# Change Log

All notable changes to this project will be documented in this file.
This project adheres to [Semantic Versioning](http://semver.org/).
The format is based on [Keep a Changelog](http://keepachangelog.com/).

## Version 0.5.5 - 2026-09-15

### Add

- eval, Function, _oy and Javy to forbidden globals

### Fixed

- Invalid JavaScript in extension handlers no longer crashes the sidecar. Syntax errors are now reported as validation findings (422) instead of causing a server error (500).
- Symlinks in extension handler directories are now rejected. This prevents potential file disclosure attacks where symlinks could point to server-side files outside the extension.
- Path traversal protection added when reading extension handler files.
- Use CQN vals while setting limit and offset in wasm code
- Nested @extensible.code annotations by bound actions

## Version 0.5.4 - 2026-08-11

### Fixed

- Entities contributed by a tenant extension are now exposed via `this.entities` inside extension code. Previously the map was built from the cached `srv.entities` reflection, which does not include tenant-pushed entities, so `this.entities.<ExtEntity>` was `undefined` and querying it (e.g. `SELECT.from(this.entities.ExtEntity)`) failed. The map is now reflected from the effective (tenant-extended) model.
- `cds add ext-handler` now correctly generates import paths for services with dots in their names

## Version 0.5.3 - 2026-08-05

### Fixed

- Parsing and compiling extension in local MTX deployment without production profile


## Version 0.5.2 - 2026-07-15

### Fixed

- Documentation was missing files

## Version 0.5.1 - 2026-07-14

### Fixed

- Typing for cds.ql

### Changed

- **Breaking:** `runtime` option is renamed to `sandbox`. The possible values are `wasm` (previously `oyster`) and `mocked` (previously `debug`). The default in development mode is `mocked`. The `wasm` sandbox can be switched on in development with `cds watch --wasm`.
In production only `wasm` sandbox is allowed.
- **Breaking:** `extensibleAnnotation` now defaults to `true`. The `@extensible.code` annotation on the CDS model is the leading source of truth for code extensions; the `extension-allowlist` is bypassed by the code checker (it still governs non-code artefacts through MTX). Projects that rely on the allow-list to gate code must set `"extensibleAnnotation": false` explicitly under `cds.requires.code-extensibility` — see [DEPRECATED.md](./DEPRECATED.md).
- `@kind: 'ext-service'` at service level is now a deprecated shortcut for `@extensible.code`; both are still accepted, prefer the annotation in new code.
- `cds add ext-handler` now generates files prefixed with `#` (e.g. `#on-travelAccepted.js`). The `#` marks the file as inactive — remove it to activate the handler.
- Action stubs generated by `cds add ext-handler` now have a typed `req.data` parameter inferred from the action's CDS declaration (bound and unbound).

### Deprecated

- The extension allow-list (`extension-allowlist` / `namespace-blocklist` under `cds.xt.ExtensibilityService`) is deprecated for gating **code** extensions. It still governs non-code artefacts. See [DEPRECATED.md](./DEPRECATED.md) for the full migration.

### Added

- `req.locale` in extension handlers
- Annotation walk `action → entity → service` with first-hit semantics: the push checker resolves each (event, artefact) pair by walking innermost first and stops at the first level that decides.
- Fine-grained `@(extensible.code: { create/read/update/delete/action/function/<opname>: bool })` object form. Per-level semantics: on an entity the CRUD/bound-op keys apply; on a service the unbound-op keys apply and cover entities that don't override; specific action/function names override the generic `action`/`function` key.
- Extension-defined artefacts (an entity or action first defined by the extension itself) are always code-extensible. The push checker recognises structurally new artefacts and skips the annotation walk for them.
- `cds add ext-handler` respects `@extensible.code` — stubs are generated only for artefacts the annotation permits (unless `extensibleAnnotation: false`).

### Removed

- The `maxResultSize` option is removed. Read result size is checked in the application service.
- `req.user` is no longer exposed in the sandbox request object. Pass identity context as an explicit action parameter.

## Version 0.4.0 - 2026-05-29

### Fixed

- "cds add ext-handler" in case of missing bound/unbound actions
- issue while changing unqualified entity names to fully qualified names in simple CQNs

### Changed

- Query Language (QL) library: Replaced mini-ql with a robust implementation based on the external module github.com/cap-js/ql
- Before/after READ handlers are now executed only for extensions with extension call depth 1. For extensions invoked from another extension, all before/after READ handlers are skipped
- Significantly updated readme documentation
- Code-extensibility validation checks are excluded from `cds build`. To validate extension code locally, use `cds build --for mtx-extension`. Note: the resulting build is for local validation only, not for deployment to MTX

### Added

- Option `code-extensibility.limitedAfterRead` restricts allowed changes in `after-READ` handlers to virtual fields (defaults to `false`)
- Default `code-extensibility` options are now defined in cds.env
- Tagged template support for `CQL` statements in extensions, e.g. `SELECT a, b from Foo`
- Hybrid use of tagged templates and fluent API for `CQL` statements in extensions, e.g. `SELECT`a, b`.from('Foo').where({ ID: 1 })`

## Version 0.3.1 - 2026-05-08

### Fixed

- A check for the Extension Allowlist was too strong, making it unusable in certain cases

### Changed

- srv.emit() is now restricted to events that are explicitly modeled in a service definition
- input/output of extension actions/functions is validated
- input of modelled events is validated
- `maxTime` Parameter is now measured in milliseconds

## Version 0.3.0 - 2026-03-11

### Added

- method `utils.i18n(key)` providing translation for the key in extension

### Fixed

- issue in allowlist restrictions being too strict by extension entities

## Version 0.2.1 - 2025-10-30

### Fixed
 
- Local multitenant development using the --with-mtx profile
- formatting of this changelog

## Version 0.2.0 - 2025-10-06

### Added
 
- Additional parameters for code extensibility:
  ```json
  "code-extensibility": {
    "maxDepth": 5, // Limit the number of recursively created Oyster sandboxes. Default is 10
    "maxResultSize": 500, // Throw an exception if the number of rows returned by SELECT exceeds the value. Default is 1000.
  }
  ```
- Restrict after read handlers to modify certain fields, like IDs, ETag and managed fields.
 
### Fixed
 
- Forbid usage of `console.log` in production
- Only application services can be code-extended
- Extensions for services with manespace `cds.xt` are forbidden
 
### Changed
 
- Switch to Oyster v2
- Keep framework.wasm in binary format
- Allow non CDS-Oyster application handlers in `app/srv` directory
- Only errors and messages produced in extension are visible within extension
 
### Removed
 
- Calling bound action from extension in form `this.action()`. Only unbound actions are allowed.
- Before-READ extension handler


## Version 0.1.0 - 2025-07-03

### Added

- alpha version ready for pilot usage

## Version 0.0.1

### Added

- initial implementation