@sap/cds-dk 9.3.0 → 9.3.2

package/CHANGELOG.md

@@ -6,6 +6,28 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.3.2 - 2025-09-16
+
+### Fixed
+
+- `cds add html5-repo` avoids some superfluous configuration combination with `cds add portal`.
+- `cds import` correctly imports OData v2 EDMX files with `Edm.Time` properties having a precision.
+
+## Version 9.3.1 - 2025-09-08
+
+### Fixed
+
+- `cds add ias` correctly sets the `subscription-manager` dependencies endpoint for Node.js.
+- `cds add data --records` respects the max length of a string field when it is annotated with `@Communication.IsEmailAddress`
+- `cds add data --records --format csv` correctly escaping complex properties nested within structs.
+- `cds add data --records` correctly generates values for structs in cases when the entity and the struct, used by the entity, have both a property with the same name.
+- `cds add html5-repo` also binds the `html5-repo-host` service to the approuter.
+- `cds up` has improved support for setups with multiple microservices.
+- `cds add mta` will add no `role-collections` parameters if there are some specified in `xs-security.json`.
+- `cds add github-actions` correctly generates a release workflow.
+- `cds add github-actions` uses a simplified and more resilient Kyma setup script.
+- `cds import` now correctly imports EDMX files with empty NavigationPropertyPath tags.
+
 ## Version 9.3.0 - 2025-09-01
 
 ### Added
@@ -23,6 +45,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Fixed
 
+- `cds add workzone` with missing `sap.app` config in `manifest.json` does not throw a `TypeError`.
 - `cds add ias` adds a subdomain-less application URL in `redirect_uris`.
 
 ## Version 9.2.1 - 2025-08-22

package/bin/up.js

@@ -27,9 +27,9 @@ module.exports = Object.assign(up, {
   *cds up --to k8s --namespace e2e-tests*
 `})
 
-const { execSync, spawn } = require('node:child_process')
+const { execSync } = require('node:child_process')
 const cds = require('../lib/cds')
-const { highlight, bold } = require('../lib/util/term')
+const { highlight } = require('../lib/util/term')
 const { exists, fs, path, path: { join } } = cds.utils
 const { readProject } = require('../lib/init/projectReader')
 
@@ -45,29 +45,9 @@ const run = cmd => {
   }
 }
 
-const runDetectingError = async (cmd, errorRegex) => {
-  console.log(highlight(cmd))
-  return new Promise((resolve, reject) => {
-    const child = spawn(cmd, { shell: true, stdio: 'pipe' })
-    let out = '';
-    ['stdout', 'stderr'].forEach(key => {
-      child[key].on('data', data => {
-        process[key].write(data.toString())
-        out += data.toString()
-      })
-    })
-    child.on('close', () => {
-      const error = out.match(errorRegex)
-      if (error) {
-        return reject('Error in command: ' + bold(cmd) + ' → exiting')
-      }
-      resolve(out)
-    })
-  })
-}
-
 async function up() {
-  const { apps, appName, hasApprouter, hasXsuaa } = readProject()
+  const project = readProject()
+  const { apps, appName, hasApprouter, hasXsuaa, isMonorepoMicroservice } = project
 
   for (const { app } of apps) {
     const appPath = path.join(cds.root, cds.env.folders.app, app)
@@ -104,11 +84,12 @@ async function up() {
       run('npm i --package-lock-only')
     }
   }
-  const prefix = execSync('npm prefix', { encoding: 'utf8' }).trim()
-  if (prefix !== cds.root) {
-    const source = path.join(prefix, 'package-lock.json')
+
+  if (isMonorepoMicroservice) {
+    const { npmWorkspaceRoot } = project
+    const source = path.join(npmWorkspaceRoot, 'package-lock.json')
     const target = path.join(process.cwd(), 'package-lock.json')
-    if (exists(target) || fs.lstatSync(target).isSymbolicLink()) fs.unlinkSync(target)
+    if (exists(target) && fs.lstatSync(target).isSymbolicLink()) fs.unlinkSync(target)
     const relative = path.relative(process.cwd(), source)
     fs.symlinkSync(relative, target, 'junction')
   }
@@ -119,7 +100,7 @@ async function up() {
     const nsKubectl = ns ? `-n ${ns}` : ''
 
     run('npm i --package-lock')
-    await runDetectingError('ctz containerize.yaml --log --push', /^\[?ERROR\]?.*/m)
+    run('ctz containerize.yaml --log --push')
     let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --wait --wait-for-jobs --timeout=10m`
     if (hasXsuaa) helmUpgrade += ' --set-file xsuaa.jsonParameters=xs-security.json'
     run(helmUpgrade)

package/lib/import/odata/metadataconverter/MetadataConverter.js

@@ -1620,6 +1620,11 @@ class PropertyPathExpression extends Expression {
         const targetOption = this.getContext().getConverterOptions().target;
         if (targetOption === MetadataConverter.TARGETS.LIBRARY) {
             target = { [this._targetName]: this.getElement().elements[0].text };
+        } else if (!this.getElement().elements && this._targetName === '$NavigationPropertyPath') {
+            //elements are not given, when <NavigationPropertyPath/> is in EDMX, which is used to refresh the current context
+            return {
+                "=": "($self)"
+            };
         } else {
             target = this.getElement().elements[0].text;
         }

package/lib/import/odata/v2parser.js

@@ -453,6 +453,10 @@ function _getServiceEntityProperty(
 		if (cdsDataType === undefined) {
 			cdsDataType = edmxncdsdatatype[dataType + "_a"];
 			hasInvalidPrecision = true;
+			// Additional fallback for Edm.Time with precision
+			if (cdsDataType === undefined && dataType === 'Edm.Time') {
+				cdsDataType = edmxncdsdatatype[dataType];
+			}
 		}
 	} else if (displayFormat && displayFormat === "Date") {
 		cdsDataType = edmxncdsdatatype[dataType + "_f"];

package/lib/init/constants.js

@@ -5,7 +5,7 @@ module.exports = {
     COMMAND_ADD: 'add',
 
     JAVA_LTS_VERSIONS: [17, 21],
-    MAVEN_ARCHETYPE_VERSION: '4.2.0',
+    MAVEN_ARCHETYPE_VERSION: '4.3.0',
 
     OPTIONS: Object.freeze({
         COMPLETION: 'completion',

package/lib/init/projectReader.js

@@ -1,5 +1,6 @@
 const cds = require('../cds')
-const { join, resolve, basename } = require('path')
+const { join, resolve, basename } = require('node:path')
+const { execSync } = require('node:child_process')
 const { fs, exists, isfile, isdir, path } = cds.utils
 const { parseXml } = require('./xml')
 const { REGEX_JAVA_VERSION, JAVA_LTS_VERSIONS } = require('./constants')
@@ -9,6 +10,7 @@ module.exports = new class ProjectReader {
 
     constructor() {
         this.readProject = this.readProject.bind(this)
+        this.cachedWorkspaceRoot = null
     }
 
     #setPackageInfo() {
@@ -105,6 +107,9 @@ module.exports = new class ProjectReader {
      * @property {boolean} hasDynatrace Indicates if the project uses Dynatrace.
      * @property {boolean} hasCloudLogging Indicates if the project uses Cloud Logging.
      * @property {String} extendsApp Indicates which project is extended if any.
+     * @property {String} githubSlug GitHub org/repo.
+     * @property {boolean} isMonorepoMicroservice Indicates if the project is a monorepo microservice.
+     * @property {String} npmWorkspaceRoot The root path of the monorepo workspace.
      */
 
     /**
@@ -198,7 +203,16 @@ module.exports = new class ProjectReader {
             sap: () => cds.cli.options.sap,
             imageRegistry: () => exists('chart/values.yaml') ? cds.load.yaml(join(cds.root, 'chart/values.yaml')).global?.image?.registry ?? '<your-container-registry-server>' : '<your-container-registry-server>',
             extendsApp: _extends,
+            npmWorkspaceRoot: () => {
+                if (this.cachedWorkspaceRoot) return this.cachedWorkspaceRoot
+                this.cachedWorkspaceRoot = execSync('npm prefix', { encoding: 'utf8', cwd: cds.root, stdio: 'pipe' }).trim()
+                return this.cachedWorkspaceRoot
+            },
+            isMonorepoMicroservice: function () {
+                return this.npmWorkspaceRoot() !== cds.root
+            },
             hasRoles: () => {}, roles: () => {}, // for xs-security generation
+            hasCustomRoleCollections: () => exists('xs-security.json') && !!JSON.parse(fs.readFileSync(path.join(cds.root, 'xs-security.json')))['role-collections']
         }
 
         // Automatically creates availability checks for `cds add` commands.

package/lib/init/template/data/as-csv.js

@@ -48,11 +48,7 @@ module.exports = async (data={}, csn, { headerOnly=false, separator=',' }={}) =>
           }
           else {
             if (i === 0)  header.push(name)
-            if (Array.isArray(value) || typeof value === 'object') { // `array of`/`many` and `cds.Map`
-              value = JSON.stringify(value)
-            }
-            value = escape(value)
-            record.push(value)
+            record.push(processValue(value))
           }
         }
         records.push(record.join(separator))
@@ -71,16 +67,23 @@ module.exports = async (data={}, csn, { headerOnly=false, separator=',' }={}) =>
       return value
     }
 
+    function processValue(v) {
+      if (Array.isArray(v) || typeof v === 'object') { // `array of`/`many` and `cds.Map`
+        return escape(JSON.stringify(v))
+      }
+      return escape(v)
+    }
+
     function resolveStruct(v, prefix) {
       return Object.entries(v).reduce((acc, [key, val]) => {
         //structs can be within structs
-        if (typeof val === 'object') {
+        if (typeof val === 'object' && !Array.isArray(val)) {
           const {headers, records} = resolveStruct(val, prefix + '_' + key);
           acc.headers = acc.headers.concat(headers);
           acc.records = acc.records.concat(records);
         } else {
           acc.headers.push(prefix + '_' + key);
-          acc.records.push(val);
+          acc.records.push(processValue(val));
         }
         return acc;
       }, {headers: [], records: []});

package/lib/init/template/data/as-json.js

@@ -125,8 +125,9 @@ function dataForField(element, artifact, csn, record, data, parent, depth, refer
 
   if (element.is_struct) {
     let struct = {}
+    Object.defineProperty(struct, '$id', {value: record['$id'], enumerable: false})
     for (const el of element.elements) {
-      struct[el.name] = dataForField(el, artifact, csn, record, data, null, depth+1, referenceData)
+      struct[el.name] = dataForField(el, artifact, csn, struct, data, null, depth+1, referenceData)
     }
     return struct
   }
@@ -176,7 +177,7 @@ function dataForField(element, artifact, csn, record, data, parent, depth, refer
         || element['@Communication.IsEmailAddress']
         || element['@cds.on.insert']?.['='] === '$user'
         || element['@cds.on.update']?.['='] === '$user') {
-        return randomEmailAddress(element.name, record['$id'], csn)
+        return randomEmailAddress(element, record['$id'], csn)
       }
 
       let str = `${element.name}-${record['$id']}`
@@ -450,11 +451,13 @@ function randomFromList(list) {
   return list[randomNumber() % list.length]
 }
 
-function randomEmailAddress(firstName, num, csn) {
+function randomEmailAddress(element, num, csn) {
   let addr = fakerValue('faker.internet.email', csn, false)
   if (addr)  return addr
   const provider = randomFromList(['example.com', 'example.org', 'example.net'])
-  return `${firstName}.${num.toString(36)}@${provider}`
+  let localPart = `${element.name}.${num.toString(36)}`
+  // -1 in substring for @
+  return (element.length ? localPart.substring(0, element.length - 1 - provider.length) : localPart) + `@${provider}`
 }
 
 function randomStrForRegex(regexStr, csn) {

package/lib/init/template/enterprise-messaging/index.js

@@ -1,5 +1,5 @@
 const cds = require('../../../cds')
-const { read, yaml: YAML } = cds.utils
+const { read, exists, yaml: YAML } = cds.utils
 const { readProject } = require('../../projectReader')
 const { merge } = require('../../merge')
 const { srv4, enterpriseMessaging, xsuaa } = require('../../registries/mta')
@@ -37,7 +37,6 @@ module.exports = class EnterpriseMessagingTemplate extends require('../../plugin
       project.cloudevents = cds.cli.options.cloudevents
       await merge(__dirname, 'files/package.json.hbs').into(configFile, { with: project })
     }
-    await merge(__dirname, 'files/event-mesh.json.hbs').into('event-mesh.json', { project })
   }
 
   async combine() {
@@ -76,5 +75,7 @@ module.exports = class EnterpriseMessagingTemplate extends require('../../plugin
     if (hasHelm || hasHelmUnifiedRuntime) {
       await merge(__dirname, 'files', 'values.yaml').into('chart/values.yaml')
     }
+
+    if (!exists('event-mesh.json')) await merge(__dirname, 'files/event-mesh.json.hbs').into('event-mesh.json', { project })
   }
 }

package/lib/init/template/enterprise-messaging-shared/index.js

@@ -1,5 +1,5 @@
 const cds = require('../../../cds')
-const { read } = cds.utils
+const { read, exists } = cds.utils
 const { readProject } = require('../../projectReader')
 const { merge } = require('../../merge')
 const { srv4, enterpriseMessaging } = require('../../registries/mta')
@@ -38,7 +38,6 @@ module.exports = class EnterpriseMessagingSharedTemplate extends require('../../
       project.cloudevents = cds.cli.options.cloudevents
       await merge(__dirname, 'files/package.json.hbs').into(configFile, { with: project })
     }
-    await merge(__dirname, 'files/event-mesh.json.hbs').into('event-mesh.json', { project })
   }
 
   async combine() {
@@ -60,5 +59,7 @@ module.exports = class EnterpriseMessagingSharedTemplate extends require('../../
     if (hasHelm || hasHelmUnifiedRuntime) {
       await merge(__dirname, 'files/values.yaml').into('chart/values.yaml')
     }
+
+    if (!exists('event-mesh.json')) await merge(__dirname, 'files/event-mesh.json.hbs').into('event-mesh.json', { project })
   }
 }

package/lib/init/template/github-actions/files/kyma-setup/action.yaml

@@ -43,15 +43,7 @@ runs:
       shell: bash
     - run: apt-get install kubectl -y
       shell: bash
-    - run: curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
-      shell: bash
-    - run: sudo apt-get install apt-transport-https --yes
-      shell: bash
-    - run: echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
-      shell: bash
-    - run: sudo apt-get update
-      shell: bash
-    - run: sudo apt-get install helm
+    - run: curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
       shell: bash
     - run: npm install -g ctz
       shell: bash

package/lib/init/template/github-actions/files/workflows/cf.yaml.hbs

@@ -2,6 +2,10 @@ name: Cloud Foundry
 
 on:
   workflow_call:
+    inputs:
+      environment:
+        default: Staging
+        type: string
   workflow_dispatch:
   push:
     branches:
@@ -22,10 +26,10 @@ jobs:
     runs-on: {{#sap}}[self-hosted, solinas]{{/sap}}{{^sap}}ubuntu-latest{{/sap}}
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
-      - uses: ./.github/actions/cf-setup # cap-js/cf-setup@v1
+      - uses: ./.github/actions/cf-setup
         with:
           cf-api: {{#literal}}${{ vars.CF_API }}{{/literal}}
           cf-org: {{#literal}}${{ vars.CF_ORG }}{{/literal}}
@@ -35,10 +39,6 @@ jobs:
       - run: npm install
       - run: npx cds up
 
-      - uses: ./.github/actions/github-deployment
-        with:
-          app-name: {{#literal}}${{ env.APP_NAME }}{{/literal}}
-
       {{#hasApprouter}}
       - run: cf logs {{#literal}}"${{ env.APP_NAME }}"{{/literal}} --recent
         if: always()
@@ -53,3 +53,13 @@ jobs:
       - run: cf logs {{#literal}}"${{ env.APP_NAME }}-mtx"{{/literal}} --recent
         if: always()
       {{/hasMultitenancy}}
+
+      - name: Get application URL
+        id: route
+        shell: bash
+        run: |
+          {{#literal}}host=$(cf app "${APP_NAME}" | awk '/routes:/ {print $2}' | sed -E 's#^https?://##; s/,.*$//')
+          echo "url=https://$host" >> "$GITHUB_OUTPUT"{{/literal}}
+    environment:
+      name: {{#literal}}${{ inputs.environment || 'Staging' }}{{/literal}}
+      url:  {{#literal}}${{ steps.route.outputs.url }}{{/literal}}

package/lib/init/template/github-actions/files/workflows/kyma.yaml.hbs

@@ -12,7 +12,7 @@ permissions:
   deployments: write
 
 concurrency:
-  group: {{#literal}}deploy-${{ github.workflow }}-${{ github.head_ref || github.run_id }}{{/literal}}
+  group: {{#literal}}kyma-${{ github.workflow }}-${{ github.head_ref || github.run_id }}{{/literal}}
   cancel-in-progress: true
 
 env:
@@ -24,7 +24,7 @@ jobs:
       image: public.int.repositories.cloud.sap/ubuntu:24.04
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
       - uses: ./.github/actions/kyma-setup

package/lib/init/template/github-actions/files/workflows/release.yaml.hbs

@@ -0,0 +1,30 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  deployments: write
+
+jobs:
+  tests:
+     uses: {{& githubSlug}}/.github/workflows/test.yaml@main
+     secrets: inherit
+{{#hasMta}}
+  deploy-cf:
+    needs: [tests]
+    uses: {{& githubSlug}}/.github/workflows/cf.yaml@main
+    secrets: inherit
+    with:
+      environment: Production
+{{/hasMta}}{{^hasMta}}{{#hasHelm}}
+  deploy-kyma:
+    needs: [tests]
+    uses: {{& githubSlug}}/.github/workflows/kyma.yaml@main
+    secrets: inherit
+    with:
+      environment: Production
+{{/hasHelm}}{{/hasMta}}

package/lib/init/template/github-actions/files/workflows/test.yaml.hbs

@@ -16,7 +16,7 @@ jobs:
   tests:
     runs-on: {{#sap}}[self-hosted, solinas]{{/sap}}{{^sap}}ubuntu-latest{{/sap}}
     steps:
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
       - uses: actions/checkout@v5

package/lib/init/template/github-actions/index.js

@@ -1,4 +1,5 @@
 const path = require('node:path')
+const { execSync } = require('node:child_process')
 const { readProject } = require('../../projectReader')
 const { renderAndCopy } = require('../../template')
 const cds = require('../../../cds')
@@ -23,11 +24,27 @@ module.exports = class GitHubActionTemplate extends require('../../plugin') {
   }
 
   async run() {
-    const out = '.github/workflows/test.yaml'
-    if (!exists(out) || cds.cli.options.force) {
-      await renderAndCopy(path.join(__dirname, 'files/workflows/test.yaml.hbs'), out, { sap: cds.cli.options.sap })
+    const test = `.github/workflows/test.yaml`
+    if (!exists(test) || cds.cli.options.force) {
+      await renderAndCopy(path.join(__dirname, 'files/workflows/test.yaml.hbs'), test, { sap: cds.cli.options.sap })
     } else {
-      console.log('> skipping ' + out)
+      console.log('> skipping ' + test)
+    }
+
+    const release = `.github/workflows/release.yaml`
+    if (!exists(release) || cds.cli.options.force) {
+
+      let githubSlug
+      try {
+          githubSlug = execSync('git remote get-url origin', { stdio: 'pipe' }).toString().split('/').slice(-2).join('/').trim().replace(/\.git$/, '')
+      } catch (error) {
+        githubSlug = '<org/repo>'
+        // console.log(`\ncould not determine GitHub URL for the project – replace '<org/repo>' in ${release}`, DEBUG ? error : '')
+      }
+      const { hasMta, hasHelm } = readProject()
+      await renderAndCopy(path.join(__dirname, 'files/workflows/release.yaml.hbs'), release, { sap: cds.cli.options.sap, githubSlug, hasMta, hasHelm })
+    } else {
+      console.log('> skipping ' + release)
     }
   }
 
@@ -44,10 +61,6 @@ module.exports = class GitHubActionTemplate extends require('../../plugin') {
       if (force || !exists(cfSetup)) {
         await copy(path.join(__dirname, 'files/cf-setup'), cfSetup)
       }
-      const cfGithub = '.github/actions/github-deployment'
-      if (force || !exists(cfGithub)) {
-        await copy(path.join(__dirname, 'files/github-deployment'), cfGithub)
-      }
     }
     if (hasHelm) {
       const kyma = '.github/workflows/kyma.yaml'

package/lib/init/template/html5-repo/files/mta.yaml.hbs

@@ -46,6 +46,7 @@ modules:
             - {{app}}.zip
           target-path: {{#isNodejs}}{{& appPath }}{{/isNodejs}}{{#isJava}}resources{{/isJava}}
       {{/apps}}
+    {{#hasWorkzoneStandard}}
     parameters:
       config:
         HTML5Runtime_enabled: true
@@ -65,6 +66,7 @@ modules:
                 Authentication: NoAuthentication
                 Type: HTTP
                 ProxyType: Internet
+    {{/hasWorkzoneStandard}}
 
   {{#apps}}
   - name: {{strippedAppName}}{{strippedApp}}

package/lib/init/template/ias/files/mta.yaml.hbs

@@ -57,10 +57,10 @@ resources:
       service-plan: application
       config:
         display-name: {{appName}}
-        {{#hasApprouter}}
         oauth2-configuration:
           token-policy:
             access-token-format: "jwt"
+        {{#hasApprouter}}
           redirect-uris:
             - ~{app-api/app-protocol}://*.~{app-api/app-uri}/login/callback
             - ~{app-api/app-protocol}://~{app-api/app-uri}/login/callback

package/lib/init/template/mta/files/mta.yaml.hbs

@@ -11,7 +11,7 @@ build-parameters:
     - builder: custom
       commands:
         - npm ci
-        - npx cds build --production
+        - npx cds build --production{{#isMonorepoMicroservice}} --ws-pack{{/isMonorepoMicroservice}}
 {{/isNodejs}}
 modules:
   - name: {{appName}}-srv

package/lib/init/template/multitenancy/files/mta.yaml.hbs

@@ -91,7 +91,7 @@ resources:
         appName: {{appName}}-${org}-${space}
         appCallbacks:
           dependenciesCallbacks:
-            url: {{#isJava}}~{srv-api/srv-cert-url}/mt/sms/subscriptions/tenants/{app_tid}/dependencies{{/isJava}}{{#isNodejs}}~{mtx-api/mtx-cert-url}/-/cds/sms-provisioning/dependencies/{app_tid}{{/isNodejs}}
+            url: {{#isJava}}~{srv-api/srv-cert-url}/mt/sms/subscriptions/tenants/{app_tid}/dependencies{{/isJava}}{{#isNodejs}}~{mtx-api/mtx-cert-url}/-/cds/sms-provisioning/dependencies{{/isNodejs}}
           subscriptionCallbacks:
             url: {{#isJava}}~{srv-api/srv-cert-url}/mt/sms/subscriptions/tenants/{app_tid}{{/isJava}}{{#isNodejs}}~{mtx-api/mtx-cert-url}/-/cds/sms-provisioning/tenant/{app_tid}{{/isNodejs}}
             async:

package/lib/init/template/multitenancy/files/values.yaml.hbs

@@ -50,7 +50,7 @@ subscription-manager:
   parameters:
     appCallbacks:
       dependenciesCallbacks:
-        {{#literal}}url: https://{{ .Release.Name }}-sidecar-{{ .Release.Namespace }}.cert.{{ .Values.global.domain }}/-/cds/sms-provisioning/dependencies/{app_tid}{{/literal}}
+        {{#literal}}url: https://{{ .Release.Name }}-sidecar-{{ .Release.Namespace }}.cert.{{ .Values.global.domain }}/-/cds/sms-provisioning/dependencies{{/literal}}
       subscriptionCallbacks:
         {{#literal}}url: https://{{ .Release.Name }}-sidecar-{{ .Release.Namespace }}.cert.{{ .Values.global.domain }}/-/cds/sms-provisioning/tenant/{app_tid}{{/literal}}
     appName: {{appName}}

package/lib/init/template/xsuaa/files/mta.yaml.hbs

@@ -24,11 +24,12 @@ resources:
       config:
         xsappname: {{appName}}-${org}-${space}
         tenant-mode: {{#hasMultitenancy}}shared{{/hasMultitenancy}}{{^hasMultitenancy}}dedicated{{/hasMultitenancy}}
-        {{#hasRoles}}
+        {{#hasRoles}}{{^hasCustomRoleCollections}}
         role-collections:
           {{#roles}}
           - name: '{{name}} ({{appName}} ${org}-${space})'
             description: 'generated'
             role-template-references: ['$XSAPPNAME.{{name}}']
           {{/roles}}
+        {{/hasCustomRoleCollections}}
         {{/hasRoles}}

package/lib/init/template/xsuaa/index.js

@@ -67,11 +67,13 @@ module.exports = class XsuaaTemplate extends require('../../plugin') {
             project.hasRoles = xsSecurity['role-templates'].length > 0
             project.roles = xsSecurity['role-templates'].map(role => role)
 
-            for (const role of xsSecurity['role-templates']) {
-                additions.push({
-                    in: [xsuaa, 'parameters.role-collections'],
-                    where: { 'role-template-references': ['XSAPPNAME'+role.name] }
-                })
+            if (!project.hasCustomRoleCollections) {
+                for (const role of xsSecurity['role-templates']) {
+                    additions.push({
+                        in: [xsuaa, 'parameters.role-collections'],
+                        where: { 'role-template-references': ['XSAPPNAME'+role.name] }
+                    })
+                }
             }
 
             await merge(__dirname, 'files/mta.yaml.hbs').into('mta.yaml', { project, additions, overwrites, relationships })

package/lib/lint/eslintHelp.json

@@ -1,5 +1,5 @@
 {
-  "version": "9.34.0",
+  "version": "9.35.0",
   "help": "\n# SYNOPSIS\n\n    *cds lint* [options] file.js [file.js] [dir]\n\n    Runs environment checks and/or checks the specified models\n    based on the ESLint framework\n\n# OPTIONS\n    \n    Basic configuration:\n      --no-config-lookup               Disable look up for eslint.config.js\n      -c, --config path::String        Use this configuration instead of eslint.config.js, eslint.config.mjs, or eslint.config.cjs\n      --inspect-config                 Open the config inspector with the current configuration\n      --ext [String]                   Specify additional file extensions to lint\n      --global [String]                Define global variables\n      --parser String                  Specify the parser to be used\n      --parser-options Object          Specify parser options\n    \n    Specify Rules and Plugins:\n      --plugin [String]                Specify plugins\n      --rule Object                    Specify rules\n    \n    Fix Problems:\n      --fix                            Automatically fix problems\n      --fix-dry-run                    Automatically fix problems without saving the changes to the file system\n      --fix-type Array                 Specify the types of fixes to apply (directive, problem, suggestion, layout)\n    \n    Ignore Files:\n      --no-ignore                      Disable use of ignore files and patterns\n      --ignore-pattern [String]        Patterns of files to ignore\n    \n    Use stdin:\n      --stdin                          Lint code provided on <STDIN> - default: false\n      --stdin-filename String          Specify filename to process STDIN as\n    \n    Handle Warnings:\n      --quiet                          Report errors only - default: false\n      --max-warnings Int               Number of warnings to trigger nonzero exit code - default: -1\n    \n    Output:\n      -o, --output-file path::String   Specify file to write report to\n      -f, --format String              Use a specific output format - default: stylish\n      --color, --no-color              Force enabling/disabling of color\n    \n    Inline configuration comments:\n      --no-inline-config               Prevent comments from changing config or rules\n      --report-unused-disable-directives  Adds reported errors for unused eslint-disable and eslint-enable directives\n      --report-unused-disable-directives-severity String  Chooses severity level for reporting unused eslint-disable and eslint-enable directives - either: off, warn, error, 0, 1, or 2\n      --report-unused-inline-configs String  Adds reported errors for unused eslint inline config comments - either: off, warn, error, 0, 1, or 2\n    \n    Caching:\n      --cache                          Only check changed files - default: false\n      --cache-file path::String        Path to the cache file. Deprecated: use --cache-location - default: .eslintcache\n      --cache-location path::String    Path to the cache file or directory\n      --cache-strategy String          Strategy to use for detecting changed files in the cache - either: metadata or content - default: metadata\n    \n    Suppressing Violations:\n      --suppress-all                   Suppress all violations - default: false\n      --suppress-rule [String]         Suppress specific rules\n      --suppressions-location path::String  Specify the location of the suppressions file\n      --prune-suppressions             Prune unused suppressions - default: false\n      --pass-on-unpruned-suppressions  Ignore unused suppressions - default: false\n    \n    Miscellaneous:\n      --init                           Run config initialization wizard - default: false\n      --env-info                       Output execution environment information - default: false\n      --no-error-on-unmatched-pattern  Prevent errors when pattern is unmatched\n      --exit-on-fatal-error            Exit with exit code 2 in case of fatal error - default: false\n      --no-warn-ignored                Suppress warnings when the file list includes ignored files\n      --pass-on-no-patterns            Exit with exit code 0 in case no file patterns are passed\n      --debug                          Output debugging information\n      -h, --help                       Show help\n      -v, --version                    Output the version number\n      --print-config path::String      Print the configuration for the given file\n      --stats                          Add statistics to the lint report - default: false\n      --flag [String]                  Enable a feature flag\n      --mcp                            Start the ESLint MCP server\n      --concurrency Int|String         Number of linting threads, auto to choose automatically, off for no multithreading - default: off\n    \n",
   "options": [
     "--config",

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.3.0",
+  "version": "9.3.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "9.3.0",
+      "version": "9.3.2",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -78,8 +78,8 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.34.0",
-      "integrity": "sha512-EoyvqQnBNsV1CWaEJ559rxXL4c8V92gxirbawSmVUOWXlsRxxQXl6LmCpdUblgxgSkDIqKnhzba2SjRTI/A5Rw==",
+      "version": "9.35.0",
+      "integrity": "sha512-30iXE9whjlILfWobBkNerJo+TXYsgVM5ERQwMcMKCHckHflCmf7wXDAHlARoWnh0s1U72WqlbeyE7iAcCzuCPw==",
       "license": "MIT",
       "peer": true,
       "engines": {
@@ -90,8 +90,8 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "9.3.0",
-      "integrity": "sha512-2JaY4AlYvDP88DpZj5vo7B+9+r2ICmY5ktcCxHpnPoC9cmauYmXQtSn6gfuDwuBAWnFMSQEMu6qXz+7Yt8o7mQ==",
+      "version": "9.3.1",
+      "integrity": "sha512-xA9EN29X8HKaz83Aod1e3Bs6LRvqcCVoaTvCtyOup5rMYDQumcoZ7UOKH6NIUTeO0zOtafUiMHucMG+dBnq5XQ==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": "^6.1",
@@ -120,8 +120,8 @@
       }
     },
     "node_modules/@sap/cds-compiler": {
-      "version": "6.3.0",
-      "integrity": "sha512-4HhZuiKa8SztqtjfM9Iey7yb2U6xQGzUbjib3JXcSSP6AJ6Bz0gViliTwf8dASPTLRtv7HU82277m4uqxU2qjw==",
+      "version": "6.3.4",
+      "integrity": "sha512-3Ip+PgK0yiZXftAC1Pc5euiz4L56t0vX/a4k8xJwTxD0Ccr6G3AvmEFLju5f96D18nr4lH1djC05BeK9yWUpGg==",
       "license": "SEE LICENSE IN LICENSE",
       "bin": {
         "cdsc": "bin/cdsc.js",
@@ -142,8 +142,8 @@
       }
     },
     "node_modules/@sap/cds-mtxs": {
-      "version": "3.3.0",
-      "integrity": "sha512-udIzKk+qUoYWLJKbGUJm0csuZP5r54msnTNy11bFDsuESio07ppgDkCIk+oGXCjsJLeoLZULCGgFvifLRi0ATg==",
+      "version": "3.3.1",
+      "integrity": "sha512-66yWxkVlqu5FsOHxDF8w2JJSlcbgtT2PTegBSECEq9+fjMOaqlxnBHpXXTODCUgK762Ad3kyCUZqW///gmpuMA==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/hdi-deploy": "^5"
@@ -261,8 +261,8 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.11.0",
-      "integrity": "sha512-1Lx3WLFQWm3ooKDYZD1eXmoGO9fxYQjrycfHFC8P0sCfQVXyROp0p9PFWBehewBOdCwHc+f/b8I0fMto5eSfwA==",
+      "version": "1.12.2",
+      "integrity": "sha512-vMJzPewAlRyOgxV2dU0Cuz2O8zzzx9VYtbJOaBgXFeLc4IV/Eg50n4LowmehOOR61S8ZMpc2K5Sa7g6A4jfkUw==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.15.6",
@@ -558,8 +558,8 @@
       }
     },
     "node_modules/detect-libc": {
-      "version": "2.0.4",
-      "integrity": "sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==",
+      "version": "2.1.0",
+      "integrity": "sha512-vEtk+OcP7VBRtQZ1EJ3bdgzSfBjgnEalLTp5zjJrS+2Z1w2KZly4SBdac/WDU3hhsNAZ9E8SC96ME4Ey8MZ7cg==",
       "license": "Apache-2.0",
       "optional": true,
       "engines": {
@@ -1213,8 +1213,8 @@
       "license": "MIT"
     },
     "node_modules/node-abi": {
-      "version": "3.75.0",
-      "integrity": "sha512-OhYaY5sDsIka7H7AtijtI9jwGYLyl29eQn/W623DiN/MIv5sUqc4g7BIDThX+gb7di9f6xK02nkp8sdfFWZLTg==",
+      "version": "3.77.0",
+      "integrity": "sha512-DSmt0OEcLoK4i3NuscSbGjOf3bqiDEutejqENSplMSFA/gmB8mkED9G4pKWnPl7MDU4rSHebKPHeitpDfyH0cQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1665,8 +1665,8 @@
       }
     },
     "node_modules/tar-fs": {
-      "version": "2.1.3",
-      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
+      "version": "2.1.4",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.3.0",
+  "version": "9.3.2",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/lib/init/template/github-actions/files/github-deployment/action.yaml

@@ -1,50 +0,0 @@
-name: GitHub Deployment for Cloud Foundry
-description: "Creates a GitHub deployment for your Cloud Foundry app"
-
-inputs:
-  app-name:
-    description: "Base name of the deployed CAP app"
-    required: true
-  environment:
-    description: "Deployment environment name"
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Get deployed server URL
-      id: get-url
-      shell: bash
-      run: |
-        raw=$(cf app "${{ inputs.app-name }}" | awk '/routes:/ {print $2}')
-        raw=$(echo "$raw" | sed -E 's#^https?://##')
-        echo "url=https://$raw" >> "$GITHUB_OUTPUT"
-
-    - name: Create GitHub Deployment
-      uses: actions/github-script@v7
-      env:
-        URL: ${{ steps.get-url.outputs.url }}
-        ENVIRONMENT: ${{ inputs.environment }}
-      with:
-        script: |
-          const { owner, repo } = context.repo
-          const ref = context.ref
-          const url = process.env.URL
-          const environment = process.env.ENVIRONMENT
-
-          const deployment = await github.rest.repos.createDeployment({
-            owner,
-            repo,
-            ref,
-            required_contexts: [],
-            environment
-          })
-
-          await github.rest.repos.createDeploymentStatus({
-            owner,
-            repo,
-            deployment_id: deployment.data.id,
-            state: 'success',
-            environment_url: url,
-            log_url: `https://github.com/${owner}/${repo}/actions/runs/${context.runId}`
-          })