@sap/cds-dk 9.8.1 → 9.8.3

package/CHANGELOG.md

@@ -6,6 +6,25 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.8.3 - 2026-04-02
+
+### Fixed
+
+- Dependency updates, e.g. for CVE-2026-33937.
+- `cds add xsuaa --plan broker` does not use plan `application` in approuter scenarios.
+
+## Version 9.8.2 - 2026-03-25
+
+### Added
+
+- `cds init` now removes the `.vscode` folder when creating projects in SAP Business Application Studio in order to restore compatibility with other project generators. This is a temporary solution likely to be reverted in cds-dk 10.
+
+### Fixed
+
+- `cds add workzone` for Kyma correctly adds the `html5-apps-repo-runtime` to its `Chart.yaml`.
+- `cds add app-front` in combination with `cds add ias` correctly includes all `IASDependencyName` settings.
+- `cds build` has improved performance in some scenarios.
+
 ## Version 9.8.1 - 2026-03-13
 
 ### Fixed

package/lib/build/plugins/plugin.js

@@ -227,14 +227,7 @@ module.exports = class Plugin {
         DEBUG?.(`model: ${relativePaths(cds.root, files).join(", ")}`)
 
         const options = { ...this.options(), cwd: cds.root }
-
-        this.context._modelCache ??= new Map()
-        const cacheKey = JSON.stringify({ files, options })
-        if (!this.context._modelCache.has(cacheKey)) {
-            const _load = cds.load(files, options)
-            this.context._modelCache.set(cacheKey, _load)
-        }
-        return this.context._modelCache.get(cacheKey)
+        return cds.load(files, options)
     }
 
     /**
@@ -253,13 +246,7 @@ module.exports = class Plugin {
         }
 
         const options = this.options()
-        this.context._modelCache ??= new Map()
-        const cacheKey = JSON.stringify({ files: sources.base, options })
-        if (!this.context._modelCache.has(cacheKey)) {
-            const _load = cds.load(sources.base, options)
-            this.context._modelCache.set(cacheKey, _load)
-        }
-        return this.context._modelCache.get(cacheKey)
+        return cds.load(sources.base, options)
     }
 
     options() {

package/lib/init/registries/mta.js

@@ -19,7 +19,7 @@ const ias = { in: 'resources', where: { 'parameters.service': 'identity' } }
 
 const xsuaa = {
     in: 'resources',
-    where: { type: 'org.cloudfoundry.managed-service', 'parameters.service': 'xsuaa', 'parameters.service-plan': 'application' }
+    where: { type: 'org.cloudfoundry.managed-service', 'parameters.service': 'xsuaa' }
 }
 
 const xsuaa4 = plan => ({

package/lib/init/template/app-frontend/files/mta.yaml.hbs

@@ -6,12 +6,6 @@ modules:
     type: {{language}}
     path: {{& srvPath}}
 
-  - name: {{appName}}
-    type: approuter.nodejs
-    path: {{& approuterPath}}
-    requires:
-      - name: {{appName}}-html5-runtime
-
   - name: {{appName}}-app-deployer
     type: com.sap.application.content
     path: {{#isNodejs}}gen{{/isNodejs}}{{#isJava}}.{{/isJava}}
@@ -25,19 +19,22 @@ modules:
           target-path: {{#isNodejs}}{{& appPath }}{{/isNodejs}}{{#isJava}}resources{{/isJava}}
       {{/apps}}
     requires:
-      - name: srv-api
       {{#hasXsuaa}}
       - name: {{appName}}-auth
       {{/hasXsuaa}}
+      - name: srv-api
       - name: {{appName}}-app-front
         parameters:
-          content-target: true
+          content-target: true{{#hasIas}}
+          config:
+            IASDependencyName: {{appName}}-ias-api{{/hasIas}}
     parameters:
       config:
         destinations:
         - name: srv-api
           url: ~{srv-api/srv-url}
-          forwardAuthToken: true
+          forwardAuthToken: true{{#hasIas}}
+          IASDependencyName: {{appName}}-ias-api{{/hasIas}}
         {{#hasUI5}}
         - name: ui5
           url: https://ui5.sap.com

package/lib/init/template/app-frontend/index.js

@@ -1,7 +1,7 @@
-const { join } = require('path')
+const { join } = require('node:path')
 const { readProject } = require('../../projectReader')
 const { merge } = require('../../merge')
-const { srv4, appDeployer, appFront } = require('../../registries/mta')
+const { srv4, appDeployer, appFront, xsuaa } = require('../../registries/mta')
 const { odataApi } = require('../../registries/xs-app')
 const { renderAndCopy } = require('../../template')
 const { exists } = require('../../../cds').utils
@@ -45,7 +45,10 @@ module.exports = class extends require('../../plugin') {
 
     async combine() {
         const project = readProject()
-        const { srvPath, appPath, addMta, apps } = project
+        const {
+            srvPath, appPath, apps,
+            hasMta, addMta, hasXsuaa, addSample, addApprouter, addWorkzoneStandard, addXsuaa, addIas
+        } = project
 
         await Promise.all(apps.map(async ({ app }) => {
             project.app = app
@@ -59,21 +62,31 @@ module.exports = class extends require('../../plugin') {
         //  await merge({ cds: { requires: { 'app-front':true } } }).into('mtx/sidecar/package.json')
         // }
 
-        if (addMta) {
+        const affected = addXsuaa || addApprouter || addWorkzoneStandard || addSample || addIas
+        if (addMta || affected && hasMta) {
             const srv = srv4(srvPath)
             project.apps = apps
-            const appModules = project.apps.map(app => ({
-                in: 'modules',
-                where: { type: 'html5', path: `${appPath}${app.app}` }
-            }))
-            const additions = [srv, appDeployer, appFront, ...appModules]
             const relationships = [{
                 insert: [appFront, 'name'],
                 into: [appDeployer, 'requires', 'name'],
             }]
+            const appModules = []
+            for (const { app } of project.apps) {
+                const html5App = { in: 'modules', where: { type: 'html5', path: `${appPath}${app}` } }
+                relationships.push({
+                    insert: [html5App],
+                    into: [appDeployer, 'build-parameters.requires'],
+                })
+            }
+            if (hasXsuaa) {
+                relationships.push({
+                    insert: [xsuaa, 'name'],
+                    into: [appDeployer, 'requires']
+                })
+            }
             await merge(__dirname, 'files/mta.yaml.hbs').into('mta.yaml', {
                 with: project,
-                additions,
+                additions: [srv, appDeployer, appFront, ...appModules],
                 relationships
             })
         }

package/lib/init/template/approuter/files/mta.yaml.hbs

@@ -73,7 +73,6 @@ resources:
       - name: app-api
     parameters:
       service: xsuaa
-      service-plan: application
       path: ./xs-security.json
       config:
         xsappname: {{appName}}-${org}-${space}

package/lib/init/template/enterprise-messaging/files/mta.yaml.hbs

@@ -18,6 +18,5 @@ resources:
     type: org.cloudfoundry.managed-service
     parameters:
       service: xsuaa
-      service-plan: application
     processed-after:
       - {{appName}}-messaging

package/lib/init/template/enterprise-messaging/index.js

@@ -42,7 +42,7 @@ module.exports = class EnterpriseMessagingTemplate extends require('../../plugin
 
   async combine() {
     const project = readProject()
-    const { addXsuaa, addKyma, addMta, srvPath, appName } = project
+    const { addXsuaa, hasXsuaa, addKyma, addMta, srvPath, appName } = project
 
     if (addMta) {
       const srv = srv4(srvPath)
@@ -56,7 +56,7 @@ module.exports = class EnterpriseMessagingTemplate extends require('../../plugin
       })
     }
 
-    if (addXsuaa || addMta) {
+    if (addXsuaa || (addMta && hasXsuaa)) {
       if (addMta) {
         await merge(__dirname, 'files/mta.yaml.hbs').into('mta.yaml', {
           project,

package/lib/init/template/html5-repo/files/mta.yaml.hbs

@@ -24,6 +24,15 @@ modules:
   - name: {{appName}}-app-deployer
     type: com.sap.application.content
     path: {{#isNodejs}}gen{{/isNodejs}}{{#isJava}}.{{/isJava}}
+    build-parameters:
+      build-result: {{#isNodejs}}{{& appPath }}{{/isNodejs}}{{#isJava}}resources{{/isJava}}
+      requires:
+      {{#apps}}
+        - name: {{strippedAppName}}{{strippedApp}}
+          artifacts:
+            - {{app}}.zip
+          target-path: {{#isNodejs}}{{& appPath }}{{/isNodejs}}{{#isJava}}resources{{/isJava}}
+      {{/apps}}
     requires:
       {{#hasXsuaa}}
       - name: {{appName}}-auth
@@ -35,15 +44,6 @@ modules:
           config:
             HTML5Runtime_enabled: true{{#hasIas}}
             IASDependencyName: {{appName}}-ias-api{{/hasIas}}
-    build-parameters:
-      build-result: {{#isNodejs}}{{& appPath }}{{/isNodejs}}{{#isJava}}resources{{/isJava}}
-      requires:
-      {{#apps}}
-        - name: {{strippedAppName}}{{strippedApp}}
-          artifacts:
-            - {{app}}.zip
-          target-path: {{#isNodejs}}{{& appPath }}{{/isNodejs}}{{#isJava}}resources{{/isJava}}
-      {{/apps}}
     {{#hasWorkzoneStandard}}
     {{#hasMultitenancy}}
     parameters:

package/lib/init/template/initial/files/.gitignore.hbs

@@ -0,0 +1,19 @@
+node_modules/
+target/
+_out/
+gen/
+
+.cdsrc-private.json
+default-*.json
+*.sqlite
+
+# MTA
+mta_archives/
+*_mta_build_tmp
+*.mtar
+
+# Other
+.DS_Store
+
+# @cap-js/cds-typer
+@cds-models

package/lib/init/template/initial/index.js

@@ -1,7 +1,7 @@
 const { join } = require('path')
 const cds = require('../../../cds')
-const { mkdirp, path } = cds.utils
-const { env4 } = require('../../projectReader')
+const { mkdirp, path, rimraf } = cds.utils
+const { env4, readProject } = require('../../projectReader')
 const { renderAndCopy } = require('../../template')
 
 module.exports = class extends require('../../plugin') {
@@ -10,6 +10,13 @@ module.exports = class extends require('../../plugin') {
         const { db, srv, app } = env4('production').folders
         await renderAndCopy(join(__dirname, 'files'), cds.root, { projectName: path.basename(cds.root) })
         await Promise.all([db, srv, app].map(p => mkdirp(p)))
-    }
 
+        // cds10: remove
+        // Delete .vscode folder if running in BAS
+        const { isBas } = readProject()
+        if (isBas) {
+            const vscodeFolder = join(cds.root, '.vscode')
+            await rimraf(vscodeFolder)
+        }
+    }
 }

package/lib/init/template/kyma/index.js

@@ -81,17 +81,17 @@ module.exports = class KymaTemplate extends require('../../plugin') {
   async combine() {
     // REVISIT: This must be moved to the respective plugins
     const {
-      addHana, addMultitenancy, addXsuaa,
-      addApprouter, addIas, addAms, hasXsuaa, hasMultitenancy,
-      addHtml5Repo, hasHtml5Repo,
+      addHana, addMultitenancy, addXsuaa, hasApprouter,
+      addApprouter, addIas, addAms, hasXsuaa, hasMultitenancy, addWorkzoneStandard,
+      addHtml5Repo, hasHtml5Repo
     } = readProject()
 
-    if (addHtml5Repo || addApprouter && hasHtml5Repo) {
+    if (addHtml5Repo || addWorkzoneStandard || addApprouter && hasHtml5Repo) {
       if (addHtml5Repo) {
         await KymaTemplate.mergeDependency('service-instance', 'html5-apps-repo-host')
         await KymaTemplate.mergeDependency('content-deployment', 'html5-apps-deployer')
       }
-      if (addApprouter) {
+      if (hasApprouter && hasHtml5Repo) {
         await KymaTemplate.mergeDependency('service-instance', 'html5-apps-repo-runtime')
       }
     }

package/lib/init/template/workzone-standard/files/mta.yaml.hbs

@@ -94,4 +94,3 @@ resources:
     type: org.cloudfoundry.managed-service
     parameters:
       service: xsuaa
-      service-plan: application

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.8.1",
+  "version": "9.8.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "9.8.1",
+      "version": "9.8.3",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -53,8 +53,8 @@
       }
     },
     "node_modules/@cap-js/openapi": {
-      "version": "1.3.1",
-      "integrity": "sha512-2QqqZlOxfvp/DDmGgTdwbBAAMjaPrrdPCbNC4+z6wjn2jXXk40j0XX7DHNnF4BU8R9LFxaUCHt2x8/9PzE83uA==",
+      "version": "1.4.0",
+      "integrity": "sha512-/LRSwn4SDxAi3qKwl09zoOhEVGaPGlYOPz/0S3UBnaMJVvaLyPiKbbaOtOnrrgulUX5OXt+ujPIQznOsbTzuAw==",
       "license": "Apache-2.0",
       "dependencies": {
         "pluralize": "^8.0.0"
@@ -103,8 +103,8 @@
       }
     },
     "node_modules/@sap/cds": {
-      "version": "9.8.2",
-      "integrity": "sha512-B85qUoUCVHN8gqHdD4nY+0LM1hEGGllEqWnMxsIBijBv3KXB4tOkf/krC8POieKZGMFRHylAcW1fAYVgbLqppw==",
+      "version": "9.8.4",
+      "integrity": "sha512-1cnFdz4Ex4LV15dztDsSLDiilVdJ2mfTqr5A3TGsRd/6cM31SnHhuZ/Ra0FEErodokNS2pwasGZmSfgHVDW8KA==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/cds-compiler": "^6.4",
@@ -151,8 +151,8 @@
       }
     },
     "node_modules/@sap/cds-mtxs": {
-      "version": "3.8.0",
-      "integrity": "sha512-8P/CKQbdbKH/1ZmgrRWiReXFb9MjLf/TjEH/MrbiJEGWCIv/bTKL6nNb0BIcBa7HQhekVqapa/cwx241NEnAVQ==",
+      "version": "3.8.1",
+      "integrity": "sha512-FUm1of08WsZ1O3eur7OGj7ZYp9Gy3RuYEGBZK+zosSPyJ3QrBhBzKwYvbh2DJdbv3P/xuk46NGg5yz914qZxrw==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/hdi-deploy": "^5"
@@ -265,13 +265,13 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.13.6",
-      "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==",
+      "version": "1.14.0",
+      "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.15.11",
         "form-data": "^4.0.5",
-        "proxy-from-env": "^1.1.0"
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/base64-js": {
@@ -295,8 +295,8 @@
       "optional": true
     },
     "node_modules/better-sqlite3": {
-      "version": "12.6.2",
-      "integrity": "sha512-8VYKM3MjCa9WcaSAI3hzwhmyHVlH8tiGFwf0RlTsZPWJ1I5MkzjiudCo4KC4DxOaL/53A5B1sI/IbldNFDbsKA==",
+      "version": "12.8.0",
+      "integrity": "sha512-RxD2Vd96sQDjQr20kdP+F+dK/1OUNiVOl200vKBZY8u0vTwysfolF6Hq+3ZK2+h8My9YvZhHsF+RSGZW2VYrPQ==",
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -893,8 +893,8 @@
       }
     },
     "node_modules/handlebars": {
-      "version": "4.7.8",
-      "integrity": "sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==",
+      "version": "4.7.9",
+      "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
       "license": "MIT",
       "dependencies": {
         "minimist": "^1.2.5",
@@ -1125,8 +1125,8 @@
       }
     },
     "node_modules/micromatch/node_modules/picomatch": {
-      "version": "2.3.1",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "version": "2.3.2",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
       "license": "MIT",
       "engines": {
         "node": ">=8.6"
@@ -1217,8 +1217,8 @@
       "license": "MIT"
     },
     "node_modules/node-abi": {
-      "version": "3.88.0",
-      "integrity": "sha512-At6b4UqIEVudaqPsXjmUO1r/N5BUr4yhDGs5PkBE8/oG5+TfLPhFechiskFsnT6Ql0VfUXbalUUCbfXxtj7K+w==",
+      "version": "3.89.0",
+      "integrity": "sha512-6u9UwL0HlAl21+agMN3YAMXcKByMqwGx+pq+P76vii5f7hTPtKDp08/H9py6DY+cfDw7kQNTGEj/rly3IgbNQA==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1278,8 +1278,8 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "8.3.0",
-      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+      "version": "8.4.1",
+      "integrity": "sha512-fvU78fIjZ+SBM9YwCknCvKOUKkLVqtWDVctl0s7xIqfmfb38t2TT4ZU2gHm+Z8xGwgW+QWEU3oQSAzIbo89Ggw==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -1334,9 +1334,12 @@
       }
     },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
+      "version": "2.1.0",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/pump": {
       "version": "3.0.4",
@@ -1454,8 +1457,8 @@
       "license": "MIT"
     },
     "node_modules/sax": {
-      "version": "1.5.0",
-      "integrity": "sha512-21IYA3Q5cQf089Z6tgaUTr7lDAyzoTPx5HRtbhsME8Udispad8dC/+sziTNugOEx54ilvatQ9YCzl4KQLPcRHA==",
+      "version": "1.6.0",
+      "integrity": "sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
@@ -1798,8 +1801,8 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.19.0",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.20.0",
+      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -1829,8 +1832,8 @@
       }
     },
     "node_modules/yaml": {
-      "version": "2.8.2",
-      "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
+      "version": "2.8.3",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.8.1",
+  "version": "9.8.3",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [