@sap/cds-dk 9.5.0 → 9.6.1

package/CHANGELOG.md

@@ -6,6 +6,49 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.6.1 - 2026-01-09
+
+### Changed
+
+- All commands use colored logs in GitHub Actions workflows by default.
+
+### Fixed
+
+- CVE-2025-15284: update `express` to fix vulnerability with `qs` <6.14.1.
+- `cds watch` is more efficient on Linux with respect to `inotify` events. This fixes some crash and stall situations on Linux, especially in SAP Business Application Studio where resources are shared.
+- `cds build --production` correctly includes `message.properties` from i18n files provided by CAP plugins.
+- `cds add sample` fixes a warning about unused imports in _app/common.cds_.
+- `cds init` fixes some rare argument parsing errors.
+
+## Version 9.6.0 - 2025-12-16
+
+### Added
+
+- `cds add console` adds dependency to the CAP console plugin.
+
+### Changed
+
+- `cds import` no longer generates a first parameter typed as `$self` to bound actions, as this parameter is implicit.
+- `cds add` sets `relativePaths: true` for generated UI5 apps to avoid deployment issues if UI5 data sources start with a "/".
+- `cds up` automatically detects the preferred platform.
+- Added deprecation notices for the following commands in favor of using `cds add kyma`:
+    - `cds add containerize`
+    - `cds add helm`
+    - `cds add helm-unified-runtime`
+
+### Fixed
+
+- `cds build --ws-pack` now checks folder depth of up to 5.
+- `cds import --config param1=true,param2=0` now writes boolean and number values correctly to `package.json`.
+- `cds add sample` sets the correct UI component in _\_appconfig/fioriSandboxConfig.json_.
+- `cds add xsuaa` correctly adds the authentication binding to the application deployer if executed afterwards.
+- `cds env` prints coloured output by default again.
+- `cds add java` will preserve existing _package.json_ settings.
+- `cds add multitenancy` now correctly adds a `devDependencies` section when missing.
+- `cds add mta` adds fixes an issue where a faulty XSUAA instance was added with `messaging: true` configured.
+- `cds add sqlite --for production` correctly activates SQLite for production, not just development.
+- `cds up -2 k8s` correctly runs `before_all` before the checksum calculation to calculate against the correct artifact.
+
 ## Version 9.5.0 - 2025-12-01
 
 ### Added
@@ -372,6 +415,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `cds add ams` for Java adds a custom builder to the `mta.yaml` to circumvent the missing `srv/src/gen/policies`.
 - `cds add multitenancy` requires the `srv-api` instead of the `mtx-api` for Java projects.
 
+
+## Version 8.9.12 - 2025-12-16
+
+### Fixed
+
+- `cds import` generates the on condition for a composition when the corresponding OData navigation property targets a collection, is contained (`$ContainsTarget` in OData EDM) and has a backlink (`$Partner` in OData EDM).
+- `cds import` now considers OData contained navigation properties as compositions instead of associations.
+- Support for `hdb` v2.
+
 ## Version 8.9.11 - 2025-11-21
 
 ### Fixed

package/bin/cds.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 const path = require('node:path')
-const { sep } = { path }
+const { sep } = path
 const fs = require('node:fs')
 
 const cli = {

package/bin/compile/index.js

@@ -1,5 +1,3 @@
-const path = require('path')
-const {colors} = require('../../lib/util/term')
 
 module.exports = Object.assign ( compile, {
   handleCompletion,
@@ -188,6 +186,8 @@ module.exports = Object.assign ( compile, {
 
 `})
 
+const path = require('path')
+
 async function handleCompletion(currentWord, previousWord, argv, util) {
   const allOptionsFlags = [
     ...compile.options ?? [],
@@ -389,6 +389,7 @@ async function compile (models, options={}) {
   function consoleLog(o) {
     if (typeof o === 'string')  return console.log (o)
     if (process.stdout.isTTY) {
+      const { enabled: colors } = require('../../lib').utils.colors
       o = inspect(o,{colors, depth: 111, compact:false}).replace(/\[Object: null prototype\] /g, '')
     } else
       o = JSON.stringify(o, null, 2)

package/bin/env.js

@@ -67,12 +67,12 @@ async function env ([cmd, key, value], options={}) {
   env['_home_cds-dk'] = path.resolve(__dirname, '..')  // to help tools find the DK
 
   if (!options.for && options.mocked) await cds.service.bindings
+  options.colors = cds.utils.colors.enabled === true
   return fn (env, key, value, options)
 }
 
 
 const { inspect, format } = require('node:util')
-const {colors} = require('../lib/util/term')
 const commands = {
 
   json: (env,k,v,o) => commands.get (env,k,v,{...o,json:true}),
@@ -88,7 +88,7 @@ const commands = {
   },
 
   get (conf, key, val, options) {
-    let fmt = x => inspect (x, {depth:22, colors})
+    let fmt = x => inspect (x, { depth:22, colors: true })
 
     let obj = (
       !key ? conf
@@ -97,7 +97,7 @@ const commands = {
       : conf.get(key.replace(/^cds\./,''))
     )
 
-    if (!colors) {
+    if (options.colors === false) {
       fmt = x => typeof x !== 'object' ? x : JSON.stringify(x,0,2)
     }
     if (options.json) {

package/bin/up.js

@@ -13,7 +13,9 @@ module.exports = Object.assign(up, {
 
   *-2* | *--to* cf|k8s
 
-    The platform to deploy to. Default is 'cf'.
+    The platform to deploy to.
+
+    Defaults to *k8s* when Helm charts are present and no *mta.yaml* exists, otherwise *cf*.
 
   *-n* | *--namespace* <name>
 
@@ -31,7 +33,7 @@ const { execSync } = require('node:child_process')
 const { tmpdir } = require('node:os')
 const crypto = require('node:crypto')
 const cds = require('../lib/cds')
-const { highlight, warn, dim } = require('../lib/util/term')
+const { highlight, warn, dim, info } = require('../lib/util/term')
 const { exists, fs, path, path: { join }, read, write } = cds.utils
 const { ask4 } = require('../lib/util/question')
 const { readProject } = require('../lib/init/projectReader')
@@ -98,7 +100,8 @@ function writeStoredChecksum(appName, checksum) {
 
 async function up() {
   const project = readProject()
-  const { apps, appName, hasApprouter, hasXsuaa, isMonorepoMicroservice, k8s } = project
+  const { apps, appName, hasApprouter, hasXsuaa, isMonorepoMicroservice, hasKyma, hasMta, k8s } = project
+  const toKyma = cds.cli.options.to === 'k8s' || hasKyma && !hasMta
 
   const html5DeployerPath = join(cds.root, cds.env.folders.app, 'html5-deployer', 'resources')
 
@@ -130,7 +133,7 @@ async function up() {
     }
   }
 
-  if (cds.cli.options.to === 'k8s') {
+  if (toKyma) {
     if (!exists('chart') || !exists('containerize.yaml')) run('cds add kyma')
 
     if (project.hasHtml5Repo) {
@@ -138,9 +141,11 @@ async function up() {
         await mkdirp(html5DeployerPath)
       }
 
-      for (const { app } of apps) {
+      for (const { app, archiveName } of apps) {
+        if (!archiveName) continue
+
         const appPath = path.join(cds.root, cds.env.folders.app, app)
-        const zipPath = path.join(appPath, `dist/${app}.zip`)
+        const zipPath = path.join(appPath, `dist/${archiveName}`)
 
         // Calculate checksum for the app source folder (excluding node_modules and dist)
         const currentChecksum = await calcDirChecksum(
@@ -151,15 +156,14 @@ async function up() {
         const storedChecksum = readStoredChecksum(app)
         const needsBuild = currentChecksum !== storedChecksum || !exists(zipPath)
 
-        if (needsBuild) {
+        if (needsBuild || process.env.SKIP_CHECK == 'true') {
           DEBUG?.(dim(`build required for '${app}' – checksums`, { old: storedChecksum, new: currentChecksum }))
           run(`npm run build --prefix ${appPath}`)
+          await copy(zipPath).to(html5DeployerPath, `${app}.zip`)
           writeStoredChecksum(app, currentChecksum)
         } else {
-          console.log(highlight(`Skipping build for UI5 app '${app}' - no changes detected (checksum: ${currentChecksum.substring(0, 8)}...)`))
+          console.log(info(`Skipping build for UI5 app '${app}' - no changes detected (checksum: ${currentChecksum.substring(0, 8)}...)`))
         }
-
-        await copy(zipPath).to(html5DeployerPath, `${app}.zip`)
       }
     }
   } else {
@@ -180,7 +184,7 @@ async function up() {
     if (!exists(target)) fs.symlinkSync(relative, target, 'junction')
   }
 
-  if (cds.cli.options.to === 'k8s') {
+  if (toKyma) {
     const ns = cds.cli.options.namespace
     const nsHelm = ns ? `--namespace ${ns}` : ''
     const nsKubectl = ns ? `-n ${ns}` : ''
@@ -196,7 +200,7 @@ async function up() {
     }
 
     const isValidDomain = str => /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(str)
-    const { image, imagePullSecret } = k8s.values.global ?? {}
+    const { image, imagePullSecret } = k8s.values?.global ?? {}
     let registry = image?.registry
     if (!process.env.CI) {
       if (!registry || !isValidDomain(registry)) {
@@ -205,7 +209,9 @@ async function up() {
         if (yn?.toLowerCase() !== 'y' || process.env.CI) {
           throw `registry parameter is invalid, please specify it in ${valuesPath}`
         } else {
-          registry = image.registry = await ask4(['registry server (e.g. index.docker.io): '])
+          registry = await ask4(['registry server (e.g. index.docker.io): '])
+          if (!k8s.values.global.image) k8s.values.global.image = {}
+          k8s.values.global.image.registry = registry
           const values = (await read(valuesPath)).replace(/(registry:\s*).*/, `$1${registry}`)
           await write(values).to(valuesPath)
 
@@ -217,15 +223,15 @@ async function up() {
         const imagePullSecretResult = run(`kubectl get secret ${imagePullSecret.name} ${nsKubectl} -o jsonpath="{.metadata.name}"`, { continueOnFail: true, silent: true })
         if (!imagePullSecretResult) {
           const yn = await ask4([`image pull secret '${imagePullSecret.name}' not found in namespace '${ns || 'default'}' – do you want to create it? (Y/n) `])
-          if (yn?.toLowerCase() !== 'y' || process.env.CI) {
+          if (yn?.toLowerCase() !== 'y' && yn !== '') {
             throw `image pull secret '${imagePullSecret.name}' is required to pull images from the registry`
           } else {
             const [username, email] = await ask4([
               'registry username: ',
-              'registry email: ',
+              'registry email: '
             ])
             const password = await ask4(['registry password: '], { redacted: true })
-            run(`kubectl create secret docker-registry ${imagePullSecret.name} ${nsKubectl} --docker-server=${registry} --docker-username=${username} --docker-password='${password}' --docker-email=${email}`)
+            run(`kubectl create secret docker-registry ${imagePullSecret.name} ${nsKubectl} --docker-server=${registry} --docker-username=${username} --docker-password='${password}' --docker-email='${email}'`)
           }
         }
       }

package/bin/util/containerize.js

@@ -104,17 +104,6 @@ async function parseYAML(filename, repoOpt = '', options) {
     const name = m.name, tag = m.tag || globalTag, bp = m['build-parameters']
     const rawImg = `${repository}/${name}`, source = `${name}:${tag}`, repoImg = `${repository}/${source}`
     const key = Object.keys(bp)[0]
-    let checksum = null
-    if (bp.buildpack?.path)
-      checksum = await calcDirChecksum(
-        join(cds.root, bp.buildpack.path),
-        (dir) => !dir.includes('node_modules'),
-        'sha256',
-        [
-          join(cds.root, filename),
-          join(cds.root, 'package.json')
-        ]
-      )
     const buildType = keyProcessorMap[key]
 
     if (!buildType) throw `'build-parameters' ${Object.keys(bp)} in ${filename} is invalid`
@@ -122,10 +111,10 @@ async function parseYAML(filename, repoOpt = '', options) {
       name,
       tag,
       buildCmd: buildType(bp, name, tag, key === 'buildpack' && options.clearCache),
-      tagCmd: [['docker', 'tag', source, repoImg]].concat(checksum ? [['docker', 'tag', source, `${rawImg}:${checksum}`]] : []),
       pushCmd: ['docker', 'push', repoImg],
+      tagCmd: [['docker', 'tag', source, repoImg]],
       image: rawImg,
-      checksum,
+      source,
       path: bp.buildpack?.path
     }
   }))
@@ -139,7 +128,7 @@ async function parseYAML(filename, repoOpt = '', options) {
  */
 async function executeModules(modules, options) {
   for (const m of modules) {
-    if (m.checksum) {
+    if (m.checksum && process.env.SKIP_CHECK != 'true') {
       try {
         run(`docker inspect --format='{{index .RepoTags 0}}' ${m.image}:${m.checksum}`, { silent: true })
         console.log(info(`image ${m.image}:${m.checksum} already exists – skipping build and push`))
@@ -157,6 +146,29 @@ async function executeModules(modules, options) {
   }
 }
 
+/**
+ * Calculates checksums for the specified modules based on their directory contents.
+ * @param {*} modules - The list of modules to calculate checksums for.
+ * @param {string} filename - The filename to include in the checksum calculation.
+ */
+async function calculateChecksums(modules, filename) {
+  for (const m of modules) {
+    if (m.path) {
+      m.checksum = await calcDirChecksum(
+        join(cds.root, m.path),
+        (dir) => !dir.includes('node_modules'),
+        'sha256',
+        [
+          join(cds.root, filename),
+          join(cds.root, 'package.json')
+        ]
+      )
+      m.tagCmd = m.tagCmd
+        .concat(m.checksum ? [['docker', 'tag', m.source, `${m.image}:${m.checksum}`]] : [])
+    }
+  }
+}
+
 /**
  * Main function to containerize modules based on a YAML configuration file.
  * @param {string} filename - The path to the YAML configuration file.
@@ -176,6 +188,7 @@ async function containerize(filename = 'containerize.yaml', options = { clearCac
   const { repository, before_all, commands: modules } = await parseYAML(filename, '', options)
   if (!repository || !modules) return
   for (const cmd of before_all) run(cmd)
+  await calculateChecksums(modules, filename)
   await executeModules(modules, options)
   return modules
 }

package/lib/build/provider/internalBuildPlugin.js

@@ -152,10 +152,33 @@ class InternalBuildPlugin extends Plugin {
         // bundleDest might be null
         if (bundleDest && Object.keys(bundles).length > 0) {
             await this.write(bundles).to(file)
+            // also collect and write messages from plugins
+            await this.collectMessageBundles(bundleDest)
             return { file, bundles }
         }
         return null
     }
+
+    /**
+     * Collect and write message bundles from CAP plugins into messages.properties files.
+     * @param {string} bundleDest
+     */
+    async collectMessageBundles(bundleDest) {
+        const messageBundle = cds.i18n.bundle4('messages')
+        const messagesData = messageBundle.translations4?.(cds.env.i18n.languages) ?? {}
+
+        // Write messages.properties files for each locale
+        for (const [locale, messages] of Object.entries(messagesData)) {
+            if (Object.keys(messages).length > 0) {
+                const fileName = locale ? `messages_${locale}.properties` : 'messages.properties'
+                const filePath = path.join(bundleDest, fileName)
+                const content = Object.entries(messages)
+                    .map(([key, value]) => `${key}=${value}`)
+                    .join('\n') + '\n'
+                await this.write(content).to(filePath)
+            }
+        }
+    }
 }
 
 // Emits the 'compile.for.runtime' event, as the produced CSN is for runtime usage.

package/lib/build/util.js

@@ -1,13 +1,19 @@
 // @ts-check
-const fs = require('fs')
-const path = require('path')
+const cp = require('node:child_process');
+const fs = require('node:fs')
+const path = require('node:path')
+
 const cds = require('../cds')
-const cp = require('child_process');
-const execAsync = require('util').promisify(cp.exec)
-const IS_WIN = require('os').platform() === 'win32'
+const execAsync = require('node:util').promisify(cp.exec)
+const { isRoot } = require('../util/fs')
+
+const IS_WIN = require('node:os').platform() === 'win32'
 const { SEVERITY_ERROR, FILE_EXT_CDS, NODEJS_MODEL_EXCLUDE_LIST } = require('./constants');
 const DEBUG = cds.debug('cli|build')
-const WS_MAX_DEPTH = 2
+
+// failsafe to avoid too deep recursions
+// increased from 2 to 5, adding a config options in the future
+const WS_MAX_DEPTH = 5
 
 /** @typedef {{col?: number, endCol?: number, line?: number, endLine?: number, file: string}} SourceLocation */
 /** @typedef {object[] | object} Credentials */
@@ -279,22 +285,32 @@ async function getWorkspaces(wsRoot, resolve = false, devDependencies = true, vi
 }
 
 function findWorkspaceRoot(currentPath, depth = 0) {
-    if (depth > WS_MAX_DEPTH) {
-        DEBUG?.(`No workspaces exist, max depth of ${WS_MAX_DEPTH} reached`)
+    if (isRoot(currentPath) || depth > WS_MAX_DEPTH) {
+        DEBUG?.(`No workspaces found, filesystem root or max depth of ${WS_MAX_DEPTH} reached`)
         return
     }
-    const packageJson = path.join(currentPath, 'package.json')
-    if (fs.existsSync(packageJson)) {
-        if (require(path.join(currentPath, 'package.json')).workspaces) {
+
+    const packageJsonPath = path.join(currentPath, 'package.json')
+    try {
+        const packageJsonContent = fs.readFileSync(packageJsonPath, 'utf8')
+        const packageJson = JSON.parse(packageJsonContent)
+        if (packageJson.workspaces?.length > 0) {
             return currentPath
         }
+    } catch (e) {
+        if (e.code !== 'ENOENT') {
+            if (e.name === 'SyntaxError') {
+                throw `Corrupt package.json found at ${packageJsonPath}: ${e.message}`
+            }
+            throw e
+        }
     }
+
     if (fs.existsSync(path.join(currentPath, '.gitmodules'))) {
         return // project root reached
     }
-    if (path.dirname(currentPath) !== currentPath) {
-        return findWorkspaceRoot(path.dirname(currentPath), depth + 1)
-    }
+
+    return findWorkspaceRoot(path.dirname(currentPath), depth + 1)
 }
 
 /**
@@ -415,15 +431,16 @@ function _filterModelPaths(modelPaths, filter = undefined) {
  * @param {string} srcDir - the directory to search for files
  * @param {(file: string) => boolean} [filter] - the filter function to apply to the found files
  * @param {string[]} files - the set of files to add the found files to
+ * @param {boolean} [ignoreSymlinks=false] - whether to ignore symlinks
  * @returns {string[]} files found in the given directory and its subdirectories
  */
-function getFiles(srcDir, filter, files = []) {
+function getFiles(srcDir, filter, files = [], ignoreSymlinks = false) {
     function handleResource(/** @type {string} entry */ entry) {
         if (!filter || filter.call(this, entry)) {
             const stats = fs.lstatSync(entry)
             if (cds.utils.isdir(entry)) {
                 getFiles(entry, filter, files)
-            } else if (stats.isFile() || stats.isSymbolicLink()) {
+            } else if (stats.isFile() || (!ignoreSymlinks && stats.isSymbolicLink())) {
                 files.push(entry)
             }
         }

package/lib/import/common.js

@@ -357,7 +357,13 @@ async function _updateNodeConfig(dest, services, kind, cwd, options) {
             config = {};
             options.config.trim().split(',').forEach(kv => {
                 const [key, val] = kv.split('=');
-                config[key] = val;
+                if (val === 'true' || val === 'false') {
+                    config[key] = (val === 'true');
+                } else if (!isNaN(val)) {
+                    config[key] = Number(val);
+                } else {
+                    config[key] = val;
+                }
             })
             normalizeToDeepObject(config);
         }

package/lib/import/odata/v4parser.js

@@ -262,8 +262,8 @@ function _captureAnnotationInCSN(targetString, annotationObject, csnDefsTargetOb
     }
 
     /**
-     * Annotations need to be flattened in CSN. E.g. 
-     * 
+     * Annotations need to be flattened in CSN. E.g.
+     *
      * @Core.ContentDisposition : {
      *  Type    : 'inline',
      *  Filename: typedImageFileName
@@ -426,7 +426,7 @@ function _validateAnnotationNamespace(annotationTerm, vocabNamespaceToAlias) {
     if (aliasOrNamespace === "cds") {
         return
     }
-    
+
     for (let alias of Object.values(known_vocabularies)) {
         if (alias === aliasOrNamespace) {
             return;
@@ -462,7 +462,7 @@ function _resolveAnnotationTerm(schemaDataAnnotation, parserContext) {
         }
     }
     /**
-     * Case 3: Namespace doesn't have edmx:Reference. But it is present in known_vocabularies. 
+     * Case 3: Namespace doesn't have edmx:Reference. But it is present in known_vocabularies.
      *         Replacing it with standard alias.
      */
     for (const [namespace, alias] of Object.entries(known_vocabularies)) {
@@ -682,7 +682,7 @@ function _parseAssociationProperty(foreignReference, associationNode, parserCont
         associationProperty.cardinality.max = 1;
     }
 
-    // Generate on condition in case $Partner exists, as that indicates a backlink with which the 
+    // Generate on condition in case $Partner exists, as that indicates a backlink with which the
     // condition can be generated.
     // If not given convert managed associations and compositions in unmanaged with empty key to avoid
     // "generation" of keys, that do not exist in the external service.
@@ -942,21 +942,10 @@ function _generateCSNForBoundActionFunction(actionFunctionObject, kind, parserCo
         csnObj.params = {};
 
         for (let index = 0; index < parameters.length; index++) {
-            let isCollection = parameters[index].$Collection;
-            csnObj.params[parameters[index].$Name] = _parseParameterAndReturnTypeContent(parameters[index], parserContext);
-            /**
-             * binding parameter handling - only first parameter will contain the binding
-             * parameter information, so only make change to the first parameter information.
-             * NOTE: Edm.Stream can act as the binding parameter for action/function
-             * We don't have any example for it, so not handled as of now
-             */
-            if (isBound && index === 0) {
-                if (isCollection) {
-                    csnObj.params[parameters[index].$Name].items.type = '$self';
-                }
-                else {
-                    csnObj.params[parameters[index].$Name].type = '$self';
-                }
+            // skip the first parameter for bound actions, which is the $self parameter
+            // that is only implicit in CSN
+            if (!isBound || index > 0) {
+                csnObj.params[parameters[index].$Name] = _parseParameterAndReturnTypeContent(parameters[index], parserContext);
             }
         }
     }
@@ -1349,7 +1338,7 @@ function _parseEntityContainer(csnDefs, entityContainerElements, parserContext)
                 Object.keys(parserContext.entityContainerAnnotations[annotationTarget]).length > 0
             ) {
                 entityContainerAnnotations[annotationTarget] = Object.assign(
-                    entityContainerAnnotations[annotationTarget], 
+                    entityContainerAnnotations[annotationTarget],
                     possibleAnnotations
                 );
             }
@@ -1452,7 +1441,7 @@ function _collectBoundActionFunction(isAction, currNamespace, elementName, eleme
 
         // binding parameter type should be within the available namespaces in the scope of a document.
         if (entityTypeNamespace !== schemaName && entityTypeNamespace !== parserContext.schemaAliasToNamespace[schemaName]) {
-            
+
             // checking if the namespace is available in other schema of the document
             if (parserContext.schemaToSchemaDataIndex.hasOwnProperty(schemaName)) {
                 entityTypeNamespace = schemaName;
@@ -1680,30 +1669,28 @@ function _generateCSN(edmxAsJson, ignorePersistenceSkip, parserContext, importer
 
     // Step 9: 2. Step for generating $ContainsTarget & $Partner links
     // The containing composition is already generated. Now the Keys: [] has to be removed
-    // on the backlink association because per OData spec, OData does not expose the foreign key fields 
+    // on the backlink association because per OData spec, OData does not expose the foreign key fields
     // used by the backlink and thus it is save to assume they must be generated for proper mocking
-    // 
-    // This happens after Step 8 because that adjusts the names of entity container entities where 
+    //
+    // This happens after Step 8 because that adjusts the names of entity container entities where
     // entity type and entity set differ in naming
-    for (const entity in csn.definitions) {
-        if (entity.type !== 'entity') continue;
-
-        const containingCompositions = Object.keys(csn.definitions[entity].elements).filter(e => 
-            csn.definitions[entity].elements[e].type === 'cds.Composition' && 
-            csn.definitions[entity].elements[e].on
+    for (const [eName, entity] of Object.entries(csn.definitions)) {
+        if (entity.kind !== 'entity') continue;
+        const containingCompositions = Object.keys(entity.elements).filter(e =>
+            entity.elements[e].type === 'cds.Composition' &&
+            entity.elements[e].on
         );
         for (const comp of containingCompositions) {
-            const compTarget = csn.definitions[csn.definitions[entity].elements[comp].target];
-            const backLink = Object.keys(compTarget.elements).find(e => 
-                compTarget.elements[e].type === 'cds.Association' && 
-                compTarget.elements[e].target === entity
+            const compTarget = csn.definitions[entity.elements[comp].target];
+            const backLink = Object.keys(compTarget.elements).find(e =>
+                compTarget.elements[e].type === 'cds.Association' &&
+                compTarget.elements[e].target === eName
             )
-            if (compTarget.elements[backLink].keys) {
+            if (compTarget.elements[backLink]?.keys) {
                 delete compTarget.elements[backLink].keys
             }
         }
     }
-
     return JSON.stringify(csn, null, 4);
 }
 
@@ -1715,7 +1702,7 @@ function _generateEDMX2JSON(edmx, name_space) {
             const v4Conv = MetadataConverterFactory.createEdmxV40XmlToV40Json(name_space);
             v4Conv.execute(inputBuffer, (error, json, missingReferencedDocuments) => {
                 if (missingReferencedDocuments?.length > 0) {
-                    console.log(missingReferencedDocuments);  
+                    console.log(missingReferencedDocuments);
                 }
 
                 if (json) {

package/lib/init/constants.js

@@ -5,7 +5,7 @@ module.exports = {
     COMMAND_ADD: 'add',
 
     JAVA_LTS_VERSIONS: [17, 21],
-    MAVEN_ARCHETYPE_VERSION: '4.4.2',
+    MAVEN_ARCHETYPE_VERSION: '4.6.1',
 
     OPTIONS: Object.freeze({
         COMPLETION: 'completion',

package/lib/init/index.js

@@ -174,7 +174,8 @@ module.exports = class CDSGenerator {
             for (const plugin of sorted) {
                 const Plugin = registered.get(plugin) ?? require('./template/' + plugin)
                 const template = new Plugin()
-                const inProduction = Plugin.hasInProduction(env4('production')) || cds.cli.argv[0]?.includes(plugin) || cds.cli.options.add?.has(plugin)
+                const added = cds.cli.command === 'add' && cds.cli.argv[0]?.split(',').includes(plugin) || cds.cli.options.add?.has(plugin)
+                const inProduction = Plugin.hasInProduction(env4('production')) || added
                 DEBUG && console.log(inProduction ? '✅' : '❌', plugin)
                 if (inProduction) await template.combine()
             }
@@ -230,6 +231,11 @@ module.exports = class CDSGenerator {
     async _fillTemplateList(plugins) {
         const templates = new Map
         for (let plugin of plugins) {
+            // cds 10 remove
+            if(plugin === "helm" || plugin === "helm-unified-runtime") {
+                cds.cli.options.add?.add("kyma")
+                cds.cli.argv[0] += ",kyma"
+            }
             // Compat
             if (plugin === 'helm' && cds.cli.options['internal-unified-runtime-charts']) {
                 console.warn(term.warn('"--internal-unified-runtime-charts" is deprecated, please use "cds add kyma --unified-runtime" instead'))