Everything in CAP / Java

No license Neither the package manifest nor the repository tree declares a licence.

Functional boundary The Maven coordinate its README gives, io.github.miyasuta:cds-feature-softdelete:1.0.0, does not resolve on Maven Central as of 2026-09-07 — you build and install it from source.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

It reads TypeScript exports only; a project written in plain JavaScript has no exported functions for it to extract. A call to the function name in a test file counts as tested, and a call through property access such as `.foo(` does not.

Quiet Release and repository quiet for 27 months.

Functional boundary Not a test-data factory. It writes files at build time to seed a database, so it does not build fixtures inside a unit test. The declared peer range stops at cds 7 — nothing says it fails on 9, but nothing says it was tried either.

It reads a UI5 project and the framework's own documentation, not a running system or a backend: a question about the service behind the app is answered somewhere else. Node.js v20.17 or v22.9 and above.

SAP prohibits gateway/proxy use for SAP Application APIs; the Atlas separately excludes CAP wrappers around those APIs from its assessed scope. Data changes require application-defined unbound actions, and the adapter supplies no rate limiting, agent-action audit logging, approval workflows or policy enforcement.

For deployed environments, the [README](https://raw.githubusercontent.com/cap-java/cds-feature-attachments/302f61c8bb76a0f54f43482ad91d89bf7dc5540f/README.md) excludes the cds-feature-attachments-fs file-system target, which is intended only for local development and testing.

If document versions are required, the [documented restrictions](https://raw.githubusercontent.com/cap-java/sdm/673769f24ef66fd97daa6a6be41262d45065d3fe/README.md) exclude versioned repositories.

Neither suite has been run against an ABAP system: the reference backends are the framework transpiled to Node and cap2UI5 on CAP, so what a check does on a real system is open. The portable profile is a subset of 61 controls, filled from a census of 247 core apps of which 64.8 % run unchanged, so an app outside it renders placeholders in the terminal and Adaptive Cards renderers.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Neither the package manifest nor the repository tree declares a licence.

Not reachable Not reachable since 2026-10-20.

Functional boundary The Level A–D grade merges SAP's two published files in the tool's own engine: it is an orientation rather than an ATC result and is left out of the signed audit pack, and the repository documents state by state where the grade is expected to differ from what the clean core ATC check reports. Nothing here runs ABAP Unit — on the RAP track that result is recorded from your own SAP system, and generated CAP tests run against mocks in an isolated runner rather than in a real SAP S/4HANA system. Tenants, organisation accounts, single sign-on, a self-hosted edition and write access through an API are deliberately not built, and one account has five analysis runs before a Gemini API key of its own is needed.