Everything in the atlas

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

If document versions are required, [@cap-js/sdm](artifact:cap-js-sdm) excludes versioned repositories in its [documented restrictions](https://raw.githubusercontent.com/cap-js/sdm/ad13b61f21816ebead2d08264a74521cfb75846c/README.md).

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

For deployed environments, the [README](https://raw.githubusercontent.com/cap-java/cds-feature-attachments/302f61c8bb76a0f54f43482ad91d89bf7dc5540f/README.md) excludes the cds-feature-attachments-fs file-system target, which is intended only for local development and testing.

If document versions are required, the [documented restrictions](https://raw.githubusercontent.com/cap-java/sdm/673769f24ef66fd97daa6a6be41262d45065d3fe/README.md) exclude versioned repositories.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Where the release and programming model offer durable locks, as RAP draft handling does, the README states that those solve the problem at the kernel level and the lock manager is for where that is not an option. A running handler occupies one background work process for as long as any lock is held, and only generated `ENQUEUE_*` modules can be locked.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

When your adoption policy excludes experimental dependencies: the [maintainer’s README](https://github.com/cap-js/cds-federation-synonyms#about-this-project) explicitly labels this plugin experimental.

Neither the package manifest nor the repository tree declares a licence.

Not an end-user app: it reads from any table the user names and writes into tables of the Z/Y namespace, with no authorisation check of its own, so the README asks a project to add its own checks on `S_TABU_DIS`/`S_TABU_NAM` and to restrict who may run it before it is used beyond a development system. XLSX upload and download are not ready for ABAP Cloud yet, and of the upload apps only the JSON one writes the file's rows back to the database.

It writes and it administers — ETL extraction and database user management are not read operations, and the same connection that profiles a column can move data out of the tenant. Masking is only as good as the configuration naming the fields, so an unlisted sensitive column is an unmasked one.

Its README says it plainly and so does this entry: this is not a simulation, every tool call reaches a live BW system, and write operations produce real changes. BW modelling objects are the definition of a warehouse — the blast radius of a wrong one is every report built on it.

DataZoo GmbH calls the extension experimental and states that minimal testing and benchmarking were done. The Business Source License 1.1 it carries restricts offering the software to third parties on a hosted or embedded basis, so an embedding product needs a commercial licence. Telemetry is on by default and is switched off per session with `SET erpl_telemetry_enabled = false` or for the machine with `DATAZOO_DISABLE_TELEMETRY=1`.

Not for a table whose contents matter, and not for one chosen at run time: the name of the table is fixed in the calling code, and the maintainer's own warning is "only hardcode the table name, don't use with important tables, use at own risk!"

The app writes to whatever table is passed in the URL parameter `table` and carries no authorisation check of its own, so past a development system it needs authorisation checks added and a restriction on who may run it.

When your adoption policy excludes experimental dependencies: the [maintainer’s README](https://github.com/cap-js/cds-federation-synonyms#about-this-project) explicitly labels this plugin experimental.

It is a bundle, not a plugin with one job. Depending on it for one feature brings the rest.

The page and the [abap2UI5](artifact:abap2ui5-abap2ui5) service have to share an origin: an `endpoint` that resolves to another origin is refused, and abap2UI5 rejects a POST whose `Origin` names another host. A host that routes by the URL hash, such as a Fiori elements app or an app with a UI5 router, needs abap2UI5 1.146.0 or later, because 1.145.0 clears the host's hash after every roundtrip. One frontend per page: the first control that starts decides which endpoint the frontend comes from.

Needs Standard ABAP 7.50 or higher, and an abap2UI5 whose frontend reserves the resourceRoot `z2ui5_cci`: a frontend predating that rename reserves `z2ui5ccc` and cannot resolve the controls. Frontend artefacts only one company needs, such as an in-house reuse library, a corporate icon font or company CSS, are what [abap2UI5-addons/custom-controls-customer](https://github.com/abap2UI5-addons/custom-controls-customer) is for, the same mechanism under the second reserved root `z2ui5_ccc`. ExportSpreadsheet needs SAPUI5: under OpenUI5 `sap.ui.export` is missing and the button renders disabled.

Neither the package manifest nor the repository tree declares a licence.

Not the whole addon in ABAP Cloud: the DDIC annotation service is not released there, so the annotations come through XCO instead, a database table is read-only, the DDL source is not read, and the cloud path was written without a cloud system to run it on. Not for a plain internal table, since it renders from CDS annotations; the README points at `z2ui5_cl_ui5_view_builder` for that case. As of 2026-10 the maintainer states that none of it has been clicked through in an SAP system: the RAP write path and the reading of metadata extensions were written from documentation and pass the three offline gates only.

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

For a deployed application's UI. The README adds it with `npm add cds-plugin-ui5 -D`, a development dependency of the CDS server, and states nothing about a build or a deployment.

There is nothing here for ABAP for Cloud: the requirements name Standard ABAP releases only, and a CDS/SADL based OData service for `ABAP for Cloud` compatibility stands under Limitations & Todo.

LISA does the translation step only: it does not discover objects or manage transports, and its README pairs it with [an ADT MCP server](artifact:sap-adt-mcp-server) for those. Every write needs a transport request, and which object types it can write differs between public cloud or [the SAP BTP ABAP environment](artifact:btp-abap-environment) and on-premise or private cloud, and by release. Running it locally is meant for development and testing, not production.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

Not where the UI library itself is expected to bind data: the documentation leaves binding a component's content and events to the host framework. Not from a CDN script tag: the project publishes none, so it assumes a build step.

Not a way to run existing reports unchanged: a report is rewritten as a class, and `CALL SCREEN`, dynpro modules, batch input, `SUBMIT` and native SQL are refused by the converter rather than mapped. Not an SAP GUI in the browser either: the programming model is classic and the screens are UI5, and the README points at abap2UI5-addons/sapgui for SE16N or SM37. Output has gaps the README names — ALV cells show dates and times as the model carries them rather than in the user's format, print is a text file because ABAP Cloud has no spool, and value tables for F4 are read on premise only.

The frontend is optional: where abap2UI5 apps are reached through the framework's own HTTP service, nothing from here is installed. In S/4 Public Cloud that endpoint needs `S_DEVELOP` authorisation, which the installation guide states makes it unfit for production, and the separate frontend app with an extra tile is what it names for business users. The `cloud_new` and `standard_new` branches need an abap2UI5 newer than 1.146.0 on the system.

Not for views built from controls outside the portable profile: sap.ui.table, sap.f, sap.uxap, sap.ui.comp and z2ui5.cc custom controls render as a visible unsupported-control box and are listed in the diagnostics, and `CONTROL_BY_ID` and `BINDING_CALL` stay unsupported. Nine frontend actions the profile allows, `DOWNLOAD_B64_FILE` and `SYSTEM_LOGOUT` among them, are skipped and reported rather than run, and formatters other than the profile's `Formatter.Date*` render a placeholder.

The class has to be moved by hand: an abapGit pull of the exported ZIP, or a paste into ADT or SE24. The palette is held to the 121 controls of UI5 1.71, and a control inserted by its class name instead comes from whatever UI5 the canvas has loaded, with nothing checking it against 1.71 - *Checks* reports that. An app class that builds no view, or more than one, is refused.

Neither suite has been run against an ABAP system: the reference backends are the framework transpiled to Node and cap2UI5 on CAP, so what a check does on a real system is open. The portable profile is a subset of 61 controls, filled from a census of 247 core apps of which 64.8 % run unchanged, so an app outside it renders placeholders in the terminal and Adaptive Cards renderers.

The value-help and search-help popups read whichever DDIC check table the user selects without an authorisation check of their own, so the README asks for your own checks and a restriction on which tables may be browsed before they are used beyond a development system. The transport-request popup works only on-premise, and the search help does not yet run on the Cloud stack.