Everything in the atlas

The page and the [abap2UI5](artifact:abap2ui5-abap2ui5) service have to share an origin: an `endpoint` that resolves to another origin is refused, and abap2UI5 rejects a POST whose `Origin` names another host. A host that routes by the URL hash, such as a Fiori elements app or an app with a UI5 router, needs abap2UI5 1.146.0 or later, because 1.145.0 clears the host's hash after every roundtrip. One frontend per page: the first control that starts decides which endpoint the frontend comes from.

No published releases; repository quiet for 52 months.

Release and repository quiet for 50 months.

Release and repository quiet for 38 months.

Quiet Release and repository quiet for 41 months.

Functional boundary The case it is written for is a document that has not been uploaded; anything already served from a URL is what the framework's own PDF control takes. Passing a document as a data URI means holding it in the page as a string first, which is a different cost from streaming it from a server.

Release and repository quiet for 26 months.

The maintainer marks this under active development; public APIs, annotation names and OData contracts may still change.

Nothing about it is readable from outside the package: there is no repository, no issue tracker, and the npm page carries no readme, so the README, the examples and the changelog can be read only from the tarball or a CDN mirror, and a bug has nowhere to be filed. Provider URLs are called from the plugin with API keys taken from environment variables in a .env file, so on BTP no call resolves through a destination and the keys live in the environment. The npm line stops at 1.0.1 on 3 November 2025; the changelog shipped inside that version is headed v2.1, so the version npm shows and the version the author counts are not the same.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

For a deployed application's UI. The README adds it with `npm add cds-plugin-ui5 -D`, a development dependency of the CDS server, and states nothing about a build or a deployment.

Release and repository quiet for 39 months.

On the UI5 path what comes back is an XML view or fragment with the data already substituted, streamed as the entity's media content, rather than an HTML page — the README calls this pre-rendering, and only the Vue path produces markup. The view kept under `srv/` has its UI5 bindings replaced by Handlebars expressions, so it is a second copy of the view, separate from the one the application ships. Version 1.0.8 declares `@sap/cds` `>=8` as its peer dependency, which puts a project on CAP 7 outside its stated range.

The declared repository is archived.