@sap/cds-dk 9.4.3 → 9.6.0

package/CHANGELOG.md

@@ -6,17 +6,87 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.6.0 - 2025-12-16
+
+### Added
+
+- `cds add console` adds dependency to the CAP console plugin.
+
+### Changed
+
+- `cds import` no longer generates a first parameter typed as `$self` to bound actions, as this parameter is implicit.
+- `cds add` sets `relativePaths: true` for generated UI5 apps to avoid deployment issues if UI5 data sources start with a "/".
+- `cds up` automatically detects the preferred platform.
+- Added deprecation notices for the following commands in favor of using `cds add kyma`:
+    - `cds add containerize`
+    - `cds add helm`
+    - `cds add helm-unified-runtime`
+
+### Fixed
+
+- `cds build --ws-pack` now checks folder depth of up to 5.
+- `cds import --config param1=true,param2=0` now writes boolean and number values correctly to `package.json`.
+- `cds add sample` sets the correct UI component in _\_appconfig/fioriSandboxConfig.json_.
+- `cds add xsuaa` correctly adds the authentication binding to the application deployer if executed afterwards.
+- `cds env` prints coloured output by default again.
+- `cds add java` will preserve existing _package.json_ settings.
+- `cds add multitenancy` now correctly adds a `devDependencies` section when missing.
+- `cds add mta` adds fixes an issue where a faulty XSUAA instance was added with `messaging: true` configured.
+- `cds add sqlite --for production` correctly activates SQLite for production, not just development.
+- `cds up -2 k8s` correctly runs `before_all` before the checksum calculation to calculate against the correct artifact.
+
+## Version 9.5.0 - 2025-12-01
+
+### Added
+
+- `cds import` now accepts `--into-namespace <string>` to override the namespace entities are imported to, when importing OpenAPI definitions.
+
+### Changed
+
+- `cds add portal` adds the correct service key configuration to the _mta.yaml_.
+- `cds add sample` creates sample files aligned with recent versions of bookshop and bookstore in https://github.com/capire.
+- `cds add sample` uses a matching ID in generated `manifest.json` and UI5 components.
+- `cds build` uses `hdblogicalschema` and `hdblogicalschemaconfig` plugins in its default `.hdiconfig`.
+- `cds add cloud-logging` adds required dependencies to _pom.xml_ for Java projects.
+- `cds add kyma` is now the only suggested Kyma facet in `cds add help`.
+- `cds add helm-unified-runtime` option is now deprecated; use `cds add kyma --unified-runtime` instead.
+- `cds up --to k8s` now saves the checksum of buildpack images to determine if a rebuild is necessary.
+- `cds up --to k8s` will interactively ask for registry credentials if they don't exist on the remote cluster.
+- `cds build` automatically adds `contentLocalizedEdmx=true` to the java build task configuration if OData V2 is set.
+- `cds add github-actions` has out-of-the-box support for Java projects.
+- `cds add html5-repo` and `cds add app-frontend` do not create a separate _ui5-deploy.yaml_ but use the default _ui5.yaml_.
+- `cds add` plugins allow merging into non-existing files with `cds.add.merge(<object>).into(<yaml-path>)`.
+- `cds build` tasks that produce `csn.json` now emit the `compile.for.runtime` event, in alignment with other runtime CSN producers like `cds serve`. Plugins can use such events to hook into CSN creation.
+- `cds add xsuaa` sets `credential-types: [ "binding-secret", "x509" ]` for XSUAA instances.
+- `cds add hana` does not create an explicit `.hdiconfig` file any more as `cds build` provides defaults.
+- `cds import` generates the on condition for a composition when the corresponding OData navigation property targets a collection, is contained (`$ContainsTarget` in OData EDM) and has a backlink (`$Partner` in OData EDM).
+- `cds import` now considers OData contained navigation properties as compositions instead of associations.
+
+### Fixed
+
+- `cds add ias` will always add a binding to the MTX sidecar or approuter if required.
+- `cds add ias` has improved support for multitenancy scenarios on Kyma.
+- `cds lint` no longer fails with error code 1 and no message when loading the config fails.
+- `cds version` no longer prints an `undefined` value for `@sap/cds-dk`.
+- `cds compile --flavor files` no longer crashes with a `TypeError`.
+- `cds add workzone` does not add superfluous `destinations` configuration to the `srv-api` import.
+
 ## Version 9.4.3 - 2025-10-29
 
+### Added
+
 ### Changed
 
+- `cds add github-actions` will use the `cap-js/cf-setup` action from GitHub marketplace instead of creating a local copy.
 - `cds add containerize` omits the Unix-based `before_all` scripts in `containerize.yaml` in favor of a cross-platform compatible `cds up --to k8s` integration.
 - `cds up --to k8s` now uses built-in containerization, eliminating the hard dependency on the `ctz` library.
 - `cds up --to k8s` will interactively ask for a domain if it can't be determined from the current Kubernetes configuration.
 - `cds build --for hana` no longer requires `.hdbgrants` and `.hdbrevokes` to be specified as a plugin in the `.hdiconfig` file.
+- `cds import` no longer emits usage info when invoked with the dry option.
 
 ### Fixed
 
+- `cds add data` fixes an issue where randomly generated `Decimal` and `Integer` values could exceed their defined precision or scale.
 - `cds add pipeline` does not add UI5 template files in some cases.
 - `cds add ias` does not write to the `mta.yaml` for non-MTA projects.
 - `cds add ias` automatically adds the `authenticationType` to `xs-app.json` if required.
@@ -40,6 +110,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `cds add test` creates correct OData URLs with unqualified entity names in service paths.
 - `cds add http` skips contained composition targets.
 - `cds add sample` no longer comes with an error when creating a Book through Fiori.
+- `cds build` now places the `i18n` folder in the generated output root directory instead of nested locations.
 
 ## Version 9.4.1 - 2025-10-09
 
@@ -331,6 +402,50 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `cds add multitenancy` requires the `srv-api` instead of the `mtx-api` for Java projects.
 
 
+## Version 8.9.12 - 2025-12-16
+
+### Fixed
+
+- `cds import` generates the on condition for a composition when the corresponding OData navigation property targets a collection, is contained (`$ContainsTarget` in OData EDM) and has a backlink (`$Partner` in OData EDM).
+- `cds import` now considers OData contained navigation properties as compositions instead of associations.
+- Support for `hdb` v2.
+
+## Version 8.9.11 - 2025-11-21
+
+### Fixed
+
+- Bump dependencies in shrinkwrap.
+
+## Version 8.9.10 - 2025-09-19
+
+### Fixed
+
+- Updated shrinkwrap to include `@sap/cds-compiler` version 5.9.12.
+
+## Version 8.9.9 - 2025-09-16
+
+### Fixed
+
+- CVE-2025-58754: vulnerability with `axios` versions <1.12.0.
+
+## Version 8.9.8 - 2025-07-24
+
+### Fixed
+
+- CVE-2025-7783: vulnerability with `form-data` versions <4.0.4.
+
+## Version 8.9.7 - 2025-07-17
+
+### Fixed
+
+- Bump dependencies in shrinkwrap.
+
+## Version 8.9.6 - 2025-06-05
+
+### Fixed
+
+- Bump dependencies in shrinkwrap.
+
 ## Version 8.9.5 - 2025-06-05
 
 ### Fixed

package/bin/compile/index.js

@@ -297,7 +297,7 @@ async function compile (models, options={}) {
     throw `You must specify a model to compile.\nRun 'cds c -?' to learn more.`
   }
 
-  let chain = model.then (m => model=m)
+  let chain = model.then?. (m => model=m) ?? Promise.resolve(model) // model could be a sync. value
 
   // add processors for compiling
   if (options.for) for (let each of options.for.split(',')) {

package/bin/env.js

@@ -67,12 +67,12 @@ async function env ([cmd, key, value], options={}) {
   env['_home_cds-dk'] = path.resolve(__dirname, '..')  // to help tools find the DK
 
   if (!options.for && options.mocked) await cds.service.bindings
+  options.colors = cds.utils.colors.enabled === true
   return fn (env, key, value, options)
 }
 
 
 const { inspect, format } = require('node:util')
-const {colors} = require('../lib/util/term')
 const commands = {
 
   json: (env,k,v,o) => commands.get (env,k,v,{...o,json:true}),
@@ -88,7 +88,7 @@ const commands = {
   },
 
   get (conf, key, val, options) {
-    let fmt = x => inspect (x, {depth:22, colors})
+    let fmt = x => inspect (x, { depth:22, colors: true })
 
     let obj = (
       !key ? conf
@@ -97,7 +97,7 @@ const commands = {
       : conf.get(key.replace(/^cds\./,''))
     )
 
-    if (!colors) {
+    if (options.colors === false) {
       fmt = x => typeof x !== 'object' ? x : JSON.stringify(x,0,2)
     }
     if (options.json) {

package/bin/export.js

@@ -111,7 +111,7 @@ class Export extends Minify {
   async export (minified,o) {
     if (this.options.to === '-') return super.print (minified)
     if (this.options.to.endsWith('/*')) this.options.to = this.export_to()
-    console.log(`\n${this.name}ing APIs to`, this.options.to, '...\n')
+    console.log(`\n${this.name}ing APIs to`, cds.utils.local(this.options.to), '...\n')
     const exports = []; exports.push(...this.export_models (minified))
     if (o.texts) exports.push (...this.export_texts (minified))
     if (o.data) exports.push (this.export_data (minified))

package/bin/help.js

@@ -12,7 +12,6 @@ module.exports = exports = Object.assign (help, {formatHelp, handleCompletion, h
 
     *i* | *init*        jump-start cds-based projects
     *a* | *add*         add a feature to an existing project
-    * * | *gen*         generate models/data using a descriptive prompt [beta]
     *m* | *import*      add models from external sources
     *c* | *compile*     compile cds models to different outputs
     *p* | *parse*       parses given cds models

package/bin/import.js

@@ -1,7 +1,7 @@
 module.exports = Object.assign(_import, {
     _name: 'import',
-    options:   [ '--services', '--for', '--out', '--as', '--name', '--include-namespaces', '--dependencies', '--from', '--config', '--destination', '--group', '--data-product' ],
-    shortcuts: [ '-s', '-4',    '-o',    '-as',  '-n',     '-ns',                    '-d',            undefined,  '-c',       undefined,       undefined, '-', '-f'],
+    options:   [ '--services', '--for', '--out', '--as', '--name', '--include-namespaces', '--dependencies', '--from', '--config', '--destination', '--group', '--into-namespace',  '--data-product' ],
+    shortcuts: [ '-s',            '-4',    '-o',  '-as',     '-n',                  '-ns',             '-d',undefined,       '-c',       undefined, undefined,                '-2',        '-', '-f'],
     flags: [ '--dry', '--force', '--no-copy', '--no-save', '--keep-namespace', '--data-product', '--edmx', '--rfc', '--odata', '--openapi', '--asyncapi' ],
     help: `
 # SYNOPSIS
@@ -56,10 +56,15 @@ module.exports = Object.assign(_import, {
         Not supported by import types "edmx", "openapi" or "asyncapi".
 
     *--data-product*
-        Tells cds import to import a data product. The source must be a valid 
+        Tells cds import to import a data product. The source must be a valid
         data product CSN file, e.g. as found on http://api.sap.com/dataproducts.
         (Not released with general availability yet)
 
+    *-2 | --into-namespace* <string>
+        Specifies a custom namespace to be used for the imported service.
+        This will override the namespace that was specified via the the
+        @title annotation of the original service.
+
     *Below options are valid for OData only*
 
     *--keep-namespace*

package/bin/repl.js

@@ -35,7 +35,7 @@ module.exports = Object.assign (repl, {
     *cds eval*  to evaluate and execute JavaScript.
 `})
 
-async function repl (_, options={}) {
+async function repl ([project], options={}) {
 
   const GREEN = '\x1b[32m', RESET = '\x1b[0m'
   const cds = require('../lib/cds')
@@ -46,9 +46,9 @@ async function repl (_, options={}) {
   inspect.defaultOptions.depth = 11
 
   Object.defineProperty (cds,'repl',{value:true})
-  await cds.service.bindings
+  await cds.service.bindings // REVISIT: this pre-populates many of the cds facade's lazy properties
   let context={}, repl = { context, displayPrompt(){} }
-  if (options.run) await _run (options.run)
+  if ((options.run ??= project)) await _run (options.run)
   if (options.use) _export (...options.use.split(','))
 
   repl = require('repl').start ({
@@ -94,14 +94,10 @@ async function repl (_, options={}) {
   process.on = (event, listener) => event !== 'uncaughtException' && event !== 'unhandledRejection' && process.addListener(event, listener)
 
   async function _run (project) {
-    try {
-      if (require.resolve('@cap-js/cds-test', {paths: [cds.root, cds.home]})) {
-        await cds.test (project)
-      }
-    } catch (e) {
-      if (e.code !== 'MODULE_NOT_FOUND') throw e
-      await cds.exec ('--project', project, '--port', '0', '--in-memory?')
-    }
+    await require('../bin/serve') ([project], { project, port: 0, 
+      'in-memory?': true, 
+      'with-mocks': true 
+    })
     _export ('entities', 'services')
   }
 

package/bin/up.js

@@ -13,7 +13,9 @@ module.exports = Object.assign(up, {
 
   *-2* | *--to* cf|k8s
 
-    The platform to deploy to. Default is 'cf'.
+    The platform to deploy to.
+
+    Defaults to *k8s* when Helm charts are present and no *mta.yaml* exists, otherwise *cf*.
 
   *-n* | *--namespace* <name>
 
@@ -28,28 +30,78 @@ module.exports = Object.assign(up, {
 `})
 
 const { execSync } = require('node:child_process')
+const { tmpdir } = require('node:os')
+const crypto = require('node:crypto')
 const cds = require('../lib/cds')
-const { highlight } = require('../lib/util/term')
-const { exists, fs, path, path: { join } } = cds.utils
+const { highlight, warn, dim, info } = require('../lib/util/term')
+const { exists, fs, path, path: { join }, read, write } = cds.utils
+const { ask4 } = require('../lib/util/question')
 const { readProject } = require('../lib/init/projectReader')
 const { mkdirp, copy } = cds.utils
 const { containerize } = require('../bin/util/containerize')
+const { calcDirChecksum } = require('../lib/util/checksum')
+
+const DEBUG = /\b(y|all|cli)\b/.test(process.env.DEBUG) ? console.debug : undefined
 
-const run = cmd => {
-  console.log(highlight(cmd))
+const run = (cmd, { continueOnFail = false, silent = false } = {}) => {
+  const redactedCmd = cmd.replace(/(--docker-password=)(['"]?)[^'"\s]+(['"]?)/, '$1[REDACTED]$3')
+  console.log(highlight(redactedCmd))
   try {
     return execSync(cmd, {
-      stdio: 'inherit',
+      stdio: silent ? 'pipe' : 'inherit',
       env: { ...process.env, FORCE_COLOR: cds.utils.colors.enabled }
     })
   } catch (error) {
+    if (continueOnFail) {
+      if (!silent)
+        console.error(error.message)
+      return
+    }
     throw error.message
   }
 }
 
+/**
+ * Get or create checksum file path in temp directory for UI5 apps
+ * @param {string} appName - The name of the app
+ * @returns {string} - Path to checksum file in temp directory
+ */
+function getChecksumFilePath(appName) {
+  const projectHash = crypto.createHash('md5').update(cds.root).digest('hex').substring(0, 8)
+  return join(tmpdir(), `cds-ui5-checksum-${projectHash}-${appName}.txt`)
+}
+
+/**
+ * Read stored checksum for an app from temp directory
+ * @param {string} appName - The name of the app
+ * @returns {string|null} - The stored checksum or null if not found
+ */
+function readStoredChecksum(appName) {
+  const checksumFile = getChecksumFilePath(appName)
+  if (exists(checksumFile)) {
+    try {
+      return fs.readFileSync(checksumFile, 'utf-8').trim()
+    } catch (e) {
+      // Ignore read errors and assume no checksum is stored
+    }
+  }
+  return null
+}
+
+/**
+ * Write checksum for an app to temp directory
+ * @param {string} appName - The name of the app
+ * @param {string} checksum - The checksum to store
+ */
+function writeStoredChecksum(appName, checksum) {
+  const checksumFile = getChecksumFilePath(appName)
+  fs.writeFileSync(checksumFile, checksum, 'utf-8')
+}
+
 async function up() {
   const project = readProject()
-  const { apps, appName, hasApprouter, hasXsuaa, isMonorepoMicroservice } = project
+  const { apps, appName, hasApprouter, hasXsuaa, isMonorepoMicroservice, hasKyma, hasMta, k8s } = project
+  const toKyma = cds.cli.options.to === 'k8s' || hasKyma && !hasMta
 
   const html5DeployerPath = join(cds.root, cds.env.folders.app, 'html5-deployer', 'resources')
 
@@ -81,19 +133,39 @@ async function up() {
     }
   }
 
-  if (cds.cli.options.to === 'k8s') {
-    if (!exists('chart')) run('cds add helm')
-    if (apps.length > 0) {
-      await mkdirp(html5DeployerPath)
-    }
+  if (toKyma) {
+    if (!exists('chart') || !exists('containerize.yaml')) run('cds add kyma')
 
-    for (const { app } of apps) {
-      const appPath = path.join(cds.root, cds.env.folders.app, app)
-      run(`npm run build --prefix ${appPath}`)
-      await copy(path.join(appPath, `dist/${app}.zip`)).to(html5DeployerPath, `${app}.zip`)
-    }
+    if (project.hasHtml5Repo) {
+      if (apps.length > 0) {
+        await mkdirp(html5DeployerPath)
+      }
+
+      for (const { app, archiveName } of apps) {
+        if (!archiveName) continue
+
+        const appPath = path.join(cds.root, cds.env.folders.app, app)
+        const zipPath = path.join(appPath, `dist/${archiveName}`)
+
+        // Calculate checksum for the app source folder (excluding node_modules and dist)
+        const currentChecksum = await calcDirChecksum(
+          appPath,
+          (dir) => !dir.includes('node_modules') && !dir.includes('dist')
+        )
+
+        const storedChecksum = readStoredChecksum(app)
+        const needsBuild = currentChecksum !== storedChecksum || !exists(zipPath)
 
-    if (!exists('containerize.yaml')) run('cds add containerize')
+        if (needsBuild || process.env.SKIP_CHECK == 'true') {
+          DEBUG?.(dim(`build required for '${app}' – checksums`, { old: storedChecksum, new: currentChecksum }))
+          run(`npm run build --prefix ${appPath}`)
+          await copy(zipPath).to(html5DeployerPath, `${app}.zip`)
+          writeStoredChecksum(app, currentChecksum)
+        } else {
+          console.log(info(`Skipping build for UI5 app '${app}' - no changes detected (checksum: ${currentChecksum.substring(0, 8)}...)`))
+        }
+      }
+    }
   } else {
     if (!exists('mta.yaml')) {
       run('cds add mta')
@@ -112,18 +184,82 @@ async function up() {
     if (!exists(target)) fs.symlinkSync(relative, target, 'junction')
   }
 
-  if (cds.cli.options.to === 'k8s') {
+  if (toKyma) {
     const ns = cds.cli.options.namespace
-    const nsHelm = ns ? `--namespace ${ns} --create-namespace` : ''
+    const nsHelm = ns ? `--namespace ${ns}` : ''
     const nsKubectl = ns ? `-n ${ns}` : ''
 
     run('npm i --package-lock')
     run('cds build --production')
-    await containerize('containerize.yaml', { push: true, clearCache: !!process.env.CLEAR_CACHE })
-    console.log('Containerization completed')
+
+    if (ns) {
+      const k8sNamespaceResult = run(`kubectl get namespace ${ns} -o jsonpath="{.metadata.name}"`, { continueOnFail: true, silent: true })
+      if (!k8sNamespaceResult) {
+        run(`kubectl create namespace ${ns}`)
+      }
+    }
+
+    const isValidDomain = str => /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(str)
+    const { image, imagePullSecret } = k8s.values?.global ?? {}
+    let registry = image?.registry
+    if (!process.env.CI) {
+      if (!registry || !isValidDomain(registry)) {
+        const valuesPath = 'chart/values.yaml'
+        const [yn] = await ask4([warn(`invalid registry server '${registry}' detected, override in ${valuesPath}? (Y/n)`)])
+        if (yn?.toLowerCase() !== 'y' || process.env.CI) {
+          throw `registry parameter is invalid, please specify it in ${valuesPath}`
+        } else {
+          registry = await ask4(['registry server (e.g. index.docker.io): '])
+          if (!k8s.values.global.image) k8s.values.global.image = {}
+          k8s.values.global.image.registry = registry
+          const values = (await read(valuesPath)).replace(/(registry:\s*).*/, `$1${registry}`)
+          await write(values).to(valuesPath)
+
+          const containerize = (await read('containerize.yaml')).replace(/(repository:\s*).*/, `$1${registry}`)
+          await write(containerize).to('containerize.yaml')
+        }
+      }
+      if (imagePullSecret?.name) {
+        const imagePullSecretResult = run(`kubectl get secret ${imagePullSecret.name} ${nsKubectl} -o jsonpath="{.metadata.name}"`, { continueOnFail: true, silent: true })
+        if (!imagePullSecretResult) {
+          const yn = await ask4([`image pull secret '${imagePullSecret.name}' not found in namespace '${ns || 'default'}' – do you want to create it? (Y/n) `])
+          if (yn?.toLowerCase() !== 'y' && yn !== '') {
+            throw `image pull secret '${imagePullSecret.name}' is required to pull images from the registry`
+          } else {
+            const [username, email] = await ask4([
+              'registry username: ',
+              'registry email: '
+            ])
+            const password = await ask4(['registry password: '], { redacted: true })
+            run(`kubectl create secret docker-registry ${imagePullSecret.name} ${nsKubectl} --docker-server=${registry} --docker-username=${username} --docker-password='${password}' --docker-email='${email}'`)
+          }
+        }
+      }
+    }
+
+    const modules = await containerize()
+    const helmArgs = []
+    modules?.forEach(m => {
+      if (m.path === 'gen/srv') {
+        helmArgs.push(`--set srv.annotations.deployment.deployment-checksum=${m.checksum}`)
+      }
+      if (m.path === 'app/router') {
+        helmArgs.push(`--set approuter.annotations.deployment.deployment-checksum=${m.checksum}`)
+      }
+      if (m.path === 'app/html5-deployer') {
+        helmArgs.push(`--set html5-apps-deployer.annotations.job.job-checksum=${m.checksum}`)
+      }
+      if (m.path === 'gen/db') {
+        helmArgs.push(`--set hana-deployer.annotations.job.job-checksum=${m.checksum}`)
+      }
+      if (m.path === 'gen/mtx/sidecar') {
+        helmArgs.push(`--set sidecar.annotations.deployment.deployment-checksum=${m.checksum}`)
+      }
+    })
 
     let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --wait --wait-for-jobs --timeout=10m`
-    if (hasXsuaa) helmUpgrade += ' --set-file xsuaa.jsonParameters=xs-security.json'
+    if (hasXsuaa) helmArgs.push(' --set-file xsuaa.jsonParameters=xs-security.json')
+    if (helmArgs.length > 0) helmUpgrade += ` ${helmArgs.join(' ')}`
     run(helmUpgrade)
     run(`kubectl rollout status deployment ${appName}-srv ${nsKubectl} --timeout=8m`)
     if (hasApprouter) run(`kubectl rollout status deployment ${appName}-approuter ${nsKubectl} --timeout=8m`)