# Changelog 2026
:::info Open Source Changelogs
For repositories and plugins that are open source, please check out the respective changelogs in the [cap-js organization](https://github.com/cap-js) and the [CAP Community](https://github.com/cap-js-community).
:::
## September 2026
### Added {#sep-26-added}
- _[cds-dk@10.1.0]_ `cds add hana-serverless` sets up SAP HANA Cloud serverless as the database, provisioning one HDI container per tenant through the serverless Tenant API.
- _[cds-dk@10.1.0]_ `cds add ai` now supports a `--plan` option to set the AI Core service plan in `mta.yaml` (default: `standard`).
- _[cds-dk@10.1.0]_ `cds add data` now supports a `--keys-only` option that, together with `--records`, fills only key columns in the generated CSV files and leaves all other columns empty.
- _[cds-dk@10.1.0]_ `cds add data` now generates values for `Binary`/`LargeBinary` (base64) and `Vector` (JSON array) elements instead of leaving them empty.
- _[cds-dk@10.1.0]_ `cds add data` now supports a `--composition-records` option to control how many records are generated per to-many composition (default 2).
- _[cds-dk@10.1.0]_ `cds add` now accepts space-separated features in addition to comma-separated, e.g. `cds add xsuaa hana nodejs`.
- _[cds-dk@10.1.0]_ `cds add extensibility` now adds an `ExtensionDeveloper` role collection to `mta.yaml` (suffixed `${org}-${space}`) and `chart/values.yaml` (suffixed with the Kyma namespace), so it can be assigned immediately after deployment.
- _[cds-dk@10.1.0]_ `cds version` now also shows the npm version and executable path.
- _[vscode-cds@10.1.0]_ Formatting: new option `maxAlignmentWhitespace` to disable an alignment that would leave more than the configured number of blanks before any of its members, counting the mandatory separating blank
- _[vscode-cds@10.1.0]_ User setting to compile as many model files as possible in one compilation. To enable set `cds.workspace.compileFilesSeparately` to `false`.
This will **boost performance** for many larger models. In case `duplicate definition` diagnostics appear check
the files involved, and in case some files should not be picked up, add the glob patterns to `cds.workspace.additionalIgnorePatterns`
(as _workspace_ setting).
- _[cds.java@5.1.0]_ `$user.` references in `@restrict` annotations now also resolve attributes from `UserInfo.getAdditionalAttributes()` (e.g. JWT claims like `email`, `givenName`). Regular attributes take precedence over additional attributes.
- _[cds.java@5.1.0]_ Propagation of the XSUAA subdomain (based on the attribute `subDomain` from the `UserInfo`) is now configurable, as it's not required by CloudSDK, anymore. Set `cds.cloudsdk.propagateXsuaaSubdomain` to `false` to omit propagation. Default value is `true` to keep the previous behavior.
- _[cds.java@5.1.0]_ The `watch` goal of the `cds-maven-plugin` provides a new fast mode which can be enabled with property `-Dfast`.
- _[cds.java@5.1.0]_ The SPII integration (ie. `cds-feature-ucl`) now also supports updates of SPII integrations.
- _[cds.java@5.1.0]_ In development mode, OpenTelemetry request traces originating from CAP are logged as indented timing trees to the console with elapsed times, showcasing the same information published to Cloud Logging in production. The feature can be explicity disabled by setting `cds.telemetry.dev-output.enabled: false`.
- _[cds.java@5.1.0]_ Setting the logger group `com.sap.cds.telemetry` to `DEBUG` now enables all of CAP's OpenTelemetry spans.
- _[cds.java@5.1.0]_ Option `generateClasses` of the `generate` goal of `cds-maven-plugin` generates static implementations for event contexts and their inner interfaces.
- _[cds.java@5.1.0]_ Serveral goals of the `cds-maven-plugin` are thread-safe and can be executed in parallel, e.g. with Maven Daemon.
- _[cds.java@5.1.0]_ The query tool of the `cds-adapter-mcp` supports distinct in selects.
- _[cds.java@5.1.0]_ HCQL V2: Adapter and remote HCQL client support `$count` in the response.
- _[cds.java@5.1.0]_ Support OData v4.01 Json format for [Batch Requests and Responses](https://docs.oasis-open.org/odata/odata-json-format/v4.01/odata-json-format-v4.01.html#sec_BatchResponse)
- _[cds.java@5.1.0]_ Implicit sorting: search request without an explicit `orderby` are now automatically sorted by relevance.
- _[cds.java@5.1.0]_ Type handling in multitenant database credentials is now more robust.
- _[cds4j@5.1.0]_ The `CqnContainmentTest` now supports the new mode `LIKE` to filter values using an SQL LIKE pattern.
- _[cds4j@5.1.0]_ Method `Expand.excluding(...)` to exclude elements from an expand.
- _[cds4j@5.1.0]_ `UserContext` now supports a unified `Map` attribute map via `attributes(Map)` / `attribute(String)`, enabling custom user attributes (e.g. from JWT claims) to be resolved in managed aspects (`$user.`).
- _[cds4j@5.1.0]_ Added `$score` ref to get the score value of a fuzzy search result on the select list and in orderBy. (beta)
- _[cds4j@5.1.0]_ The default sort order of a hierarchy view is defined by `@cds.default.order`. If no annotation is present, the `order by` of the projection is used instead.
- _[cds@10.1.0]_ New `sqlite:memory` preset for `cds.requires.db` runs an in-memory SQLite database, now also in production
- _[cds@10.1.0]_ New `hana-serverless` kind for `cds.requires.db` connects to a HANA Cloud serverless instance (Beta)
- _[cds@10.1.0]_ Node.js-native `fetch` client now resolves named destinations through the SAP BTP Destination service for `NoAuthentication`, `BasicAuthentication`, and `OAuth2ClientCredentials` (proxy type `Internet` only) (beta)
- _[cds-mtxs@4.1.0]_ `cds.env.features.native_hdi_deploy` can now enable native HANA tenant deployment with delta uploads, bulk HDI inputs, and streaming for large artifacts.
### Changed {#sep-26-changed}
- _[cds-dk@10.1.0]_ `cds watch` now ignores the `.cds` folder by default, alongside the existing defaults like `node_modules` and `gen`. `.cds` model files and `.cdsrc.json` are unaffected.
- _[cds-dk@10.1.0]_ `cds compile -2 asyncapi` and `cds import --asyncapi` are now provided by `@cap-js/asyncapi` as a CDS plugin. The plugin is currently still bundled with `@sap/cds-dk`. Add it explicitly to your `devDependencies` as it will be removed in a future version.
- _[cds-dk@10.1.0]_ `cds build` now packages npm workspace dependencies as tarballs by default, use `--no-ws-pack` to disable.
- _[cds-dk@10.1.0]_ `cds completion` now comes with pre-calculated shell scripts for faster tab-completion. Also, it no longer disturbs shell completion in VS Code debug terminals.
- _[cds-dk@10.1.0]_ `cds add approuter` now uses `@sap/approuter@^23.0.0` instead of `@sap/approuter@^22.0.0`.
- _[vscode-cds@10.1.0]_ Minimum VSCode version is now 1.123.0
- _[cds.java@5.1.0]_ Don't read elements `DraftAdministrativeData_DraftUUID`, `HasActiveEntity` and `HasDraftEntity` during edit-draft action.
- _[cds.java@5.1.0]_ `cds-feature-ord` has moved to Open Source and is now versioned independently from CDS Services.
- _[cds4j@5.1.0]_ Reduced the memory footprint of bulk update/upsert element determination by avoiding intermediate `Stream` allocations when collecting the affected element paths.
- _[cds4j@5.1.0]_ Removed support for Mongo DB (internal, unreleased)
- _[cds4j@5.1.0]_ The `CQL.toUpper` and `.toLower` methods now accept a `CqnValue`.
- _[cds4j@5.1.0]_ Deprecated `UserContext.setAttributes(Map>)`, `getAttribute(String)`, and `getAttributes()` in favor of the new unified API.
- _[cds@10.1.0]_ `cds.spawn` uses dedicated, short-lived transaction for fetching extended models
- _[cds@10.1.0]_ Messaging webhook endpoints are no longer registered anonymously in production when neither `cds.requires.auth` nor `cds.requires.messaging.xsuaa` is configured.
- _[cds@10.1.0]_ UCL tenant mapping notification handlers will be scheduled as `tenant: receiverTenant` instead of anonymously
### Fixed {#sep-26-fixed}
- _[cds-dk@10.1.2]_ `cds` no longer crashes with an `ENOENT` (`uv_cwd`) stack trace when the shell's current directory has been deleted, for example, during tab-completion.
- _[cds-dk@10.1.2]_ `cds build --for java` no longer writes Node.js runtime messages.
- _[cds-dk@10.1.2]_ `cds build` preserves line breaks in merged `messages.properties` bundles.
- _[cds-dk@10.1.2]_ `cds add xsuaa` no longer generates an invalid `mta.yaml` when added after `workzone`.
- _[cds-dk@10.1.2]_ `cds add cloud-logging` now binds existing approuter and multitenancy modules when `mta` is added later.
- _[cds-dk@10.1.2]_ `cds add enterprise-messaging` and `cds add event-mesh` now contribute to an MTA descriptor added later.
- _[cds-dk@10.1.2]_ `cds add destination` now binds existing approuter and multitenancy modules when `mta` is added later.
- _[cds-dk@8.9.13]_ CVE-2025-15284: update `express` to fix vulnerability with `qs` <6.14.1
- _[cds-dk@10.1.0]_ `cds up` now forwards `BP_DEPENDENCY_MIRROR_*` variables to Paketo buildpacks.
- _[cds-dk@10.1.0]_ `cds add data` now generates values across the full `@assert.range` when the range lies outside the default `[0,100]`, instead of emitting the lower bound for every record (integers) or exceeding the upper bound (decimals).
- _[cds-dk@10.1.0]_ `cds add data` now generates varying `Time` values instead of the same fixed `22:59:53` for every record.
- _[cds-dk@10.1.0]_ `cds add data` now honors `@assert.range` on `Double` elements instead of generating values across the default `[0,100]` regardless of the annotation.
- _[cds-dk@10.1.0]_ `cds add data` now generates whole numbers for `Integer` elements whose `@assert.range` uses fractional bounds, instead of emitting fractional values.
- _[cds-dk@10.1.0]_ `cds add data` now generates varied values for `Decimal` elements whose scale equals their precision (such as `Decimal(2,2)`), instead of emitting `0` for every record.
- _[cds-dk@10.1.0]_ `cds add data` now honors `@assert.range` on `Timestamp` elements instead of always generating dates in the default `2000-2024` window.
- _[cds-dk@10.1.0]_ `cds add data` no longer crashes with `Invalid time value` when a `Date` element has a single-day `@assert.range`.
- _[cds-dk@10.1.0]_ `cds add data` now generates varied dates within `@assert.range` bounds on `Date`, `DateTime` and `Timestamp` elements when the range lies entirely outside the default `2000-2024` window, instead of emitting the same out-of-range value for every record.
- _[cds-dk@10.1.0]_ `cds add data` now honors open-interval and infinity `@assert.range` bounds (such as `[(0),_]` or `[(5),(10)]`) on numeric and date elements, instead of ignoring them and generating values across the default range.
- _[cds-dk@10.1.0]_ `cds add data` no longer includes excluded bounds when generating scaled decimals for open `@assert.range` intervals.
- _[cds-dk@10.1.0]_ `cds add data` now generates the exact day for `Date` elements regardless of the local timezone, instead of occasionally emitting the day before the intended date.
- _[cds-dk@10.1.0]_ `cds add data` now generates multiple distinct rows for link entities whose key consists of two or more associations, instead of collapsing them to a single row.
- _[cds-dk@10.1.0]_ `cds add data` now writes the foreign-key column for to-one compositions into the parent CSV, instead of leaving the parent unlinked to its generated child.
- _[cds-dk@10.1.0]_ `cds add data` now honors an `@assert.range` on an `array of` scalar element, so the generated array elements stay within the annotated bounds.
- _[cds-dk@10.1.0]_ `cds add data` now generates the requested number of distinct rows for a standalone link entity whose key associations point to entities created on demand, instead of collapsing them to a single row.
- _[cds-dk@10.1.0]_ `cds add data` now pairs two distinct target rows in a self-referential link entity (two key associations to the same entity), instead of pointing both foreign keys at the same row.
- _[cds-dk@10.1.0]_ `cds build --ws-pack` now also packs the workspace root package into a module's `gen/srv` when the module depends on it via a `file:` spec, so monorepos whose root package is itself a dependency no longer need to pack it by hand.
- _[cds-dk@10.1.0]_ `cds bind --to-app-services` no longer classifies a machine-to-machine `identity` binding that consumes another service (carrying `consumed-services`) as the application's user authentication, so it no longer overwrites the real `xsuaa` auth binding.
- _[cds-dk@10.1.0]_ `cds build` now copies the workspace root `package-lock.json` into a module's `gen/srv` when the module has none, so npm workspaces monorepo deployments get frozen dependencies instead of freshly resolved ranges.
- _[cds-dk@10.1.0]_ `cds build` now copies `.cdsrc.yaml` into the deployment output folder alongside `.cdsrc.json`, so YAML-based CDS configuration works correctly when deployed to Cloud Foundry.
- _[cds-dk@10.1.0]_ `cds import --from asyncapi` now correctly imports types referenced via `$ref` in AsyncAPI schemas, including `allOf` composition, and no longer loses types from earlier events when a service has multiple events.
- _[cds-dk@10.1.0]_ `cds build` now correctly resolves `manifest.json` for UI5 CLI v5 component projects, which use a `src/` folder instead of `webapp/`.
- _[cds-dk@10.1.0]_ `cds build --for fiori` now honors custom `resources.configuration.paths` mappings in `ui5.yaml` when locating a UI module's `manifest.json`.
- _[cds-dk@10.1.0]_ `cds add html5-repo`, `cds add workzone`, and `cds add portal` no longer emit an HTML5 application content deployer module into `mta.yaml` when the project has no UI apps, avoiding the `could not find the ".../gen/app" path` build failure.
- _[cds-dk@10.1.0]_ `cds up` now pushes buildpack images directly to the registry via `pack build --publish`, avoiding the `manifest invalid` error on containerd-backed Docker daemons.
- _[cds-dk@10.1.0]_ `cds add app-front` avoids duplicates for `srv-api` in `xs-app.json` if entries pre-exist.
- _[cds-dk@10.1.0]_ `cds add ias` (and `cds add ams`) with an approuter no longer leaves a stray `properties.name: srv-api` on the approuter's `srv-api` destination in `mta.yaml`, which uses certificate-based forwarding instead.
- _[cds-dk@10.1.0]_ `cds add sample` fixes cds files such that `const { Books } = cds.entities` works, i.e. the default namespace is set.
- _[cds-dk@8.9.13]_ CVE-2025-15284: update `express` to fix vulnerability with `qs` <6.14.1
- _[vscode-cds@10.1.0]_ Syntax highlighting for CQL strings now also works when there are spaces between `cds.ql` and the opening string. Having a newline between `cds.ql` and the opening backtick is still not supported.
- _[vscode-cds@10.1.0]_ Syntax highlighting: delimited and quoted identifiers in `using`, `namespace`, `context` and `extend`
- _[vscode-cds@10.1.0]_ Syntax highlighting: multiple `;`-separated elements or enum values on a single line
- _[vscode-cds@10.1.0]_ Syntax highlighting: first segment of a qualified type path (`Foo:bar`)
- _[cds-compiler@7.1.1]_ **effective:**
+ Fix dump in flattening for actions with entity parameters.
+ Ensure consistent handling of reference-like annotation expressions during flattening.
- _[cds-compiler@7.1.1]_ **sql:**
+ Add missing `@hierarchy` columns to localized convenience views.
+ Avoid crash on mixin backlink with renamed target element.
+ The generated SQL for a reference `assoc.elem` where `assoc` is an association defined with duplicate backlink comparisons with `$self` is now more likely
to be correct. Usually, there is an error for the definition of such an `assoc`, but the corresponding message can be downgraded to a warning.
- _[cds-compiler@6.9.5]_ **effective:**
+ Fix dump in flattening for actions with entity parameters.
+ Ensure consistent handling of reference-like annotation expressions during flattening.
- _[cds-compiler@6.9.5]_ **sql:** Add missing `@hierarchy` columns to localized convenience views.
- _[cds.java@5.1.1]_ Avoid CDS4j version with broken `cds4j-cql` artifact.
- _[cds.java@5.1.0]_ Fixed `ClassCastException` in `DraftScenarioAnalyzer` when a `WHERE` clause contains an `IN`-subquery predicate (e.g. `value.in(Select.from(...))`).
- _[cds.java@5.1.0]_ Fixed a bug in OData V4 returning 404 instead of 204, when following a valid navigation property that has a null value.
- _[cds.java@5.1.0]_ Code generated by the `generate` goal of the `cds-maven-plugin` with `generateClasses` set to `true` no longer triggers Java compiler warnings.
- _[cds.java@5.1.0]_ Fixed a bug causing a `DestinationAccessException´ when reading Service Manager bindings that were created with `X509_ATTESTED` (ie. zero trust).
- _[cds.java@5.1.0]_ Fixed a bug, causing unexpected removal of a tenant's DataSource from the cache, if HDI container deletion is skipped during unsubscribe.
- _[cds.java@5.1.0]_ Fixed a bug, causing missing draft messages, in case `cds.drafts.persistence` is set to `split`.
- _[cds.java@5.1.0]_ Fixed several bugs in the `generate` goal of the `cds-maven-plugin` when `interfacesForAspects` is enabled: builder interfaces used wrong types for aspect-derived entities, reverse associations targeting aspect members used wrong generated types, and inner interfaces of aspect-structured entities were generated incorrectly.
- _[cds.java@5.1.0]_ Fixed a bug causing a `NullPointerException` in OData v4 for the requests with `@bind:null` (v4.01) and `@odata.bind:null` (v4.0) (remove link to an association).
- _[cds.java@5.1.0]_ Fixed a bug causing OData v4 request with `$apply=filter()/...` to be rejected by filter restrictions check.
- _[cds.java@5.1.0]_ Fixed a bug causing OData v4 request with `GET /Entity(=val,...)` to be rejected by filter restrictions check.
- _[cds.java@5.1.0]_ Fixed a bug, causing HTTP status `500` (`Cannot find type with name: .cds_Map`) for OData JSON `$metadata` requests, if the CDS Model exposes dynamic `Map` elements.
- _[cds.java@5.1.0]_ Fixed a bug, causing HTTP status `400` for OData v4 bound action requests on entity set with no namespace on action: `POST /com.sap.Service/com.sap.Entity/boundAction`
- _[cds.java@5.1.0]_ Fixed a bug in xsuaa scope prefix validation
- _[cds.java@5.1.0]_ Requests rejected by Spring Security's `StrictHttpFirewall` (e.g. URLs with matrix parameters such as telemetry requests with UI5 > 1.148) no longer produce `401 WWW-Authenticate: Basic` responses triggering repeated browser Basic-Auth popups.
- _[cds.java@5.1.0]_ Fixed a bug causing incorrect statements when writing draft messages on entities with instance-based authorizations.
- _[cds.java@5.1.0]_ Fixed a bug in OData v4 producing an incorrect decimal values in serialized payload for requests with `$apply` and HTTP header `IEEE754compatible=true`.
- _[cds4j@5.1.0]_ In CQN, the `count`, `startswith`, `endswith`, `matchespattern` and `countdistinct` functions are now represented in lower case, for compatibility with HCQL.
- _[cds4j@5.1.0]_ Fixed a bug where type casts on refs to a `cds.Map` starting with a to-one association were ignored.
- _[cds4j@5.1.0]_ Fixed a statement execution order induced deadlock on concurrent deep updates/upserts on the same target entity.
- _[cds4j@5.1.0]_ Preserve update hints during statement normalization.
- _[cds4j@5.1.0]_ Fixed `CdsElementNotFoundException` with `cds.sql.toOnePath.mode: optimize` on refs using break-outs like `$self`.
- _[cds4j@5.1.0]_ Fixed loss of inline count of expand during projection resolution.
- _[cds4j@5.1.0]_ Fixed a deep update silently setting a composition child's non-key backlink foreign key to `null` when the child carried a nested association whose ON condition shares that backlink FK element and was `null` in the payload.
- _[cds4j@5.1.0]_ Fixed expressions in function arguments being constructed as generic xpr when being parsed.
- _[cds@10.1.1]_ Messaging consumers (Event Mesh AMQP, Kafka, Redis) no longer crash with `TypeError: Cannot use 'in' operator to search for 'data' in null` when a message with a `null` payload is received
- _[cds@10.1.1]_ `cds.env` now correctly replaces an array default with an object project override instead of assigning object properties onto the array
- _[cds@10.1.1]_ SQLite now uses its default pool config (single, non-evicting connection) even when `@cap-js/sqlite` is installed globally rather than as a local dependency
- _[cds@10.1.1]_ Stripping of `IsActiveEntity` in programmatic deep updates to draft instances
- _[cds@10.1.1]_ Server crash when string keys contain control characters in OData `Location` response header
- _[cds@10.1.1]_ Binary keys in OData `Location` response header are now formatted as binary literals (`binary'...'`)
- _[cds@10.1.1]_ Skip periodic message processing when no provider tenant is configured
- _[cds@10.1.1]_ The parent-readable check during CREATE/navigation no longer swallows system errors (for example, database failures); such errors are now propagated instead of being masked as a `404`
- _[cds@10.1.1]_ Support X.509 in `enterprise-messaging`'s deploy task
- _[cds@10.1.1]_ Incompatibility of global config `cds.sql.lock_acquire_timeout` and event-queue implementation
- _[cds@10.1.1]_ Outbox messages written before `appid` was introduced are now processed after an upgrade instead of being skipped
- _[cds@10.1.1]_ A queued outbox message whose target service can't be resolved is now dead-lettered instead of crashing the application
- _[cds@10.1.1]_ Recurring scheduled tasks (`.every()`) are no longer resurrected when unscheduled while running, and re-submitting one while it runs no longer discards the updated schedule and payload
- _[cds@10.1.0]_ `@assert` messages using `{i18n>...}` placeholders are no longer mistaken for structured `error(...)` results
- _[cds@10.1.0]_ JSON `$batch` requests now reject invalid `atomicityGroup` identifiers
- _[cds@10.1.0]_ Scheduling a task via `srv.schedule(...).after()` or `.every()` with a delay above Node's 32-bit `setTimeout` limit (~24.8 days, e.g. `.after('30d')`) no longer emits a `TimeoutOverflowWarning` or fires almost immediately. Such delays are now armed as chained timers, so the task still fires at its exact scheduled time.
- _[cds@10.1.0]_ OData requests with unknown key names in the key predicate (e.g. `Books(ID=1,sad=2)`) are now rejected with `400 Bad Request` instead of causing a `500` error
- _[cds@10.1.0]_ `cds-rc.js` schema now has a `$id` so `jsonschema` 1.5 resolves internal `$ref`s correctly
- _[cds@10.1.0]_ REST `HEAD` responses now report byte-accurate `Content-Length` headers for Unicode JSON payloads
- _[cds@10.1.0]_ Query properties like `limit` and `recurse` are no longer lost when forwarded to remote services
- _[cds@10.1.0]_ `cds.requires..service = ` (a required service naming itself) no longer fails with a spurious `conflicts with` error on server start
- _[cds@10.1.0]_ `UPDATE` and `DELETE` remote-service-queries, that use `.where` instead of a key to specify their subject, will throw
- _[cds@10.1.0]_ Navigating to or creating under a parent protected by an instance-based `@restrict.where` now returns `404` when the parent is not readable
- _[cds@10.1.0]_ A static `@restrict.where` on a collection-bound action is now enforced, rejecting callers who do not satisfy the condition — previously it was silently ignored
- _[cds-mtxs@4.1.0]_ `SmsProvisioningService` certificate check is now better aligned with the Java implementation.
- _[cds-mtxs@4.1.0]_ Extension validation checks have been refined.
- _[cds-mtxs@4.1.0]_ `POST /-/cds/model-provider/getEdmx` now checks the requested service name more exactly.
- _[cds-mtxs@4.1.0]_ Callback url for Saas Registry and Subscription Manager is now determined in a more robust way.
### Removed {#sep-26-removed}
- _[cds@10.1.0]_ UCL GraphQL interface adapter as dead code after UCL deprecated the GraphQL on-boarding flow
## August 2026
### Added {#aug-26-added}
- _[cds-compiler@7.1.0]_ **compiler:**
+ It is now possible to extend a view/projection with a `where` or `having` clause, even if it already had one.
Extensions are joined with `and` if such a clause already exists.
+ Publishing an association with an empty filter is now supported. For a managed association, this turns it
into an unmanaged one. For an unmanaged association, it has no effect.
+ `select one` is now supported in `parse.cql` and `parse.expr`.
+ Compiler adds helper property `$backlink` to CSN. It enables compiler backends and other CSN consumers
to better handle backlink comparisons with `$self`. This property may vanish in future releases.
- _[cds-compiler@7.1.0]_ **odata:**
+ Update OData vocabularies: Common and UI.
- _[cds-compiler@7.1.0]_ **sql:**
+ Wrap predicate columns in `CASE ... WHEN` for SAP HANA.
+ Support common `cds.Vector` functions on SAP HANA and Postgres.
- _[cds.java@4.9.3]_ `TenantProviderService` now supports the SaaS Registry/Subscription Manager API v2 for "Get All Subscriptions" endpoint. Use the property `cds.multiTenancy.useSaaSApiV2` to control the API version to use. Default is `false` to use existing v1 of the API.
- _[cds-mtxs@4.0.3]_ `cds-mtx subscribe`, `unsubscribe`, and `upgrade` now take more than one tenant at once, e.g. `cds-mtx upgrade t1 t2` or `cds-mtx upgrade t1,t2`.
### Changed {#aug-26-changed}
- _[cds-dk@10.0.8]_ `cds login` now uses the renamed login endpoints `/-/cds/login/grant` and `/-/cds/login/grant-metadata` with a legacy fallback, and updates saved legacy token URLs.
- _[cds-dk@10.0.7]_ `cds init --nodejs` creates a cleaned-up .gitignore file
- _[cds-dk@9.9.5]_ `cds login` now uses the renamed login endpoints `/-/cds/login/grant` and `/-/cds/login/grant-metadata` with a legacy fallback, and updates saved legacy token URLs.
- _[cds-compiler@7.1.0]_ **compiler:**
+ Issue a warning that a type with an unmanaged association can only be used as an include.
+ Omit empty extend for `extend … with definitions` from parsed CSN.
- _[cds-mtxs@4.0.3]_ Login endpoints renamed to `/-/cds/login/grant` and `/-/cds/login/grant-metadata` with redirects from former paths.
- _[cds-mtxs@4.0.2]_ When updating from `@sap/cds-mtxs@<3.6.0`, you now need to upgrade your tenant database before you can add new extensions.
### Fixed {#aug-26-fixed}
- _[cds-dk@10.0.7]_ Bundle `@sap/cds-mtxs` 4 again, instead of 3.
- _[cds-dk@10.0.7]_ `cds import --from asyncapi` now correctly imports types referenced via `$ref` in AsyncAPI schemas, including `allOf` composition, and no longer loses types from earlier events when a service has multiple events.
- _[cds-dk@10.0.7]_ `cds add html5-repo`, `cds add workzone`, and `cds add portal` no longer emit an HTML5 application content deployer module into `mta.yaml` when the project has no UI apps, avoiding the `could not find the ".../gen/app" path` build failure.
- _[cds-dk@10.0.7]_ `cds init --nodejs` creates the ESLint and VS Code config files again
- _[cds-compiler@7.1.0]_ **compiler:**
+ Properly render structures with property `...` in CDL.
+ Extending a `where`, `having` or `group by` clause from unrelated layers no longer results in an error.
A warning is emitted when extending an `order by` clause from unrelated layers.
- _[cds-compiler@7.1.0]_ **effective:**
+ Correctly rewrite references in annotation expressions inside arrays.
+ Add option to replace annotation expressions by strings to evade error situations.
- _[cds-compiler@7.1.0]_ **sql:**
+ Don't dump while reporting an error for `$self` in a filter of a `from` reference.
+ Correctly handle renamed target elements in backlink comparisons.
- _[cds.java@5.0.2]_ Fixed a bug causing a `NullPointerException` in case Service Manager bindings (for hdi containers) do not contain a field `database_id`.
- _[cds.java@4.9.4]_ Fixed a bug in xsuaa scope prefix validation
- _[cds.java@4.9.3]_ Fixed a bug causing a `NullPointerException` in OData v4 for the requests with `@bind:null` (v4.01) and `@odata.bind:null` (v4.0) (remove link to an association).
- _[cds@10.0.6]_ `$apply=filter(...)/groupby(...)/aggregate($count)` with non-UTC `DateTimeOffset` filter values now returns correct results on HANA
- _[cds@10.0.6]_ Generated index page now uses relative hrefs, fixing links when served behind an approuter with a path prefix
- _[cds@10.0.6]_ `$batch` sub-requests returned an empty body and headers when `@opentelemetry/instrumentation-express` (or any instrumentation that wraps Express handlers to arity 2) was active
- _[cds@10.0.6]_ `cds.xt.ModelProviderService` can be served in mtx sidecar
- _[cds@10.0.6]_ Modeled service events were not properly ignored in OData adapter
- _[cds@10.0.6]_ Generic handler for draft-specific actions not correctly being bound to the transaction context
- _[cds-mtxs@4.0.4]_ Version bump
- _[cds-mtxs@4.0.3]_ HANA credential health-check now detects the available driver via `require.resolve()` instead of reading `package.json`, fixing `MODULE_NOT_FOUND` for apps that follow the "Plug & Play" guidance and don't declare `hdb` or `@sap/hana-client` directly.
- _[cds-mtxs@4.0.3]_ Tenant upgrade now reports a clear per-tenant `422` error when a stored extension is incompatible with the changed base model, instead of aborting with an uncaught compilation error.
- _[cds-mtxs@4.0.3]_ `cds-mtx-migrate` now runs more robust with uncommon model configurations.
- _[cds-mtxs@4.0.2]_ `PUT /-/cds/extensibility/Extensions/` with a status that is not active (0 or 1), now returns the correct entry.
- _[cds-mtxs@4.0.2]_ Extensions table is now resolved properly again when `cds.sql.names = quoted` is set.
- _[cds-mtxs@3.9.6]_ Parallel single-tenant upgrades no longer fail with `tar: Cannot open: File exists` when extensibility is disabled.
- _[cds-mtxs@3.9.6]_ Deployment to tenant containers is more stable with a large number of service bindings provided via `VCAP_SERVICES_FILE_PATH`.
- _[cds-mtxs@3.9.6]_ More robust error handling for HDI deployment logs on read-only file system on Kyma.
- _[cds-mtxs@3.9.6]_ Configuration `cds.requires.multitenancy.retries` is now effective.
- _[cds-mtxs@3.9.6]_ Reading tenants no longer logs a spurious `Failed to parse metadata to JSON` error for tenants without metadata.
- _[cds-mtxs@3.9.6]_ A tenant's HANA connection pool now reliably recovers once valid credentials are restored, as cache-bypassing Service Manager lookups no longer overwrite the shared bindings cache with transiently invalid credentials.
- _[cds-mtxs@3.9.6]_ More robust handling of Service Manager errors.
## July 2026
### Added {#jul-26-added}
- _[cds-dk@10.0.6]_ `cds add xsuaa` now generates namespace-suffixed XSUAA `role-collections` for Kyma.
- _[vscode-cds@10.0.2]_ Syntax highlighting for CQL strings within the tagged template string following `cds.ql`.
- _[cds.java@5.0.1]_ `TenantProviderService` now supports the SaaS Registry/Subscription Manager API v2 for "Get All Subscriptions" endpoint. Use the property `cds.multiTenancy.useSaaSApiV2` to control the API version to use. Default is `false` to use existing v1 of the API.
### Changed {#jul-26-changed}
- _[cds-dk@10.0.6]_ `cds init` and `cds add` now detect app folders by the UI framework in their `package.json` (`@ui5/cli`, `react`, `vue`, `svelte`, `@angular/core`, `vite`) or a `webapp/manifest.json`, instead of matching against well-known folder names.
- _[cds-dk@10.0.6]_ `cds add approuter` now generates the approuter into `.deploy/app-router` by default instead of `app/router`, still respecting an existing `app/router` folder.
- _[cds-dk@10.0.6]_ `cds add html5-repo`, `cds add app-frontend`, and `cds add portal` now place the HTML5 application content deployer in `.deploy/html5-deployer` by default instead of `app/html5-deployer`, still respecting an existing `app/html5-deployer` folder.
- _[cds-dk@9.9.4]_ `cds init` uses Maven Java archetype version 4.9.1 for creating Java projects.
- _[cds-dk@9.9.4]_ Other dependency updates
- _[vscode-cds@10.0.2]_ Project Explorer now shows all configuration files including defaults.
- _[cds-mtxs@3.9.5]_ Calling endpoint `POST /-/cds/sms-provisioning/upgrade` now checks the correct permissions.
### Fixed {#jul-26-fixed}
- _[cds-dk@10.0.6]_ `cds add http` now respects capability restrictions, emitting only supported requests for `@Capabilities.*Restrictions: false`, `@odata.singleton`, and `@insertonly` entities.
- _[cds-dk@10.0.6]_ `cds add http` now generates requests for bound actions and functions on an instance, including draft-enabled entities (e.g. `POST .../E(ID=…,IsActiveEntity=true)/S.approve`), and `GET` requests for OData functions.
- _[cds-dk@10.0.6]_ `cds add http` now omits readonly, computed and managed fields (`@readonly`, `@Core.Computed`, `@cds.on.insert`/`@cds.on.update`) from `POST`/`PATCH` bodies, since clients cannot set them.
- _[cds-dk@10.0.6]_ `cds add http` now slugs `# @name` handles and suffixes collisions, so delimited names (`![a.b]`) and entities that slug alike (`A.sub` vs. `Asub`) yield valid, unique handles.
- _[cds-dk@10.0.6]_ `cds add http` now flattens nested composition entity-set names to underscores in URLs (e.g. `E_addr` instead of the unroutable `E.addr`).
- _[cds-dk@10.0.6]_ `cds add http` now includes all keys in composite-key draft requests instead of only the first, and single-quotes single string keys (e.g. `Books/'abc'`), matching composite string keys.
- _[cds-dk@10.0.6]_ `cds add http` now addresses parameterized entities as `Entity(p=…)/Set`, omitting the invalid `POST`/`PATCH`/`DELETE` requests it previously generated for them.
- _[cds-dk@10.0.6]_ `cds add http` no longer emits `PATCH`/`DELETE` requests with `undefined` or `[object Object]` in the URL for keys without a sample value, structured keys, or entities without a scalar key.
- _[cds-dk@10.0.6]_ `cds add http` no longer produces a double slash in request URLs for a service mounted at the root path (`@path: '/'`).
- _[cds-dk@10.0.6]_ `cds add http` and `cds add data` no longer crash with `Cannot convert undefined or null to object` for a keyless entity whose composition's `on` condition references `$self`.
- _[cds-dk@10.0.6]_ `cds add http` no longer throws `MULTIPLE_DOCS` when `application.yaml` uses `---` separators (Spring Boot multi-profile format).
- _[cds-dk@10.0.6]_ `cds export --data` now reads seed data via in-memory SQLite instead of the configured db driver, so it no longer fails in projects with `requires.db: hana` (e.g. CAP Java).
- _[cds-dk@10.0.6]_ `cds init --java --add mta` now writes `path: srv` for the Java `srv` module in `mta.yaml` instead of `gen/srv`, so `mbt build` no longer fails with `the "gen/srv" path of the "-srv" module does not exist`.
- _[cds-dk@10.0.6]_ `cds build --for nodejs --production` now also bundles _messages.properties_ files from plugins found via neighborhood resolution. `cds build --for java` retains the previous behaviour and does not use neighborhood resolution for plugin message files.
- _[cds-dk@10.0.6]_ `cds version` no longer reports dependency problems if no dependencies are installed at all. It prints an info message instead.
- _[cds-dk@10.0.6]_ `cds add test` creates tests that are green by default. Sample data is provided as commented code.
- _[cds-dk@10.0.5]_ `cds build --for hana` now declares the plugin for native HANA artifacts placed in the build output (e.g. a `.hdbprojectionview` from `db/src`) in the generated `.hdiconfig`.
- _[cds-dk@10.0.5]_ `cds add typer` now generates a `jsconfig.json` file that works with VS Code.
- _[cds-dk@10.0.5]_ `cds debug --force` on Kyma now preserves existing `NODE_OPTIONS` flags (e.g. `--max-old-space-size`) instead of overwriting them when enabling the inspector.
- _[cds-dk@10.0.5]_ `cds add sample` now selects `stock` in the Books list and object pages, so the overstock discount shows up in the UI.
- _[cds-dk@10.0.5]_ `cds add data` now generates correct foreign-key columns for nested compositions of aspects, e.g. `up__up__ID,up__ID,ID,name` instead of a broken `up__up_` header.
- _[cds-dk@10.0.5]_ `cds build` no longer fails with `npm ls -ws: unknown option` on npm 12, which dropped the short `-ws` flag.
- _[cds-dk@10.0.5]_ `cds build` now packages transitive npm workspace dependencies again on npm 12, which changed `npm pack --json` to emit an object keyed by package name instead of an array.
- _[cds-dk@10.0.5]_ `cds up` uses `helm --rollback-on-failure` instead of the deprecated `--atomic`.
- _[cds-dk@10.0.5]_ `cds add portal` on Java + IAS disables JWT proof-of-possession on `srv` (`SAP_SPRING_SECURITY_IDENTITY_PROOFTOKEN=false`) so Portal-proxied tile OData works.
- _[cds-dk@10.0.5]_ `cds add ias` forwards client certificates from the approuter to `srv-api` (`backendDestinations.srv-api.forwardAuthCertificates`).
- _[cds-dk@10.0.5]_ `cds add ias` always enables `xsuaa-cross-consumption` in the identity service parameters.
- _[cds-dk@10.0.5]_ `cds add ias` no longer sets an mTLS `expose.host` on the approuter, restoring a plain approuter host for the browser flow.
- _[cds-dk@10.0.5]_ `cds add portal` on Java multitenant now binds the Portal service instance to `srv` so CAP Java's `getDependencies` reports Portal to the SaaS Registry.
- _[cds-dk@10.0.5]_ `cds add kyma` uses a tenant-agnostic (tcpSocket) startup probe for the multitenant approuter, avoiding 400s from `TENANT_HOST_PATTERN` on kubelet probes.
- _[cds-dk@10.0.5]_ `cds add kyma` no longer emits the dead `Authentication: OAuth2UserTokenExchange` key on `backendDestinations.srv-api`.
- _[cds-dk@10.0.5]_ `cds add github-actions` uses updated versions.
- _[cds-dk@10.0.5]_ `cds watch` now works in ESM scenarios where only a global `cds-dk` is installed, where it would formerly fail with `ERR_MODULE_NOT_FOUND` for `@sap/cds`.
- _[cds-dk@10.0.5]_ `cds watch`no longer shows a `'server.hmr.protocol/host/port/path/clientPort/timeout/server' is deprecated` warning when running a Vite application.
- _[cds-dk@10.0.4]_ `cds watch` now starts apps with a SQLite database again in cases where they don't have a `@cap-js/sqlite` dependency or a `package.json`.
- _[cds-dk@10.0.3]_ `cds import` now wraps arrays-of-arrays in a `{ value: [...] }` struct when importing OpenAPI/Swagger specs, avoiding the OData `chained-array-of` compiler error.
- _[cds-dk@10.0.3]_ `cds version` now also prints versions of secondary packages likes `@sap/cds-compiler` and `@cap-js/db-service`.
- _[cds-dk@10.0.3]_ `cds build --production` no longer overrides collected message bundles with empty default bundles.
- _[eslint-plugin-cds@4.2.5]_ Fixed `TypeError: scopeManager.addGlobals is not a function`, preventing compatibility with ESLint 10.
- _[cds-compiler@7.0.3]_ **compiler:** When a backlink target is at least distantly related to the entity
embedding an association with a backlink comparison, the compiler issues a
warning ref-deprecated-backlink instead of reporting an error ref-invalid-backlink;
this is now also the case if the target entity is auto-exposed.
- _[cds-compiler@7.0.3]_ **sql:** Avoid dump in to.sql.migration with complex models.
- _[cds-compiler@7.0.2]_ **compiler:**
+ Avoid dump for a new association in a projection with backlink comparison while reporting a missing backlink target element.
+ Soften incompatibility concerning backlink comparisons: missing target elements which are referred to in the foreign keys or ON-condition of the backlink
association now only lead to a warning, not an error.
+ Soften incompatibility concerning structure values for annotations: a structure property like `list` won't be rejected; we avoid an ambiguity with an
_expression_ `(1, 2, 3)` by putting `'=': true` next to `list: …` in the CSN, like in compiler v6.
A `xpr` expression and an `#` enum symbol are rendered without a sibling `=`, though.
- _[cds-compiler@6.9.4]_ **effective:**
+ Correctly rewrite references in annotation expressions inside arrays.
+ Add option to replace annotation expressions by strings to evade error situations.
- _[cds4j@5.0.1]_ Fixed a bug in `ProjectionResolver` that caused an empty (`null` values) payload in expanded association, when using filter with path expressions.
- _[cds4j@5.0.1]_ The `count` is now represented in CQN in lower case, which allows for better compatibility with HCQL.
- _[cds4j@5.0.1]_ The inline count of an expand is now represented as `count: true` instead of `inlineCount: true`.
- _[cds@10.0.5]_ Messaging management requests to SAP Event Mesh or Event Mesh in SAP Integration Suite (EMIS) now always send a (possibly empty) body for `PUT`/`POST` requests, as required by EMIS (and compatible with SAP Event Mesh)
- _[cds@10.0.5]_ Only convert `@Common.Text` to `@cds.search` for service entities
- _[cds@10.0.4]_ Default language fallbacks for incomplete `i18n` bundles in Java projects
- _[cds@10.0.4]_ `srv.on/before('READ',...)` handlers registered with a cds-typer singular entity proxy were erroneously rewritten to event `each`
- _[cds@10.0.4]_ Asynchronous plugins (exporting a Promise) were not awaited in ESM projects
- _[cds@10.0.4]_ Fixed context propagation for local app and remote service calls
- _[cds@10.0.3]_ Suppress "connect to" log for internal scheduling service
- _[cds@9.9.3]_ Fixed context propagation for local app and remote service calls
## June 2026
### Added {#jun-26-added}
- _[cds-dk@10.0.1]_ `cds add event-mesh` and `cds add event-mesh-shared` set up configuration and deployment descriptors for Event Mesh of SAP Integration Suite.
- _[cds-dk@10.0.1]_ `cds upgrade` now detects Java/Spring Boot migration issues and integrates OpenRewrite for automated fixes via `--fix`.
- _[cds-dk@10.0.1]_ `cds upgrade --report` writes `report.md` and `report.yaml` to `.cds-upgrade/` for AI agent and human consumption.
- _[cds-dk@10.0.1]_ `cds upgrade` groups findings by capire section with links to the migration guide.
- _[cds-dk@10.0.0]_ `cds upgrade` analyzes project code and configuration for CDS 10 compatibility issues.
- _[cds-dk@10.0.0]_ `cds add react|vue` without `--into` scaffolds the Vite app directly into `app/`; `cds watch` mounts it at `/`.
- _[cds-dk@10.0.0]_ `cds add portal` uses the `sapse/application-content-deployer-buildpack` for Kyma to simplify HTML5 repo content and SAP BTP Portal service deployment.
- _[cds-dk@10.0.0]_ `cds add ai` adds out-of-the-box AI integration with `@cap-js/ai` via the SAP BTP AI Core service.
- _[cds-dk@10.0.0]_ `cds debug` warns about `http` health checks on Cloud Foundry that would kill the container while paused at a breakpoint.
- _[cds-compiler@7.0.1]_ **compiler:** Special property `$includeAfter` is put into a CSN of flavor `gensrc`/`xtended` to preserve the original
element order for entities and other structures with `includes` added via an `extend` statement.
- _[cds-compiler@7.0.1]_ **sql:** Default values from structures with a single element are propagated to the flattened leaf element.
- _[cds-compiler@7.0.1]_ **odata:** Default values from structures with a single element are propagated to the flattened leaf element.
- _[cds.java@5.0.0]_ The `add` goal of the `cds-maven-plugin` now generates a `pom.xml` for Maven modules exported via `cds export`.
- _[cds.java@5.0.0]_ The `generate` goal of the `cds-maven-plugin` has a new option `generateClasses` to generate static implementations for accessor interfaces.
- _[cds.java@5.0.0]_ The module `cds-services-code-generator` replaces `cds4j-codegen`.
- _[cds.java@5.0.0]_ Introduced `ContainerDeploymentService` in `cds-feature-mt` as Beta to support additional frameworks for schema evolution in non-sidecar scenarios.
- _[cds.java@5.0.0]_ Support "inline aggregate" expressions in OData v4, e.g. `$apply=aggregate(Sales(amount mul product/taxRate with sum as Tax))`
- _[cds.java@4.9.1]_ Support usage of custom functions in dynamic queries on SQLite with MT.
- _[cds.java@4.9.1]_ Remote OData v4 services now support `$count` in `$expand()`.
- _[cds.java@4.9.1]_ Logs for 401 errors in Remote OData services now include the value of the `www-authenticate` header, if available.
- _[cds.java@4.9.1]_ Support `onBehalfOf` configuration for IAS app-to-app destinations, allowing control over the authentication strategy (`currentUser`, `systemUser`, `systemUserProvider`) when calling remote APIs through destinations with `cloudsdk.ias-dependency-name`.
- _[cds.java@4.9.1]_ Added `cds.sql.search.localized` with option `view` as replacement for deprecated `cds.sql.search.mode`.
- _[cds4j@5.0.0]_ Extend `CQL.vector_embedding` to accept text as String.
- _[cds4j@5.0.0]_ Support type propagation for `cosineSimilarity` and `l2Distance`.
- _[cds4j@5.0.0]_ Support calculation of aggregates for hierarchies.
- _[cds4j@5.0.0]_ Support filters through to-one associations into `cds.Map` elements.
- _[cds4j@5.0.0]_ Method `CdsStructuredType.elements(Predicate filter)` to get a filtered stream of elements.
- _[cds4j@5.0.0]_ Emulate SAP HANA SCORE search-syntax on other databases.
- _[cds4j@5.0.0]_ SAP HANA:
+ improve search of UUIDs and fuzzy search in large strings.
+ allow fuzzy search in hierarchy queries.
- _[cds4j@5.0.0]_ Removed Beta from CdsJsonConverter
- _[cds4j@5.0.0]_ Improved performance of large deep insert statements
- _[cds@10.0.2]_ Event Queues: Support for 6-field cron (with seconds)
- _[cds@10.0.1]_ Support for SAP Integration Suite Event Mesh (EMIS) via messaging kinds `event-mesh` and `event-mesh-shared` (beta)
+ In contrast to SAP Event Mesh, multitenancy is out of scope!
- _[cds@10.0.0]_ New annotation `@cds.minify: false` allows to avoid minification of definitions that would otherwise be removed from the model. For example, that would happen to types which are not used anywhere in the model.
- _[cds@10.0.0]_ UCL: Support for integration update operations (`add`, `remove`, `modify`, `rotate`) for tenant mapping notifications.
- _[cds@10.0.0]_ UCL: Accept mTLS certificate from `x-forwarded-client-cert` (XFCC) header for Kubernetes/Istio/Envoy environments, in addition to the existing Cloud Foundry HAProxy headers.
- _[cds@10.0.0]_ Compatibility flag `cds.env.features.compat_srv_getters` (default: `false`) to opt into the deprecated function-call API for `srv.entities`, `srv.events`, `srv.types`, and `srv.actions`. This flag will be removed with cds^11.
- _[cds@10.0.0]_ Mark all CSN `val`s with `param: false`
- _[cds@10.0.0]_ For `CREATE`, `UPDATE`, `UPSERT`, and `DELETE` requests, the generic CRUD handler now consistently returns arrays carrying an `.affected` property with the number of affected rows (instead of `req.data`, or — for `DELETE` — the affected count itself).
+ Opt-out via `cds.env.features.legacy_srv_results: true`. This flag will be removed with cds^11.
- _[cds@10.0.0]_ `redis-messaging`: Support for credentials in GCP-based regions (adds private CA)
- _[cds-mtxs@3.9.4]_ `getCsn` now sets `meta.extended` to `true` or `false` on the returned CSN, indicating whether tenant extensions were applied. If `meta.extended` is set to `false`, the deployment is using the precompiled HANA artifacts instead of running another HANA build.
### Changed {#jun-26-changed}
- _[cds-dk@10.0.1]_ `@sap/cds-dk` now comes with `bundleDependencies` for reproducible installs. This is a replacement for the `npm-shrinkwrap.json` that is no longer supported by NPM 12 and higher.
- _[cds-dk@10.0.1]_ `cds init` no longer assumes `--nodejs` when running in SAP Business Application Studio.
- _[cds-dk@10.0.1]_ `cds init` no longer omits the `.vscode` folder when running in SAP Business Application Studio.
- _[cds-dk@10.0.1]_ `cds init/add --nodejs` now creates ESM projects by default. For CommonJS projects, use `cds init --add cjs`.
- _[cds-dk@10.0.1]_ `cds add data` no longer creates random strings for fields annotated with `@assert.format`.
- _[cds-dk@10.0.1]_ `cds add ias` does not use the `HTML5.` prefix for HTML5 repo settings.
- _[cds-dk@10.0.1]_ `cds add node` now adds a devDependency to `@cap-js/sqlite@^3`
- _[cds-dk@10.0.1]_ `cds upgrade` now produces concise CLI output (count + title per rule) and a structured report with capire-aligned sections.
- _[cds-dk@10.0.0]_ `cds add` and `cds build` create `engines` fields using caret dependencies of LTS Node.js versions, such as `^24`.
- _[cds-dk@10.0.0]_ `cds version` now always prints entries in a new formatting, even in Java projects and when running in BAS. For a stable output that can be parsed by scripts, use `--json`.
- _[cds-dk@10.0.0]_ `cds add hana` does not generate _db/undeploy.json_ any more.
- _[cds-dk@10.0.0]_ `cds build --for hana` generates _gen/db/undeploy.json_, merging an existing _db/undeploy.json_ if present.
- _[cds-compiler@7.0.1]_ **compiler:**
+ Messages reported by compiler backends for non-applied `annotate` statements now mention the original file location if that is unique.
+ The message IDs and texts for undefined references have been consolidated.
- _[cds-compiler@7.0.1]_ **odata:**
+ Non-spec compliant simple identifiers in OData V2 now lead to a warning.
+ Avoid duplicate or incorrect warnings for value help shortcut.
- _[cds-compiler@7.0.1]_ **sql:**
+ Performance of the SQL backend has been improved: wildcard `*` in views and projections is only expanded lazily.
+ No errors are reported anymore for non-persisted entities, as they are irrelevant for database deployment
(for the message IDs `type-missing-argument`, `type-unexpected-argument`, `ref-unsupported-type`, and `ref-unexpected-args`).
- _[cds.java@5.0.0]_ The minimum required JDK for CAP Java is 21.
- _[cds.java@5.0.0]_ The OpenRewrite recipes in `cds-services-recipes` now use the consolidated package namespace `com.sap.cds.services.migrations` for all recipe names and Java classes (previously mixed between `.recipes` and `.migrations`).
- _[cds.java@5.0.0]_ Renamed `cds.mcp.autoConfig` to `cds.mcp.autoWired`.
- _[cds.java@5.0.0]_ Renamed `cds.taskScheduler.enabled` to `cds.outbox.persistent.scheduler.enabled`.
- _[cds.java@5.0.0]_ Removed deprecated properties `eventContext` and `cqnService` from goal `generate` of the `cds-maven-plugin`.
- _[cds.java@5.0.0]_ The properties `cds.outbox.inMemory.enabled` and `cds.outbox.inMemory.emitDuringChangeSetContext` have been deprecated.
- _[cds.java@5.0.0]_ ~~The default search mode for OData V2 and V4 has been changed to `pass-through`. To restore the old behavior, set `cds.odataV2.search.mode` and `cds.odataV4.search.mode` to `odata-lenient`.~~
- _[cds.java@5.0.0]_ The default value for property `cds.errors.preferServiceException` has been changed from `false` to `true`.
- _[cds.java@5.0.0]_ The default value for property `cds.multiTenancy.serviceManager.cacheRefreshInterval` has been changed from `20` to `60` minutes.
- _[cds.java@5.0.0]_ ~~The number of max requests in a OData V2 batch request has been limited to `10`. To restore the old behavior, set `cds.odataV2.batch.maxRequest` to `-1`.~~
- _[cds.java@5.0.0]_ The default value for property `cds.persistence.changeSet.enforceTransactional` has been changed from `true` to `false`.
- _[cds.java@5.0.0]_ Outboxes for services are now by default unordered. To restore the old behavior, set `cds.outbox.services..ordered` to `true`.
- _[cds.java@5.0.0]_ The default value for property `cds.query.restrictions.enabled` has been changed from `false` to `true`.
- _[cds.java@5.0.0]_ The default value for property `cds.query.deep-entity-readonly.enabled` has been changed from `false` to `true`.
- _[cds.java@5.0.0]_ The default value for property `cds.sql.toOnePath.mode` has been changed from `always-join` to `optimize`.
- _[cds.java@5.0.0]_ The default value for property `cds.sql.hana.search.fuzzy` has been changed from `false` to `true`.
- _[cds.java@5.0.0]_ The deprecated property `cds.sql.hana.optimizationMode` has been removed.
- _[cds.java@5.0.0]_ Removed deprecated `Exits` classes from `cds-feature-mt`.
- _[cds.java@5.0.0]_ Changed default JDK in `cds-services-archetype` for new CAP Java projects to JDK 25.
- _[cds.java@5.0.0]_ Removed deprecated goal `install-cdsdk` from `cds-maven-plugin`.
- _[cds.java@5.0.0]_ The default authentication mode is now model-relaxed for local development. In production environments, the secure-by-default behavior is preserved by automatically applying model-strict.
- _[cds.java@5.0.0]_ Changed the default Node.js version in the `cds-maven-plugin` to current LTS 24.x.
- _[cds.java@5.0.0]_ Bumped minimum required Maven version of the `cds-maven-plugin` to 3.9.10.
- _[cds.java@5.0.0]_ Removed Maven modules `repackaged/odata-v2-lib` and `repackaged/odata-v4-lib`.
- _[cds.java@5.0.0]_ OData v2: log forbidden char in DEBUG level.
- _[cds.java@5.0.0]_ Removed `cds.odataV2.searchMode` and `cds.odataV4.searchMode` and introduced `cds.sql.search.syntax` with options `HANA` (default) and `ODATA`.
- _[cds.java@5.0.0]_ Removed `cds.sql.search.mode` and introduced `cds.sql.search.localized` with option `view`; `generic` mode is not supported anymore.
- _[cds4j@5.0.0]_ Removed support for SAP HANA JSON Document Store.
- _[cds4j@5.0.0]_ Removed modules `cds4j-codegen` and `cds4j-maven-plugin`.
- _[cds4j@5.0.0]_ Removed support for search via the `CONTAINS` function in HANA legacy mode.
- _[cds4j@5.0.0]_ Values contained in an annotation with expression value are now treated as constants.
- _[cds4j@5.0.0]_ Removed config option `cds.sql.collate`. Collation now always applies to all string elements (previously the `"localized-strings"` value restricted collation to localized elements only).
- _[cds4j@5.0.0]_ Removed deprecated `exists(Select subQuery)` method from `Modifier`.
- _[cds4j@5.0.0]_ Removed deprecated `isAbstract` method in `CdsEntity`.
- _[cds4j@5.0.0]_ Removed deprecated `CqnPassThroughSearchPredicate`, instead use `CqnSearchStringPredicate`.
- _[cds4j@5.0.0]_ Removed higher auto-weighting of key element in fuzzy search.
- _[cds4j@5.0.0]_ Removed `CqnTransformation.getKind()` and the `CqnTransformation.Kind` enum (beta)
- _[cds4j@5.0.0]_ Replaced config option `cds.sql.search.mode: localized-view` with `cds.sql.search.localized: view`; `generic` mode is not supported anymore.
- _[cds@10.0.0]_ Node.js 22 is now the minimum required Node.js version. Version 20 is no longer supported.
- _[cds@10.0.0]_ `cds.features.compat_texts_entities` is changed to _false_ and will be removed in an upcoming version.
- _[cds@10.0.0]_ `cds.features.ieee754compatible` is changed to _true_ to return strings for Decimal/Int64 for all db services.
- _[cds@10.0.0]_ `cds.i18n.fatjson` is changed to _false_ and will be removed in an upcoming version.
- _[cds@10.0.0]_ Advanced Event Queue Scheduling via Scheduling Service on by default (if both `db` and `queue` are available)
- _[cds@10.0.0]_ `cds.fiori.direct_crud` is split into the two feature flags `cds.fiori.bypass_draft` and `cds.fiori.draft_new_action`
+ `cds.fiori.bypass_draft` allows the modification of active instances. It is now enabled by default
+ `cds.fiori.draft_new_action` introduces the `draftNew` action to create new drafts. It is still disabled by default (as before)
- _[cds@10.0.0]_ REST adapter: bulk `POST` of multiple entries is now dispatched as a single `INSERT` instead of one dispatch per entry.
+ Set `cds.env.features.bulk_inserts_via_rest: false` to revert to the legacy per-entry dispatch. This flag will be removed with cds^11.
- _[cds@10.0.0]_ `req.query` is deprecated for bound actions/ functions and will be removed in cds^11. Use `req.subject` instead.
- _[cds@10.0.0]_ Generic Handlers: Static `handle_*` methods that registered preflight handlers were replaced by non-static `handle_*` functions that are called before `handle`
+ Fully backwards-compatible: In case of a custom static `handle_*` method that overrides a built-in one, the respective `handle_*` function is not called
- _[cds@10.0.0]_ Updated default configuration for `persistent-queue`:
+ `legacyLocking` default changed from `true` to `false`
+ `maxAttempts` default reduced from `20` to `10`
+ `storeLastError` option removed (now always `true` implicitly)
- _[cds@10.0.0]_ Protocol adapters are now real classes, The `.router` contains now the protocol router (previously it was returned from the constructor itself).
- _[cds@10.0.0]_ `cds.validate` now return the error code in `.code` instead of `.message`.
- _[cds@10.0.0]_ Errors are now logged in default language instead of the plain developer texts.
- _[cds@10.0.0]_ OData parser accepts `/^[0-9a-z-]{1,36}$/i` as UUID
- _[cds@10.0.0]_ Flows: `@from` is checked in parallel to any other before handler
- _[cds@10.0.0]_ RemoteService: Clearing keys from payload (`req.data`) is now done in generic `on` handler instead of an extra `before` handler
- _[cds@10.0.0]_ Undocumented `srv.reject(event, path)` registers a standard `before` handler
- _[cds@10.0.0]_ **[internal]** Refactored core service implementation (`srv-dispatch`, `srv-handlers`, `cds.Service`) for improved code clarity and maintainability
- _[cds-mtxs@4.0.1]_ Migration from `@sap/cds-mtx` has been removed.
- _[cds-mtxs@4.0.1]_ Calling endpoint `POST /-/cds/sms-provisioning/upgrade` now requires more permissions.
- _[cds-mtxs@4.0.1]_ Annotation `@Common.FieldControl` is now also blocked for extensions.
- _[cds-mtxs@4.0.1]_ Annotations `@Capabilities.*` are now also blocked for extensions.
- _[cds-mtxs@4.0.1]_ The MTX sidecar now logs a warning if `cds.sql` is configured differently in both the project root and the sidecar. By setting `cds.env.requires['cds.xt.ModelProviderService']['use-root-sql-config'] === true`,
you can enforce the configuration of the project root.
- _[cds-mtxs@3.9.4]_ In case of multiple instances on Cloud Foundry, the initial creation of the `t0` tenant is only done by instance 0.
- _[cds-mtxs@3.9.4]_ Service Broker errors are logged with more detailed descriptions in the Service Manager client.
### Fixed {#jun-26-fixed}
- _[cds-dk@10.0.1]_ `cds subscribe`, `cds unsubscribe`, and `cds upgrade` default to mock credentials on localhost, removing the need for explicit `-u user:password`.
- _[cds-dk@10.0.1]_ `cds bind` will throw an error when `--to` is specified without providing a path.
- _[cds-dk@10.0.1]_ `cds build --for hana` now correctly relocates generated _.hdbsynonymconfig_ files containing `*.configure` properties (e.g. `schema.configure`).
- _[cds-dk@10.0.1]_ `cds add html5-repo` and `cds add app-frontend` detect UI5 modules per app via each app's `@ui5/cli` devDependency, instead of relying on a project-wide flag.
- _[cds-dk@10.0.1]_ Removed undocumented `dp-cli` data product import method. Use `dp-metadata` repository import or direct JSON file import instead.
- _[cds-dk@10.0.1]_ `cds add html5-repo`, `cds add app-frontend`, and `cds add typescript` now add `ui5-tooling-transpile-task` to existing `ui5.yaml` for TypeScript projects.
- _[cds-dk@10.0.1]_ `cds version` no longer fails if `@sap/cds` < 9.8 is installed.
- _[cds-dk@10.0.1]_ `cds build` no longer fails with `EEXIST` when the MTX sidecar has its own `.npmrc`, and dereferences symlinks during copy so `gen/` is self-contained and portable.
- _[cds-dk@10.0.1]_ `cds upgrade` no longer fails when ast-grep exits with non-zero on certain file patterns.
- _[cds-dk@10.0.1]_ Removed undocumented `dp-cli` data product import method. Use `dp-metadata` repository import or direct JSON file import instead.
- _[cds-dk@10.0.1]_ `cds import` for OData v2 now can import annotations.
- _[cds-dk@10.0.1]_ `cds lint` no longer silently swallows any error.
- _[cds-dk@10.0.0]_ `cds bind` now correctly handles CF org, space, and service instance names containing commas.
- _[cds-dk@10.0.0]_ `cds up` deploys to Kyma with `helm --atomic`, so failed deployments no longer block the next run.
- _[cds-dk@10.0.0]_ `cds add vue` uses correct placeholder values for book and author in `App.vue`.
- _[cds-dk@10.0.0]_ `cds build --production` now also bundles _message.properties_ files from plugins.
- _[cds-dk@10.0.0]_ `cds push` provides support for CAP plugins.
- _[cds-dk@10.0.0]_ `cds add dynatrace` in combination with `nodejs` makes sure the `nodejs` MTA changes are correctly applied.
- _[cds-dk@10.0.0]_ The `NO_COLOR` environment variable also accepts values other than `true`.
- _[cds-dk@9.9.3]_ `cds import` for OData v2 now can import annotations.
- _[cds-dk@9.9.3]_ `cds watch` on Windows no longer restarts the server for read-only file opens (antivirus, Windows Search indexer, TypeScript loaders like tsx). A mtime guard now confirms a file was actually written before emitting a `change` event.
- _[cds-dk@8.9.13]_ CVE-2025-15284: update `express` to fix vulnerability with `qs` <6.14.1
- _[eslint-plugin-cds@4.2.4]_ `auth-valid-restrict-grant` no longer crashes on JOINs with three or more tables.
- _[cds-compiler@7.0.1]_ **sql:**
+ An error is reported for subqueries that select only virtual elements. This avoids late errors during database deployment.
+ Parameter references in nested inlines are now handled correctly.
- _[cds-compiler@6.9.3]_ **api:** New compiler option `noErrorForUnknownAnnotateTarget` downgrades errors to warnings
for `annotate` statements with security-relevant annotations (`@restrict`, `@requires`, `@ams`)
whose target does not exist.
- _[cds.java@5.0.0]_ OData error targets that reference a plain composition name (e.g. `values/amount`) are now automatically rewritten to the service-layer infix-filter alias (e.g. `initialSlice/amount`), so that Fiori clients can correctly resolve the target path for inline error highlighting.
- _[cds.java@5.0.0]_ SELECT from SELECT queries (subqueries in the FROM clause) no longer fail when columns of inner queries are aliased and used in the outer subquery.
- _[cds.java@4.9.1]_ Content-Disposition headers now use RFC 5987 `filename*` encoding for non-ASCII filenames, ensuring correct display in browsers for files with special characters.
- _[cds.java@4.9.1]_ Empty `If-Match` and `If-None-Match` headers are now treated as invalid and rejected with `421` error code.
- _[cds.java@4.9.1]_ Enhanced resiliency to `cds-feature-kafka` when registering a consumer group ID and topic registration.
- _[cds4j@5.0.0]_ Fixed a bug in `groupBy` transformation for `@odata.draft.enabled` entity, causing a `ClassCastException`, when `IsActiveEntity` or `HasActiveEntity` are used as groups.
- _[cds4j@5.0.0]_ Decimal retrieved from SQLite are truncated to adhere to the declared scale.
- _[cds4j@5.0.0]_ Fixed a bug in optimized to-one expands where `null` values in nested rows were not included in results.
- _[cds@10.0.2]_ `cds.env` omits default values from plugins if requested
- _[cds@10.0.2]_ `$filter=