[dependabot]

Bumps @cap-js/openapi from 1.6.0 to 1.7.0.

Release notes

Sourced from @​cap-js/openapi's releases.

v1.7.0

Added

• Added defaultProtocol configuration option as fallback if no config is provided.
• Collection responses now include the optional @odata.nextLink / @nextLink property in their schema, documenting server-driven paging as per the OData specification.

Changed

• set odata as the service protocol if no protocol is set to match the default behavior of @sap/cds. Provide cds.env.openapi.defaultProtocol = "rest" to restore old behavior.
• ER diagrams are now rendered using the yuml.me v1 API (app.yuml.me), avoiding the 'please migrate' image. The diagram and legend are displayed as clickable SVG images.

Deprecated

Removed

Fixed

• @Common.Label values containing i18n placeholders (e.g. {i18n>TasksPlural}) are no longer corrupted by camelCase word-splitting in tag names
• Entities that are transitively autoexposed and should still be considered readonly, do not generate documentation for write endpoints anymore
• Back-reference navigation properties on child entities in compositions (the generated parent nav pointing back up) are no longer emitted in the OpenAPI read schema
• Implicitly auto-exposed composition targets (annotated @cds.autoexposed by the CDS compiler) no longer generate top-level GET paths that CAP would reject with 405
• OpenAPI compilation is now pure: the input CSN is no longer mutated during compilation
• Services annotated with @protocol: 'rest' no longer include a /$batch path in the generated OpenAPI document

Security

Changelog

Sourced from @​cap-js/openapi's changelog.

[1.7.0] - 2026-10-06

Added

• Added defaultProtocol configuration option as fallback if no config is provided.
• Collection responses now include the optional @odata.nextLink / @nextLink property in their schema, documenting server-driven paging as per the OData specification.

Changed

• set odata as the service protocol if no protocol is set to match the default behavior of @sap/cds. Provide cds.env.openapi.defaultProtocol = "rest" to restore old behavior.
• ER diagrams are now rendered using the yuml.me v1 API (app.yuml.me), avoiding the 'please migrate' image. The diagram and legend are displayed as clickable SVG images.

Deprecated

Removed

Fixed

• @Common.Label values containing i18n placeholders (e.g. {i18n>TasksPlural}) are no longer corrupted by camelCase word-splitting in tag names
• Entities that are transitively autoexposed and should still be considered readonly, do not generate documentation for write endpoints anymore
• Back-reference navigation properties on child entities in compositions (the generated parent nav pointing back up) are no longer emitted in the OpenAPI read schema
• Implicitly auto-exposed composition targets (annotated @cds.autoexposed by the CDS compiler) no longer generate top-level GET paths that CAP would reject with 405
• OpenAPI compilation is now pure: the input CSN is no longer mutated during compilation
• Services annotated with @protocol: 'rest' no longer include a /$batch path in the generated OpenAPI document

Security

Commits

• 15bf85e chore(version): minor version 1.7.0 (#200)
• a2937d0 fix: suppress $batch path for REST services (#194)
• bb34ba5 chore(deps-dev): bump @​types/node from 26.6.2 to 26.6.3 in the development-de...
• e0b9eaa chore: Move import code from cds-dk to openapi (#189)
• fdda85b chore: remove call-graph generator and its mermaid-cli dependency (#197)
• d571923 refactor: raise complexity threshold a bit; simplify code to stay under (#198)
• 624a004 fix: emit @​odata.nextLink in collection response schema (#195)
• 0c5c1c5 fix: Backreferences (#182)
• a16fd9b chore(deps-dev): bump the development-dependencies group across 1 directory w...
• ed80be2 chore(deps-dev): bump @​types/node from 26.5.0 to 26.5.1 in the development-de...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[daiedy]

Closing unmerged: @cap-js/openapi stays pinned to 1.6.0 (ADR-0029 amendments A, G). With 1.7.0 the Swagger document of the draft-enabled CatalogService answers 500 (cap-js/openapi#204); the fix, cap-js/openapi#207, is not released yet. test/api-docs.test.js ("serves the Swagger UI and its OpenAPI document in development") is the guard that failed here. The pin is dropped by a bump to the first release that contains #207.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.