SAP Cloud Application Programming Model for Node.js 9

Last reviewed Sep 23, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 22114 lines · 3.7K tokens
  3. SAP Cloud Application Programming Model for Node.js 9138 lines · 6.5K tokens
Total354 lines · 13.4K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 95
  • 113
  • 117
  • 201
  • 208
  • 209
  • 214
  • 250
  • 252
  • 287
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 345
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 434
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 602
  • 613
  • 639
  • 653
  • 732
  • 770
  • 799
  • 807
  • 829
  • 838
  • 841
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply the Node.js 22 prompt first. These rules target @sap/cds 9, including CDS models, application services, OData, drafts, remote services, transactional queues, messaging, and CAP 9-compatible multitenancy, and were checked against 9.9.3. Apply JavaScript and Node.js controls from the included baselines alongside these rules.

Version scope and maintenance

  • Run this CAP 9 application on a maintained Node.js 22 patch. The package declares node >=20, but CAP 9's documented runtime scope is Node.js 20/22 and Node.js 20 is out of maintenance; the engine range does not establish support for every newer Node.js major.
  • Treat CAP 9 as maintenance-only after CAP 10's release; apply compatible critical fixes and plan migration within SAP's maintenance window of at most twelve months after the next major release.
  • Lock @sap/cds together with its compatible compiler 6.x, Fiori 2.x, database adapters, MTX 3.x, authentication, Cloud SDK, and plugin packages, and update them as one set. Respect the Express dependency range ^4.22.1 || ^5 that CAP 9.9.3 declares; review and test middleware compatibility when changing Express majors.
  • Keep CAP 10-only APIs and defaults out of this application. In particular, verify remote-client capabilities, queue APIs, retry defaults, and compatibility flags against the installed CAP 9 packages.
  • Inspect effective configuration with cds env under the production profile, including the separate sidecar configuration; compare authentication, database, protocol, queue, destination, and tenant settings to the deployment design. Keep