build(deps): bump the sap group with 4 updates

[dependabot]

Bumps the sap group with 4 updates: @sap/cds, @cap-js/cds-typer, @cap-js/cds-types and @sap/eslint-plugin-cds.

Updates @sap/cds from 10.0.3 to 10.0.6

Updates @cap-js/cds-typer from 0.40.0 to 0.41.0

Release notes

Sourced from @​cap-js/cds-typer's releases.

v0.41.0

Added

Changed

Deprecated

Removed

Fixed

• properly handle .texts properties in combination with compat_texts_entities=false (default in cds10) during runtime.
• emit correct import and namespace-qualified type reference for inline enum companion types when the parent type is defined in a different namespace.

Security

v0.40.2

Added

Changed

Deprecated

Removed

Fixed

• emit kind property on events as static member to be properly consumed by cds-types.
• do not cut off leading namespaces from top-level events, but only leading service names from events nested therein.

Security

v0.40.1

Added

Changed

Deprecated

Removed

Fixed

• Events with dotted names (e.g. service S { event X.Y : {...} }) now generate a properly namespaced class namespace X { class Y } instead of producing duplicate top-level identifiers.
• Event names now use the service-relative name (e.g. 'X.Y' without preceeding S), matching the name the CDS runtime uses when registering and emitting such events.
• Entity elements of named struct types used within CDS aspects are now correctly flattened when using --inlineDeclarations flat.

Security

Changelog

Sourced from @​cap-js/cds-typer's changelog.

[0.41.0] - 2026-08-24

Added

Changed

Deprecated

Removed

Fixed

• properly handle .texts properties in combination with compat_texts_entities=false (default in cds10) during runtime.
• emit correct import and namespace-qualified type reference for inline enum companion types when the parent type is defined in a different namespace.

Security

[0.40.2] - 2026-07-27

Added

Changed

Deprecated

Removed

Fixed

• emit kind property on events as static member to be properly consumed by cds-types.
• do not cut off leading namespaces from top-level events, but only leading service names from events nested therein.

Security

[0.40.1] - 2026-07-21

Added

Changed

Deprecated

Removed

Fixed

• Events with dotted names (e.g. service S { event X.Y : {...} }) now generate a properly namespaced class namespace X { class Y } instead of producing duplicate top-level identifiers.
• Event names now use the service-relative name (e.g. 'X.Y' without preceeding S), matching the name the CDS runtime uses when registering and emitting such events.
• Entity elements of named struct types used within CDS aspects are now correctly flattened when using --inlineDeclarations flat.

Security

Commits

• 0058128 chore(version): minor version 0.41.0 (#652)
• 507c078 chore(deps-dev): Bump the development-dependencies group across 1 directory w...
• a7f1a20 chore(deps-dev): Bump brace-expansion from 5.0.7 to 5.0.9 (#649)
• c57d86a feat: Allow using remote inline enums (#651)
• 7b97c3f fix: Adjust boilerplate for cds10 defaults (#647)
• 576031b chore(version): patch version 0.40.2 (#644)
• b302d4a fix: Do not cut namespaces from top-level events (#643)
• 017bed4 fix: Static event kind (#641)
• b6600af chore(deps-dev): Bump brace-expansion from 5.0.6 to 5.0.7 (#638)
• 10a0983 chore(version): patch version 0.40.1 (#637)
• Additional commits viewable in compare view

Updates @cap-js/cds-types from 0.18.0 to 0.19.0

Release notes

Sourced from @​cap-js/cds-types's releases.

v0.19.0

Added

• Added types for req.req and req.res in cds.Request
• cds.User now has an authInfo property typed against @sap/xssec's SecurityContext. @sap/xssec is an peer dependency.
• cds.ql is now typed as a callable universal converter: tagged template, function accepting a CQN object, or plain string — all returning SELECT<unknown>
• CXL helper functions (ref, val, expr, columns, expand, where, orderBy) are now exported from cds.ql and can be destructured from it
• cds.parse.cql, cds.run, and cds.read now accept tagged template literals
• Service.run(query) now proxies the entity type of the contained query through to the return type

Changed

• Bound action handlers now keep req.subject typed as the bound action's instance type (__self) instead of a class/ref hybrid.
• Subject-based query overloads (SELECT.from, SELECT.one.from, UPDATE, DELETE) now derive the entity class from the passed subject instance to preserve typed query results.

Deprecated

Removed

Fixed

• Types for SELECT.one includes undefined

Security

Changelog

Sourced from @​cap-js/cds-types's changelog.

[0.19.0] - 2026-08-24

Added

• Added types for req.req and req.res in cds.Request
• cds.User now has an authInfo property typed against @sap/xssec's SecurityContext. @sap/xssec is an peer dependency.
• cds.ql is now typed as a callable universal converter: tagged template, function accepting a CQN object, or plain string — all returning SELECT<unknown>
• CXL helper functions (ref, val, expr, columns, expand, where, orderBy) are now exported from cds.ql and can be destructured from it
• cds.parse.cql, cds.run, and cds.read now accept tagged template literals
• Service.run(query) now proxies the entity type of the contained query through to the return type

Changed

• Bound action handlers now keep req.subject typed as the bound action's instance type (__self) instead of a class/ref hybrid.
• Subject-based query overloads (SELECT.from, SELECT.one.from, UPDATE, DELETE) now derive the entity class from the passed subject instance to preserve typed query results.

Deprecated

Removed

Fixed

• Types for SELECT.one includes undefined

Security

Commits

• 20e88f8 chore(version): minor version 0.19.0 (#593)
• e399364 build(deps-dev): bump the development-dependencies group across 1 directory w...
• 2754bb5 fix: Propagate subject type (#588)
• aa31f74 feat: Proxy result of constructed query through service.run (#587)
• 0d23ce1 feat: Callable cds.ql (#586)
• 3299a1e build(deps-dev): bump the development-dependencies group with 3 updates (#584)
• 6c702df fix: SELECT.one also returns undefined (#514)
• 3dfaf30 fix(types): add authInfo to User for xssec security context access (#580)
• afc0536 chore: Add 'new' label to issue template (#579)
• b81ab2f feat: add types for req.req and req.res (#415)
• See full diff in compare view

Updates @sap/eslint-plugin-cds from 4.2.4 to 4.2.5

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[anselm94]

These dependency updates are being consolidated into PR #40.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml