chore(deps-dev): bump @cap-js/cds-types from 0.17.0 to 0.19.0

[dependabot]

Bumps @cap-js/cds-types from 0.17.0 to 0.19.0.

Release notes

Sourced from @​cap-js/cds-types's releases.

v0.19.0

Added

• Added types for req.req and req.res in cds.Request
• cds.User now has an authInfo property typed against @sap/xssec's SecurityContext. @sap/xssec is an peer dependency.
• cds.ql is now typed as a callable universal converter: tagged template, function accepting a CQN object, or plain string — all returning SELECT<unknown>
• CXL helper functions (ref, val, expr, columns, expand, where, orderBy) are now exported from cds.ql and can be destructured from it
• cds.parse.cql, cds.run, and cds.read now accept tagged template literals
• Service.run(query) now proxies the entity type of the contained query through to the return type

Changed

• Bound action handlers now keep req.subject typed as the bound action's instance type (__self) instead of a class/ref hybrid.
• Subject-based query overloads (SELECT.from, SELECT.one.from, UPDATE, DELETE) now derive the entity class from the passed subject instance to preserve typed query results.

Deprecated

Removed

Fixed

• Types for SELECT.one includes undefined

Security

v0.18.0

Added

Changed

• Installing @cap-js/cds-types no longer executes a postinstall script that creates a symlink in node_modules/@types. Instead, use a paths entry in your tsconfig.json. This entry can be created by running cds add typescript in your project.

Deprecated

Removed

Fixed

Security

Changelog

Sourced from @​cap-js/cds-types's changelog.

[0.19.0] - 2026-08-24

Added

• Added types for req.req and req.res in cds.Request
• cds.User now has an authInfo property typed against @sap/xssec's SecurityContext. @sap/xssec is an peer dependency.
• cds.ql is now typed as a callable universal converter: tagged template, function accepting a CQN object, or plain string — all returning SELECT<unknown>
• CXL helper functions (ref, val, expr, columns, expand, where, orderBy) are now exported from cds.ql and can be destructured from it
• cds.parse.cql, cds.run, and cds.read now accept tagged template literals
• Service.run(query) now proxies the entity type of the contained query through to the return type

Changed

• Bound action handlers now keep req.subject typed as the bound action's instance type (__self) instead of a class/ref hybrid.
• Subject-based query overloads (SELECT.from, SELECT.one.from, UPDATE, DELETE) now derive the entity class from the passed subject instance to preserve typed query results.

Deprecated

Removed

Fixed

• Types for SELECT.one includes undefined

Security

[0.18.0] - 2026-06-22

Added

Changed

• Installing @cap-js/cds-types no longer executes a postinstall script that creates a symlink in node_modules/@types. Instead, use a paths entry in your tsconfig.json. This entry can be created by running cds add typescript in your project.

Deprecated

Removed

Fixed

Security

Commits

• 20e88f8 chore(version): minor version 0.19.0 (#593)
• e399364 build(deps-dev): bump the development-dependencies group across 1 directory w...
• 2754bb5 fix: Propagate subject type (#588)
• aa31f74 feat: Proxy result of constructed query through service.run (#587)
• 0d23ce1 feat: Callable cds.ql (#586)
• 3299a1e build(deps-dev): bump the development-dependencies group with 3 updates (#584)
• 6c702df fix: SELECT.one also returns undefined (#514)
• 3dfaf30 fix(types): add authInfo to User for xssec security context access (#580)
• afc0536 chore: Add 'new' label to issue template (#579)
• b81ab2f feat: add types for req.req and req.res (#415)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)