SAP Cloud Application Programming Model for Node.js 10

Apply the Node.js 24 prompt first. These rules cover @sap/cds 10 on Node.js 24, including CDS models, application services, OData, drafts, queues, remote services, optional multitenancy and the Application Router when it serves the browser UI. CAP 10 declares Node.js 22 or newer; the selected baseline is the supported Node.js 24 LTS line, not every release accepted by that broad engine range.

Runtime and production configuration

• Keep the deployed dependency set within the compatible CDS 10 family: CDS compiler 7, CAP database adapters 3, and optional @sap/cds-mtxs 4. Review the runtime, adapters, authentication library, plugins, and build tools together when applying security updates.
• For multitenant deployments, maintain @sap/cds-mtxs wherever it runs, including the sidecar's own package.json and lockfile; updating the application's @sap/cds does not update a separately locked sidecar. Leave extensibility disabled when unneeded, enforce tenant authorization on its administrative endpoints, and apply SAP Note 3798315 remediation when the deployed sidecar is affected.
• Exclude the compromised releases @cap-js/sqlite 2.2.2, @cap-js/postgres 2.2.2, @cap-js/db-service 2.10.1, @cap-js/openapi 1.4.1, and mbt 1.2.48 from application and build environments. Treat prior installation as an incident requiring investigation and rotation of all credentials accessible to that environment; updating or removing a package does not revoke stolen access.
• Set NODE_ENV=production and inspect effective CAP configuration under that environment. Keep