Bump com.sap.cds:cds-feature-attachments from 1.5.0 to 1.7.0 in /sdm

[dependabot]

Bumps com.sap.cds:cds-feature-attachments from 1.5.0 to 1.7.0.

Release notes

Sourced from com.sap.cds:cds-feature-attachments's releases.

1.7.0

Added

• Added support for single (inline) attachments via the Attachment type. (#768)
• Added top-level Attachments aspect to allow usage without sap.attachments namespace (#806), i.e., using {Attachments} from 'com.sap.cds/cds-feature-attachments'.

Security

• Attachment content is now served with Content-Disposition: attachment by default (previously inline) to mitigate stored XSS (CWE-79) via user-uploaded SVG/HTML payloads (cds-calesi #1263). Applications that require inline previews can opt in by annotating content in their own CDS model — see the "Content Disposition" section in the README. It is recommended to combine this with @Core.AcceptableMediaTypes restricting inline content to non-scriptable types (e.g. image/jpeg, image/png, application/pdf).

Full Changelog: cap-java/cds-feature-attachments@1.6.0...1.7.0

1.6.0

Added

• Added top-level Attachments aspect to allow usage without sap.attachments namespace (#806), i.e., using {Attachments} from 'com.sap.cds/cds-feature-attachments'.
• Extract fileName and mimeType from HTTP headers (Content-Disposition, Content-Type, slug) when not provided in the request payload (#804)
• Added independent MalwareScannerService for scanning arbitrary content without the AttachmentService (#785)
• Added translations for ScanStates entity texts (#787, #814)

Changed

• Upgraded to CAP Java CDS 5 / @​sap/cds-dk 10 (#856)
• Minimum required Java version raised from 17 to 21 (#856)
• Enabled S3 server-side encryption (AES256) by default for AWS Object Store (#788)

Full Changelog: cap-java/cds-feature-attachments@1.5.0...1.6.0

Changelog

Sourced from com.sap.cds:cds-feature-attachments's changelog.

Version 1.7.0 - 2026-08-19

Added

• Added support for single (inline) attachments via the Attachment type. (#768)
• Added top-level Attachments aspect to allow usage without sap.attachments namespace (#806), i.e., using {Attachments} from 'com.sap.cds/cds-feature-attachments'.

Security

• Attachment content is now served with Content-Disposition: attachment by default (previously inline) to mitigate stored XSS (CWE-79) via user-uploaded SVG/HTML payloads (cds-calesi #1263). Applications that require inline previews can opt in by annotating content in their own CDS model — see the "Content Disposition" section in the README. It is recommended to combine this with @Core.AcceptableMediaTypes restricting inline content to non-scriptable types (e.g. image/jpeg, image/png, application/pdf).

Version 1.6.0 - 2026-07-17

Added

• Extract fileName and mimeType from HTTP headers (Content-Disposition, Content-Type, slug) when not provided in the request payload (#804)
• Added independent MalwareScannerService for scanning arbitrary content without the AttachmentService (#785)
• Added translations for ScanStates entity texts (#787, #814)

Changed

• Upgraded to CAP Java CDS 5 / @​sap/cds-dk 10 (#856)
• Minimum required Java version raised from 17 to 21 (#856)
• Enabled S3 server-side encryption (AES256) by default for AWS Object Store (#788)

Commits

• f4f9956 Release 1.7.0 prep (#879)
• cedfff6 Bump the minor-patch group across 1 directory with 7 updates (#878)
• 36f024a Changed pinned version from main to commit sha for actions from https://githu...
• 1eedd5d Support inline single attachments via Attachment type (#768)
• dfa6d2e Bump the minor-patch group across 1 directory with 2 updates (#877)
• db4795e Bump the minor-patch group across 1 directory with 8 updates (#876)
• 73d3358 Remove inline annotation and add document the new behavior (#872)
• 5755528 Bump actions/setup-java from 5.5.0 to 5.6.0 in the minor-patch group across 1...
• 8de6af5 Bump actions/checkout from 6.0.3 to 7.0.0 (#870)
• ba58cf6 Bump the minor-patch group across 1 directory with 7 updates (#871)
• Additional commits viewable in compare view