@sap/cds-dk 9.6.0 → 9.6.1

package/CHANGELOG.md

@@ -6,6 +6,20 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.6.1 - 2026-01-09
+
+### Changed
+
+- All commands use colored logs in GitHub Actions workflows by default.
+
+### Fixed
+
+- CVE-2025-15284: update `express` to fix vulnerability with `qs` <6.14.1.
+- `cds watch` is more efficient on Linux with respect to `inotify` events. This fixes some crash and stall situations on Linux, especially in SAP Business Application Studio where resources are shared.
+- `cds build --production` correctly includes `message.properties` from i18n files provided by CAP plugins.
+- `cds add sample` fixes a warning about unused imports in _app/common.cds_.
+- `cds init` fixes some rare argument parsing errors.
+
 ## Version 9.6.0 - 2025-12-16
 
 ### Added

package/bin/cds.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 const path = require('node:path')
-const { sep } = { path }
+const { sep } = path
 const fs = require('node:fs')
 
 const cli = {

package/bin/compile/index.js

@@ -1,5 +1,3 @@
-const path = require('path')
-const {colors} = require('../../lib/util/term')
 
 module.exports = Object.assign ( compile, {
   handleCompletion,
@@ -188,6 +186,8 @@ module.exports = Object.assign ( compile, {
 
 `})
 
+const path = require('path')
+
 async function handleCompletion(currentWord, previousWord, argv, util) {
   const allOptionsFlags = [
     ...compile.options ?? [],
@@ -389,6 +389,7 @@ async function compile (models, options={}) {
   function consoleLog(o) {
     if (typeof o === 'string')  return console.log (o)
     if (process.stdout.isTTY) {
+      const { enabled: colors } = require('../../lib').utils.colors
       o = inspect(o,{colors, depth: 111, compact:false}).replace(/\[Object: null prototype\] /g, '')
     } else
       o = JSON.stringify(o, null, 2)

package/lib/build/provider/internalBuildPlugin.js

@@ -152,10 +152,33 @@ class InternalBuildPlugin extends Plugin {
         // bundleDest might be null
         if (bundleDest && Object.keys(bundles).length > 0) {
             await this.write(bundles).to(file)
+            // also collect and write messages from plugins
+            await this.collectMessageBundles(bundleDest)
             return { file, bundles }
         }
         return null
     }
+
+    /**
+     * Collect and write message bundles from CAP plugins into messages.properties files.
+     * @param {string} bundleDest
+     */
+    async collectMessageBundles(bundleDest) {
+        const messageBundle = cds.i18n.bundle4('messages')
+        const messagesData = messageBundle.translations4?.(cds.env.i18n.languages) ?? {}
+
+        // Write messages.properties files for each locale
+        for (const [locale, messages] of Object.entries(messagesData)) {
+            if (Object.keys(messages).length > 0) {
+                const fileName = locale ? `messages_${locale}.properties` : 'messages.properties'
+                const filePath = path.join(bundleDest, fileName)
+                const content = Object.entries(messages)
+                    .map(([key, value]) => `${key}=${value}`)
+                    .join('\n') + '\n'
+                await this.write(content).to(filePath)
+            }
+        }
+    }
 }
 
 // Emits the 'compile.for.runtime' event, as the produced CSN is for runtime usage.

package/lib/init/constants.js

@@ -5,7 +5,7 @@ module.exports = {
     COMMAND_ADD: 'add',
 
     JAVA_LTS_VERSIONS: [17, 21],
-    MAVEN_ARCHETYPE_VERSION: '4.6.0',
+    MAVEN_ARCHETYPE_VERSION: '4.6.1',
 
     OPTIONS: Object.freeze({
         COMPLETION: 'completion',

package/lib/init/index.js

@@ -174,7 +174,8 @@ module.exports = class CDSGenerator {
             for (const plugin of sorted) {
                 const Plugin = registered.get(plugin) ?? require('./template/' + plugin)
                 const template = new Plugin()
-                const inProduction = Plugin.hasInProduction(env4('production')) || cds.cli.argv[0]?.includes(plugin) || cds.cli.options.add?.has(plugin)
+                const added = cds.cli.command === 'add' && cds.cli.argv[0]?.split(',').includes(plugin) || cds.cli.options.add?.has(plugin)
+                const inProduction = Plugin.hasInProduction(env4('production')) || added
                 DEBUG && console.log(inProduction ? '✅' : '❌', plugin)
                 if (inProduction) await template.combine()
             }

package/lib/init/projectReader.js

@@ -76,7 +76,7 @@ module.exports = new class ProjectReader {
         const _isESM = () => pkgJson().type === 'module'
         const _isTypescript = () => !!pkgJson().dependencies?.typescript || !!pkgJson().devDependencies?.typescript
         const _hasTyper = () => !!pkgJson().dependencies?.['@cap-js/cds-typer'] || !!pkgJson().devDependencies?.['@cap-js/cds-typer']
-        const _inProd = plugin => require(`./template/${plugin}`).hasInProduction(env) || cds.cli.argv[0]?.includes(plugin) || cds.cli.options.add?.has(plugin)
+        const _inProd = plugin => require(`./template/${plugin}`).hasInProduction(env) || cds.cli.command === 'add' && cds.cli.argv[0]?.split(',').includes(plugin) || cds.cli.options.add?.has(plugin)
         const _uiEmbedded = () => exists(join(env.folders.app, 'xs-app.json'))
         const _uiModule = () => !_uiEmbedded() && isdir(env.folders.app) && fs.readdirSync(resolve(cds.root, env.folders.app)).length > 0
         const _isJava = () => this.isJava
@@ -215,7 +215,7 @@ module.exports = new class ProjectReader {
                     const facet = p.slice(prefix.length).replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase()
                     const inProd = _inProd(facet)
                     if (prefix === 'add') {
-                        const adding = facet => cds.cli.argv[0]?.includes(facet) || cds.cli.options.add?.has(facet)
+                        const adding = plugin => cds.cli.command === 'add' && cds.cli.argv[0]?.split(',').includes(plugin) || cds.cli.options.add?.has(plugin)
                         const caller = new Error().stack.split('\n')[3].replace(/\\/g, '/').match(/lib\/init\/template\/([^/]+)\/index\.js/)[1]
                         return inProd && (adding(facet) || adding(caller))
                     }

package/lib/init/template/mta/index.js

@@ -1,7 +1,7 @@
 const cds = require('../../../cds')
 const { exists } = cds.utils
-const { bold } = require('../../../util/term')
 const { readProject } = require('../../projectReader')
+const { bold } = require('../../../util/term')
 const { merge, sort } = require('../../merge')
 const { mvn } = require('../../add')
 

package/lib/init/template/sample/files/app/common.cds

@@ -226,7 +226,7 @@ annotate common.Currencies with @(UI : {
 //
 //	Currencies Elements
 //
-annotate common.Currencies with {
+annotate sap.common.Currencies with {
   numcode  @title: '{i18n>NumCode}';
   minor    @title: '{i18n>MinorUnit}';
   exponent @title: '{i18n>Exponent}';

package/lib/util/term.js

@@ -34,7 +34,9 @@ const format = module.exports.format = (o, severity='Error', asInternalError=fal
     default       : return format.info (o)
   }
 }
-format.colors = process.stdout.isTTY && process.stderr.isTTY && process.env.NO_COLOR !== 'true' || (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== 'false')
+const forceColor = process.env.FORCE_COLOR && process.env.FORCE_COLOR !== 'false'
+const rendersColors = process.stdout.isTTY && process.stderr.isTTY || process.env.GITHUB_ACTIONS
+format.colors = rendersColors && process.env.NO_COLOR !== 'true' || forceColor
 
 // decorate.error, .warning, .info
 // 'Error: foo'  ->  '[ERROR] foo'  (Maven-like, allows for better grepping in logs)

package/lib/watch/livereload-server.js

@@ -5,10 +5,11 @@ const ws = require('ws')
 const express = require('express')
 const { URL } = require('url')
 const { relative, sep } = require ('path')
+const escapedSep = sep === '\\' ? '\\\\' : sep
 
 const ext = 'css,gif,html,jpg,png,svg,ts,mjs,cjs,js,json,properties,change,variant,ctrl_variant,ctrl_variant_change,ctrl_variant_management_change'
 const watchIncludes = RegExp(`\\.(${ext.replace(/,/g,'|')})$|\\${sep}(webapp|appconfig)`)
-const watchExcludes = RegExp(`@cds-models\\${sep}|@types\\${sep}`)
+const watchExcludes = new RegExp(`${escapedSep}(node_modules|\\.git|dist)(${escapedSep}|$)|@cds-models${escapedSep}|@types${escapedSep}`)
 
 module.exports = class LiveReload {
   async start(port, cwd, delay=0) {
@@ -83,14 +84,14 @@ module.exports = class LiveReload {
       })
 
       // Watching for touched files...
-      const watch = require('node-watch')
+      const watch = require('./watcher')
       const filter = f => {
         const isIn = !watchExcludes.test(f) && watchIncludes.test(f)
         if (!isIn)  DEBUG?. (`livereload ignored: ${relative(cwd||process.cwd(), f)}`)
         // else        DEBUG?. (`livereload NOT ignored: ${relative(cwd||process.cwd(), f)}`, watchIncludes)
         return isIn
       }
-      const watcher = watch (cwd||process.cwd(),{ recursive:true, filter, delay:0 })
+      const watcher = watch (cwd||process.cwd(),{ filter, ignore: watchExcludes })
       if (DEBUG) watcher.on('close', ()=> DEBUG('⚡️', 'cds watch - livereload file watcher closed'))
       watcher.on('change', _coalesceEvents(delay, (files) => {
         DEBUG?. (`livereload for: ${files.map(f => f.name)}`)

package/lib/watch/node-watch.js

@@ -49,7 +49,7 @@ module.exports = ({ cwd = process.cwd(), script, ext, ignore=RegExp(), watched,
   process.on('shutdown', ()=> _kill(child))
 
   // Watching for touched files...
-  const watch = require('node-watch')
+  const watch = require('./watcher')
   const include = RegExp(`\\.(${ext.replace(/,/g,'|')})$`)
   const filter = f => {
     const isIn = !ignore.test(f) && include.test(f)
@@ -57,7 +57,7 @@ module.exports = ({ cwd = process.cwd(), script, ext, ignore=RegExp(), watched,
     // else  DEBUG?. (`NOT ignored: ${relative(cwd||process.cwd(), f)}`, include.test(f), include)
     return isIn
   }
-  const watcher = watch (watched,{ recursive:true, filter, delay:0 })
+  const watcher = watch (watched,{ filter, ignore })
   if (DEBUG) watcher.on('close', ()=> DEBUG('⚡️', 'cds watch - file watcher closed'))
   watcher.on('change', restart)
   process.on('shutdown', ()=> watcher.close())
@@ -78,12 +78,9 @@ module.exports = ({ cwd = process.cwd(), script, ext, ignore=RegExp(), watched,
 
   emitter.restart = restart
   emitter.stop    = () => _kill(child)
-  emitter.setEnv  = (name, value) => {
-    if (typeof value === "undefined") {
-      delete env[name]
-    } else {
-      env[name] // REVISIT: no value assigned ???
-    }
+  emitter.setEnv = (name, value) => {
+    if (typeof value === 'undefined') delete env[name]
+    else env[name] = value
   }
   return emitter
 }

package/lib/watch/watcher.js

@@ -0,0 +1,136 @@
+const fs = require('node:fs')
+const { resolve, sep } = require('node:path')
+const { EventEmitter } = require('node:events')
+
+module.exports = function watch(paths, { filter, ignore } = {}) {
+  const ee = new EventEmitter()
+  const roots = [...new Set((Array.isArray(paths) ? paths : [paths]).filter(Boolean).map(p => resolve(p)))]
+  const ac = new AbortController() // eslint-disable-line no-undef
+  let closed = false
+
+  const _allow = p => !filter || (filter instanceof RegExp ? filter.test(p) : filter(p))
+
+  const useNativeRecursive = process.platform === 'darwin' || process.platform === 'win32'
+  if (useNativeRecursive) {
+    const _watch = async root => {
+      try {
+        if (!fs.existsSync(root)) return
+        const watcher = fs.promises.watch(root, { recursive: true, signal: ac.signal })
+        for await (const event of watcher) {
+          if (closed) break
+          const name = event.filename?.toString?.() ?? event.filename ?? ''
+          const fullPath = resolve(root, name)
+          if (_allow(fullPath)) {
+            ee.emit('change', fs.existsSync(fullPath) ? 'update' : 'remove', fullPath)
+          }
+        }
+      } catch (e) {
+        if (e.name !== 'AbortError') ee.emit('error', e)
+      }
+    }
+
+    roots.forEach(r => _watch(r).catch(e => ee.emit('error', e)))
+
+    ee.close = () => {
+      if (closed) return
+      closed = true
+      ac.abort()
+      ee.emit('close')
+    }
+
+    return ee
+  } else {
+    return _linuxCompat()
+  }
+
+  // On Linux, recursive watchers allocates OS watchers for the whole tree,
+  // so we avoid it to skip ignored dirs before allocating watchers.
+  function _linuxCompat() {
+    const watching = new Set()
+    const queued = new Set()
+    const queue = []
+    const active = new Set()
+    const max = 32
+
+    const _ignored = p => {
+      if (!ignore) return false
+      const test = ignore instanceof RegExp ? s => ignore.test(s) : ignore
+      return test(p) || test(p + sep) // allow trailing sep
+    }
+    const _enqueue = d => {
+      if (closed) return
+      const dir = resolve(d)
+      if (_ignored(dir)) return
+      if (watching.has(dir) || queued.has(dir)) return
+      queued.add(dir)
+      queue.push(dir)
+      _pump()
+    }
+    const _startWatch = dir => {
+      if (watching.has(dir)) return
+      watching.add(dir)
+      ;(async () => {
+        try {
+          if (!fs.existsSync(dir)) return
+          const watcher = fs.promises.watch(dir, { signal: ac.signal }) // non-recursive
+          for await (const event of watcher) {
+            if (closed) break
+            const name = event.filename?.toString?.() ?? event.filename ?? ''
+            const fullPath = name ? resolve(dir, name) : dir
+
+            // if a new dir appears, start watching it (unless ignored)
+            if (name && !_ignored(fullPath) && fs.existsSync(fullPath)) {
+              try {
+                if (fs.lstatSync(fullPath).isDirectory()) _enqueue(fullPath)
+              } catch { /* ignore */ }
+            }
+            if (_allow(fullPath)) {
+              ee.emit('change', fs.existsSync(fullPath) ? 'update' : 'remove', fullPath)
+            }
+          }
+        } catch (e) {
+          if (e.name !== 'AbortError' && !closed) ee.emit('error', e)
+        }
+      })().catch(e => ee.emit('error', e))
+    }
+
+    const _scan = async dir => {
+      _startWatch(dir)
+
+      let entries = []
+      try { entries = await fs.promises.readdir(dir, { withFileTypes: true }) }
+      catch { return }
+
+      for (const e of entries) {
+        if (e.isSymbolicLink?.()) continue
+        if (!e.isDirectory?.()) continue
+        const child = resolve(dir, e.name)
+        if (!_ignored(child)) _enqueue(child)
+      }
+    }
+
+    const _pump = () => {
+      while (!closed && queue.length && active.size < max) {
+        const dir = queue.shift()
+        queued.delete(dir)
+
+        const p = _scan(dir)
+          .catch(e => ee.emit('error', e))
+          .finally(() => {
+            active.delete(p)
+            _pump()
+          })
+
+        active.add(p)
+      }
+    }
+    roots.forEach(_enqueue)
+    ee.close = () => {
+      if (closed) return
+      closed = true
+      ac.abort()
+      ee.emit('close')
+    }
+    return ee
+  }
+}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.6.0",
+  "version": "9.6.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "9.6.0",
+      "version": "9.6.1",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -15,11 +15,10 @@
         "@sap/cds-mtxs": ">=2",
         "@sap/hdi-deploy": "^5",
         "axios": "^1",
-        "express": "^4.17.3",
+        "express": "^4.22.1",
         "hdb": "^2.0.0",
         "livereload-js": "^4.0.1",
         "mustache": "^4.0.1",
-        "node-watch": ">=0.7",
         "ws": "^8.4.2",
         "xml-js": "^1.6.11",
         "yaml": "^2"
@@ -42,8 +41,8 @@
       }
     },
     "node_modules/@cap-js/db-service": {
-      "version": "2.8.0",
-      "integrity": "sha512-Ub+ywq2Nk5UmKH5pZnqZ7qC37DIRfF9IhOozjByhevjB/j7A6p9SpLkTwElSEMkhPSJnRYafILOGde1XH/wseQ==",
+      "version": "2.8.1",
+      "integrity": "sha512-p2MHv97d+yiUBJYSAI/qusZzdEtOVfv6GZH51mkfxNXLeOGpV1wjr6UhLDmZrt6h7gTfqJA6cR1WUrrVOq38Ag==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -54,8 +53,8 @@
       }
     },
     "node_modules/@cap-js/openapi": {
-      "version": "1.3.0",
-      "integrity": "sha512-bLb7BadSA8cqcYJLXDgZ6lrDlk8SaAb2amSZY3pi9rd02yCJI3a2Z4a3F2HFXhX0C9ioC22IRd6Yf5mE0fDAfQ==",
+      "version": "1.3.1",
+      "integrity": "sha512-2QqqZlOxfvp/DDmGgTdwbBAAMjaPrrdPCbNC4+z6wjn2jXXk40j0XX7DHNnF4BU8R9LFxaUCHt2x8/9PzE83uA==",
       "license": "Apache-2.0",
       "dependencies": {
         "pluralize": "^8.0.0"
@@ -65,12 +64,12 @@
       }
     },
     "node_modules/@cap-js/sqlite": {
-      "version": "2.1.1",
-      "integrity": "sha512-6u4A3TQLbF5/of9JrtuNEva97wp5KOl6finhE4CaD4MgOp/uCVZFBb06wF3WYRF6ZhD8rMtgQ/PGv+sWfrLrVQ==",
+      "version": "2.1.2",
+      "integrity": "sha512-q8fQuIzwCfUF+l36BoL3LP32JYw389cmsZzE0Ec3JVz7k1sL+WzZ1XIbL1Ua/we3cHrDV+U3E9iAd0FOlcFumw==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@cap-js/db-service": "^2.8.0",
+        "@cap-js/db-service": "^2.8.1",
         "better-sqlite3": "^12.0.0"
       },
       "peerDependencies": {
@@ -90,8 +89,8 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "9.6.0",
-      "integrity": "sha512-KZdAQZl8B2hvY71eh0FlXezTMuAsFILNgPZwqcT45ibAU4GSQB1eDc51jqA3t6UnpWN+jLSZDYNOagpztBkwJg==",
+      "version": "9.6.2",
+      "integrity": "sha512-BBn2k3fZFfOC8Qmgo/kC9Sjs7ClhtVjf480++LmY/vtthfuybnLA2g4SdisTbCBVePALN44JNA339wVfHCAPSw==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": "^6.3",
@@ -970,8 +969,8 @@
       }
     },
     "node_modules/hdb": {
-      "version": "2.26.3",
-      "integrity": "sha512-+fTSzgUZoThsQPlakxOYDYigkSAJfewr72y3cN8PLutGCugwym88A+7nV82+3bMYi/SaDB9JfIPPfi1Otv2iow==",
+      "version": "2.26.4",
+      "integrity": "sha512-v0uIr9mD9iw2Ws+H6+iLNO6W+uIqeXwt8Mwe1c0CZQOn1Sk631Uy4zgdz1wOz4IY3WgxdVjBAYWZ9AS8A/dLIQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "iconv-lite": "0.7.0"
@@ -1263,14 +1262,6 @@
         "node": ">= 8.0.0"
       }
     },
-    "node_modules/node-watch": {
-      "version": "0.7.4",
-      "integrity": "sha512-RinNxoz4W1cep1b928fuFhvAQ5ag/+1UlMDV7rbyGthBIgsiEouS4kvRayvvboxii4m8eolKOIBo3OjDqbc+uQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/object-inspect": {
       "version": "1.13.4",
       "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
@@ -1377,8 +1368,8 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.14.0",
-      "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+      "version": "6.14.1",
+      "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -1466,9 +1457,12 @@
       "license": "MIT"
     },
     "node_modules/sax": {
-      "version": "1.4.3",
-      "integrity": "sha512-yqYn1JhPczigF94DMS+shiDMjDowYO6y9+wB/4WgO0Y19jWYk0lQ4tuG5KI7kj4FTp1wxPj5IFfcrz/s1c3jjQ==",
-      "license": "BlueOak-1.0.0"
+      "version": "1.4.4",
+      "integrity": "sha512-1n3r/tGXO6b6VXMdFT54SHzT9ytu9yr7TaELowdYpMqY/Ao7EnlQGmAQ1+RatX7Tkkdm6hONI2owqNx2aZj5Sw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=11.0.0"
+      }
     },
     "node_modules/semver": {
       "version": "7.7.3",
@@ -1822,8 +1816,8 @@
       "optional": true
     },
     "node_modules/ws": {
-      "version": "8.18.3",
-      "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
+      "version": "8.19.0",
+      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.6.0",
+  "version": "9.6.1",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [
@@ -23,11 +23,10 @@
     "@sap/cds-mtxs": ">=2",
     "@sap/hdi-deploy": "^5",
     "axios": "^1",
-    "express": "^4.17.3",
+    "express": "^4.22.1",
     "hdb": "^2.0.0",
     "livereload-js": "^4.0.1",
     "mustache": "^4.0.1",
-    "node-watch": ">=0.7",
     "ws": "^8.4.2",
     "xml-js": "^1.6.11",
     "yaml": "^2"