[dependabot]

Bumps the cap2ui5 group with 1 update: @cap2ui5/cds-plugin.

Updates @cap2ui5/cds-plugin from 0.4.0 to 0.5.0

Changelog

Sourced from @​cap2ui5/cds-plugin's changelog.

[0.5.0] - 2026-10-14

Added

• An MCP endpoint for AI agents, off unless cds.requires.cap2ui5.agent is true or { path, apps, confirm, forbidden }: JSON-RPC over Streamable HTTP at /rest/root/z2ui5/mcp, with the tools app_list, app_start, app_describe and app_act answering abap2UI5's agent snapshot v1 - the MCP server's own code, vendored unchanged in lib/agent/vendor/. An app opts in with defineApp( )'s new option agent (true, false, or { events: { SAVE: "confirm", "DELETE*": "forbidden" }, description }), a transpiled ABAP app through agent.apps. Agents never fire a confirm or forbidden event; a confirm refusal answers a link that opens the screen for a human, restored from the draft for the same user. A tool call runs the roundtrip in process as the CAP user who called, behind the same roles as the route; anonymous callers are refused even where roles lets them into the UI. A session the server lost in a restart is restored from its draft. A SelectDialog / TableSelectDialog is a table of the snapshot and app_act with row on its confirm picks that row as a click does; the items of a MessagePopover / MessageView are messages.
• cap2ui5.AgentLog: one row per agent tool call - user, tool, app, session, event, outcome - but never the values an agent entered. Like cap2ui5.Drafts it is part of the model, so the next cds deploy creates the table, whether the endpoint is on or not.
• Retention for cap2ui5.AgentLog: cds.requires.cap2ui5.agent.retention days, 90 unless set, 0 or false to keep every row; a value that is not a number of days fails the start. The endpoint deletes the older rows on the way of an agent call, at most once an hour per process and tenant, as the draft store expires drafts on an app start. purgeAgentLog( { days } ) runs the same DELETE from a project's own scheduled job.

Changed

• It hosts @abap2ui5/node-runtime 1.147.0 (abap2UI5 1.147.0): a bound table of flat rows written to JSON directly, the draft kept as a digest, the developer tools as a bundle of their own, the request URL in a 500 body stripped to the characters a URL is made of, and the two embedded-page switches ownsHash / ownsPage. The package's output/ is a folder per origin from this release on (@abaplint/transpiler 2.14): the plugin finds the express adapter under output/express-icf-shim/ there and under the flat output/ of 1.146.0 and older, so an overrides to an older runtime still boots. A host that imports a module of output/ by its own path has to follow the layout (abap2UI5's release notes name the mapping).

• The agent endpoint vendors abap2UI5/mcp-server a4d9f07: the agent client follows the protocol's frontend rules (PROTOCOL check, sap-contextid, one roundtrip at a time per session, popups closed when the app changes, the error body verbatim). The in-process transport answers the client's HEAD token fetch with an empty 200 - the handler never asks for a CSRF token.

• package.json names the author (cap2UI5), as npm and the Best of CAP

... (truncated)

Commits

• 61c7604 Release 0.5.0: @​abap2ui5/node-runtime 1.147.0, the express adapter found in e...
• 0634c92 Stateful sessions per CAP user (#105)
• 6003cd1 Roundtrips one at a time per process (#104)
• 5b7d0ca Agent endpoint: re-vendor mcp-server a4d9f07 (protocol frontend rules) (#103)
• 822b72c CI: protocol backend conformance suite; no unvalidated request data in the 50...
• a40fa84 Let agents operate cap2UI5 apps over MCP, as the CAP user, off by default (#101)
• f7a77b5 Refuse what a field cannot take, read every event argument, let CAP's dates i...
• 987b0c5 Name the author in the plugin's package.json (#99)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions