chore: cds5 upgrade and release prep#856
Merged
Merged
Conversation
![hyperspace-pr-bot[bot]](https://avatars.githubusercontent.com/u/2531208?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
The PR upgrades the stack to CDS 10 / Spring Boot 4.1 / Java 21 and adds a standalone MalwareScannerService demo. The changes are generally correct, but there are a few issues to address: the new MalwareScanRestHandler is missing the required SAP license header (which will fail the Spotless CI gate), file.getOriginalFilename() is reflected back in the response without sanitisation, and the IOException catch block incorrectly maps scanner-side I/O failures to HTTP 400. Additionally, the spring-boot-starter-webmvc-test artifact ID should be verified against the Spring Boot 4.1.0 BOM to avoid a dependency-resolution build failure.
PR Bot Information
Version: 1.27.6
- Event Trigger:
pull_request.opened - LLM:
anthropic--claude-4.6-sonnet - File Content Strategy: Full file content
- Agent Instructions:
- Correlation ID:
a2e32a90-7f6f-11f1-8ea6-67b428453d8f
The @cap-js/db-service and @cap-js/sqlite resolved URLs pointed at int.repositories.cloud.sap (SAP-internal Artifactory), which GitHub Actions runners cannot reach. Regenerated the lock file with an explicit --@cap-js:registry=https://registry.npmjs.org/ override so npm ci works in CI.
Add .mvn/maven.config with Aether HTTP retry settings so that transient 'Connection reset' errors from Maven Central (as seen in the SonarQube scan job on ci run 29328143776) don't fail the pipeline. The reuseConnections=false flag specifically mitigates the 'Connection reset' class of errors caused by server-side idle connection closure. Applied automatically to every mvn invocation without workflow changes.
lisajulia
requested changes
Jul 14, 2026
lisajulia
left a comment
lisajulia
left a comment
Contributor
There was a problem hiding this comment.
Thanks for the PR! I found some minor things only.
…tests profile
Now that every module's pom has a cds.npm-ci execution that installs
@sap/cds-dk locally from its package.json/package-lock.json, the two
global 'npm i -g @sap/cds-dk@10.0.4' steps in the pipeline are
redundant.
Also, the -P skip-integration-tests profile in the root pom did not
actually skip anything, because Maven profiles' <modules> section is
additive to the parent's, not replacing. The tests job was building all
9 modules including integration-tests-* and coverage-report on every
Java matrix cell (~2 min wasted per cell).
Changes:
- pipeline.yml tests job:
* Remove the 'Install @sap/cds-dk' step
* Change 'Run Tests' to use -pl <core-modules> -am instead of the
broken profile. Builds only the plugin + two storage targets.
- .github/actions/cf-bind/action.yml:
* Remove the 'Install @sap/cds-dk' step
* After 'npm ci' in integration-tests/mtx-local, push
./node_modules/.bin to GITHUB_PATH so subsequent cds bind calls find
the locally-installed cds CLI.
- pom.xml:
* Delete the dead skip-integration-tests profile.
package.json is now the single source of truth for the cds-dk version
across CI and every local build.
lisajulia
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrade to CDS5 / CAP Java 5 and Release 1.6.0
Chore
🔧 Bumps the project to CAP Java 5 (
cds.services.version→5.0.0),@sap/cds-dkv10, Spring Boot 4.1.0, and Java 21, and cuts the final1.6.0release. Alongside the dependency upgrades, the build is hardened to usenpm ci(instead ofnpm install), and all integration tests are migrated to the newspring-boot-webmvc-testsplit artifact introduced in Spring Boot 4.Changes
.gitignore: Added exceptions for the two newpackage-lock.jsonfiles so they are tracked in source control.pom.xml(root): Version bumped to1.6.0(was1.6.0-rc1), Java target raised to 21,cds.services.version→5.0.0,cds.cdsdk.version→10.0.4, minimum Maven version enforcer updated to3.9.14.cds-feature-attachments/package.json+package-lock.json: New localpackage.jsonthat pins@sap/cds-dk ^10for the cds-maven-plugin build, with a committed lock file for reproducible installs.cds-feature-attachments/pom.xml: Added acds.npm-ciexecution step that runsnpm cibefore the CDS build step.integration-tests/package.json+package-lock.json: Added@sap/cds-dk ^10dev dependency with a committed lock file.integration-tests/pom.xml: Spring Boot BOM version bumped to4.1.0.integration-tests/generic/pom.xml: Addedspring-boot-starter-webmvc-testtest dependency; addedcds.npm-ciMaven execution.integration-tests/mtx-local/package.json: Bumped@sap/cds-dk→^10,@sap/cds-mtxs→^4.integration-tests/mtx-local/mtx/sidecar/package.json: Bumped@sap/cds→^10,@sap/cds-mtxs→^4,express→^5.integration-tests/mtx-local/srv/pom.xml: Addedspring-boot-starter-webmvc-test; switchednpm install→npm ci; added clean step fornode_modules/com.sap.cds.DraftOdataRequestValidationBase,OdataRequestValidationBase,MultiTenantAttachmentIsolationTest,SubscribeAndUnsubscribeTest,ApplicationTest): Replacedorg.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvcwithorg.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvcto match the Spring Boot 4 package restructuring. Removed Spring-injectedObjectMapperbeans in favor of locally instantiated instances.samples/bookshop/pom.xml: Raisedjdk.versionto 21,cds.services.version→5.0.0, Spring Boot →4.1.0,cds-feature-attachments→1.6.0.samples/bookshop/srv/pom.xml: Addedspring-boot-starter-webmvc-testtest dependency.samples/bookshop/srv/…/MalwareScanRestHandler.java: New REST controller demonstrating the standaloneMalwareScannerServiceAPI (POST /api/v1/malware/scanandPOST /api/v1/malware/scan/upload).samples/bookshop/README.md: Added documentation section for the new standalone malware scanning endpoints, including local (no-binding) and BTP hybrid-mode usage examples.PR Bot Information
Version:
1.27.6pull_request.openedanthropic--claude-4.6-sonneta2e32a90-7f6f-11f1-8ea6-67b428453d8f