatedIntRange(element, range)
       return +(randomDecimalInRange(range).toFixed(scale))
     }

package/lib/init/template/hana/index.js

@@ -13,8 +13,8 @@ module.exports = class HanaTemplate extends require('../../plugin') {
         return 'database support for SAP HANA'
     }
 
-    static hasInProduction(env) {
-        return env.requires?.db?.kind === 'hana' || readProject().dependencies?.['@cap-js/hana']
+    static hasInProduction() {
+        return readProject().dependencies?.['@cap-js/hana']
     }
 
     async run() {

package/lib/init/template/handler/index.js

@@ -145,7 +145,7 @@ async function createExtCodeHandler(service, proj, out, force) {
   // package.json
   const pkgJson = await read('package.json')
   const pkgJsonDelta = require('./files/extension/package.json')
-  deepMerge(pkgJson, pkgJsonDelta)
+  cds.utils.merge ? cds.utils.merge(pkgJson, pkgJsonDelta) : merge(pkgJson, pkgJsonDelta)
   await write('package.json', pkgJson, { spaces: 2 })
 }
 
@@ -161,15 +161,19 @@ async function loadModel() {
   }
 }
 
-function deepMerge(obj1, obj2) {
-  for (const key in obj2) {
-    if (Object.prototype.hasOwnProperty.call(obj2, key)) {
-      if (obj2[key] instanceof Object && obj1[key] instanceof Object) {
-        obj1[key] = deepMerge(obj1[key], obj2[key])
-      } else {
-        obj1[key] = obj2[key]
-      }
-    }
-  }
-  return obj1
+// TODO remove w/ cds 10, copied from cds-utils.js
+/**
+ * Polyfill for cds.utils.merge
+ * Simple helper to deep-merge two or more objects.
+ * Entries from `xs` overwrite entries in `o`.
+ * @example cds.utils.merge({foo:1},{bar:2},{baz:3})
+ * @returns `o` with entries from `xs` merged in.
+ */
+function merge (o,...xs) {
+  let v; for (let x of xs) for (let k in x)
+    if (k === '__proto__' || k === 'constructor') continue //> avoid prototype pollution
+    else o[k] = is_object(v=x[k]) ? merge(o[k]??={},v) : v
+  return o
 }
+const is_object = x => typeof x === 'object' && x !== null && !is_array(x)
+const is_array = Array.isArray

package/lib/init/template/multitenancy/files/package.sidecar.json.hbs

@@ -11,7 +11,7 @@
     "@cap-js/sqlite": "^2"
   },
   "engines": {
-    "node": "^22"
+    "node": ">=20"
   },
   "scripts": {
     "start": "cds-serve"{{#isJava}},

package/lib/init/template/nodejs/files/package.json.hbs

@@ -10,11 +10,11 @@
     "express": "^4"
   },
   "engines": {
-    "node": "^22"
+    "node": ">=20"
   },
   "devDependencies": {
     "@cap-js/sqlite": "^2",
-    "@cap-js/cds-types": "^0.10.0"
+    "@cap-js/cds-types": "^0.11.0"
   },
   "scripts": {
     "start": "cds-serve"

package/lib/init/template/postgres/files/package.json.hbs

@@ -1,5 +1,5 @@
 {
   "dependencies": {
-    "@cap-js/postgres": "^1"
+    "@cap-js/postgres": "^2"
   }
 }

package/lib/init/template/sample/files/app/admin-books/fiori-service.cds

@@ -7,6 +7,12 @@ using { sap.capire.bookshop } from '../../db/schema';
 //
 
 annotate AdminService.Books with @(UI: {
+  HeaderInfo       : {
+    TypeName      : '{i18n>Book}',
+    TypeNamePlural: '{i18n>Books}',
+    Title         : {Value: title},
+    Description   : {Value: author.name}
+  },
   Facets: [
     {
       $Type : 'UI.ReferenceFacet',

package/lib/init/template/sample/files/app/admin-books/webapp/manifest.json

@@ -110,6 +110,7 @@
           "options": {
             "settings": {
               "entitySet": "Books",
+              "editableHeaderContent": false,
               "navigation": {
                 "Authors": {
                   "detail": {

package/lib/init/template/sample/files/app/browse/fiori-service.cds

@@ -6,8 +6,9 @@ using { CatalogService } from '../../srv/cat-service.cds';
 //
 annotate CatalogService.Books with @(UI : {
     HeaderInfo: {
-        TypeName      : 'Book',
-        TypeNamePlural: 'Books',
+        TypeName      : '{i18n>Book}',
+        TypeNamePlural: '{i18n>Books}',
+        Title         : {Value: title},
         Description   : {Value : author}
     },
     HeaderFacets: [{

package/lib/init/template/sample/files/app/common.cds

@@ -41,17 +41,6 @@ annotate Currencies with {
   symbol @Common.Label: '{i18n>Currency}';
 }
 
-////////////////////////////////////////////////////////////////////////////
-//
-//	Books Details
-//
-annotate my.Books with @(UI : {HeaderInfo : {
-  TypeName      : '{i18n>Book}',
-  TypeNamePlural: '{i18n>Books}',
-  Title         : { Value: title },
-  Description   : { Value: author.name }
-}, });
-
 
 ////////////////////////////////////////////////////////////////////////////
 //

package/lib/init/template/typescript/files/package.json

@@ -1,6 +1,6 @@
 {
   "devDependencies": {
-    "@cap-js/cds-types": "^0.10.0",
+    "@cap-js/cds-types": "^0.11.0",
     "@types/node": "^22.0.0",
     "tsx": "^4",
     "typescript": "^5"