From 1b5b702bb96f4b3581ab8a2e2373cc34178c47ca Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Wed, 19 Aug 2026 10:43:43 +0200 Subject: [PATCH] Release 1.7.0 prep --- README.md | 2 +- doc/CHANGELOG.md | 8 ++++++-- pom.xml | 2 +- samples/bookshop/pom.xml | 2 +- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 22ddf19a..210e8f25 100644 --- a/README.md +++ b/README.md @@ -120,7 +120,7 @@ The UI Facet can also be added directly after other UI Facets in a `cds` file in ### Single (Inline) Attachments > [!Important] -> Inline attachments require **cds-services 4.9.0** or higher and are available from **cds-feature-attachments 1.6.0**. +> Inline attachments are available from **cds-feature-attachments 1.7.0**. In addition to the composition-based `Attachments` aspect (which supports multiple files), `cds-feature-attachments` provides the `Attachment` type for **single-file** attachment fields directly on an entity. This is useful when an entity needs exactly one file, for example a profile icon or a cover image. diff --git a/doc/CHANGELOG.md b/doc/CHANGELOG.md index b0366d95..e602d6a3 100644 --- a/doc/CHANGELOG.md +++ b/doc/CHANGELOG.md @@ -9,11 +9,15 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/). ## Unreleased ### Added +### Changed + +## Version 1.7.0 - 2026-08-19 -- Added support for single (inline) attachments via the `Attachment` type. Requires cds-services 4.9.0 or higher. (#768) +### Added + +- Added support for single (inline) attachments via the `Attachment` type. (#768) - Added top-level `Attachments` aspect to allow usage without `sap.attachments` namespace (#806), i.e., `using {Attachments} from 'com.sap.cds/cds-feature-attachments'`. -### Changed ### Security - Attachment content is now served with `Content-Disposition: attachment` by default (previously `inline`) to mitigate stored XSS (CWE-79) via user-uploaded SVG/HTML payloads (cds-calesi #1263). Applications that require inline previews can opt in by annotating `content` in their own CDS model — see the "Content Disposition" section in the README. It is recommended to combine this with `@Core.AcceptableMediaTypes` restricting inline content to non-scriptable types (e.g. `image/jpeg`, `image/png`, `application/pdf`). diff --git a/pom.xml b/pom.xml index 53f8f327..cc653025 100644 --- a/pom.xml +++ b/pom.xml @@ -59,7 +59,7 @@ - 1.6.0 + 1.7.0 21 ${java.version} UTF-8 diff --git a/samples/bookshop/pom.xml b/samples/bookshop/pom.xml index 4ec699ac..3736b666 100644 --- a/samples/bookshop/pom.xml +++ b/samples/bookshop/pom.xml @@ -49,7 +49,7 @@ com.sap.cds cds-feature-attachments - 1.6.0 + 1.7.0