@sap/cli-core 2026.4.0 → 2026.6.0

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 2026.5.0
+
+### Added
+
+- Added `--force` option to the `login` command to skip the confirmation prompt when overwriting existing secrets. This is useful when running the CLI programmatically or in scripts.
+
+### Fixed
+
+- Fixed config state leakage between commands when using `getCommands()` programmatically. Previously, `config.data` and `config.headers` from one command (e.g., file content from `--file` option) would persist and leak into subsequent commands, causing incorrect request payloads.
+
 ## 2026.3.0
 
 ### Fixed

package/commands/handler/parseArguments.js

@@ -1,10 +1,22 @@
 import { kebabCase } from "lodash-es";
-import { set as setConfig } from "../../config/index.js";
+import { get as getConfig, set as setConfig } from "../../config/index.js";
 import { getBooleanOption, parseOption } from "./utils.js";
 import { OPTION_TLS_VERSION, OPTION_VERBOSE } from "../../constants.js";
 import { get as getLogger } from "../../logger/index.js";
+/**
+ * Clears command-specific config properties that should not persist between commands.
+ * This prevents data from one command (e.g., file content from --file option) from
+ * leaking into subsequent commands when using getCommands() programmatically.
+ */
+const clearCommandSpecificConfig = () => {
+    const config = getConfig();
+    delete config.data;
+    delete config.headers;
+};
 export const create = (handlerArgs) => async () => async (...args) => {
     const { debug } = getLogger("commands.handler.parseArguments");
+    // Clear command-specific config from previous commands to prevent state leakage
+    clearCommandSpecificConfig();
     const command = args[args.length - 1].name();
     const options = Object.entries(args[args.length - 2])
         .map((o) => [o[0], parseOption(o[1])])

package/commands/login.command.js

@@ -1,6 +1,7 @@
 import { SecretsStorageSingleton } from "../cache/secrets/SecretsStorageSingleton.js";
 import { getTenantUrl } from "../cache/secrets/utils.js";
-import { OPTION_ACCESS_TOKEN, OPTION_AUTHORIZATION_FLOW, OPTION_AUTHORIZATION_URL, OPTION_BROWSER, OPTION_CLIENT_ID, OPTION_CLIENT_SECRET, OPTION_CODE, OPTION_HOST, OPTION_OPTIONS_FILE, OPTION_REFRESH_TOKEN, OPTION_SECRETS_FILE, OPTION_TLS_VERSION, OPTION_TOKEN_URL, OPTION_VERBOSE, ROOT_COMMAND, } from "../constants.js";
+import { get as getConfig } from "../config/index.js";
+import { OPTION_ACCESS_TOKEN, OPTION_AUTHORIZATION_FLOW, OPTION_AUTHORIZATION_URL, OPTION_BROWSER, OPTION_CLIENT_ID, OPTION_CLIENT_SECRET, OPTION_CODE, OPTION_FORCE, OPTION_HOST, OPTION_OPTIONS_FILE, OPTION_REFRESH_TOKEN, OPTION_SECRETS_FILE, OPTION_TLS_VERSION, OPTION_TOKEN_URL, OPTION_VERBOSE, ROOT_COMMAND, } from "../constants.js";
 import { get } from "../logger/index.js";
 import { logVerbose } from "../logger/utils.js";
 import { getDefaultBrowser, getSupportedBrowsers } from "../utils/openUtils.js";
@@ -22,7 +23,15 @@ export const verifyHost = async () => async () => {
         throw new Error("tenant URL not defined. use option -H, --host");
     }
 };
+const isForceOptionSet = () => {
+    const config = getConfig();
+    return config.options?.[OPTION_FORCE.longName] === true;
+};
 const confirmSecretsOverwrite = async (tenantUrl) => {
+    // Skip prompt if --force option is set
+    if (isForceOptionSet()) {
+        return true;
+    }
     const promptResponse = await promptForValue({
         prompts: {
             type: "confirm",
@@ -100,6 +109,10 @@ const loginCommand = {
             default: getDefaultBrowser,
         },
         { ...OPTION_AUTHORIZATION_FLOW, hidden: false },
+        {
+            ...OPTION_FORCE,
+            description: "skip confirmation prompt when overwriting existing secrets",
+        },
     ]), createMandatoryOptionsHandler(), verifyHost, createOrHandler("commands.login", warnIfSecretExistsInCache, createNextHandler("commands.login", createOauthHandler(), initializeCache, saveSecrets))),
 };
 export default loginCommand;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cli-core",
-  "version": "2026.4.0",
+  "version": "2026.6.0",
   "description": "Command-Line Interface (CLI) Core Module",
   "license": "SEE LICENSE IN LICENSE",
   "author": "SAP SE",
@@ -18,12 +18,12 @@
     "cli-core"
   ],
   "dependencies": {
-    "ajv": "8.17.1",
-    "axios": "1.13.3",
-    "commander": "14.0.2",
+    "ajv": "8.18.0",
+    "axios": "1.13.5",
+    "commander": "14.0.3",
     "compare-versions": "6.1.1",
-    "config": "4.2.0",
-    "dotenv": "17.2.3",
+    "config": "4.3.0",
+    "dotenv": "17.3.1",
     "form-data": "4.0.5",
     "fs-extra": "11.3.3",
     "https-proxy-agent": "7.0.6",
@@ -32,6 +32,6 @@
     "open": "11.0.0",
     "path": "0.12.7",
     "prompts": "2.4.2",
-    "qs": "6.14.1"
+    "qs": "6.15.0"
   }
 }