Skip to main content

release-notes-15-to-29

5.28.0 - April 14, 2026​

All Release Changes

🔧 Compatibility Notes​

  • [OpenAPI Apache Generator] Remove no args constructor in generated API clients.

✨ New Functionality​

  • Added support for SAP Cloud Identity Services (SCI) sap_id_type and sub claims in OIDC principal extraction. When sap_id_type=user, the sub claim is now used as the Subject Name Identifier (User ID, Email, or Custom Attribute as configured in SCI).

📈 Improvements​

  • Improved the support for the credential type X509_ATTESTED. HttpDestination objects created via ServiceBindingDestinationLoader no longer need to be re-created for the rotation of certificates to take effect.

🐛 Fixed Issues​

  • Fixed stateful OData request path construction caused by shared ODataResourcePath instances being mutated when building count, read-by-key, and function requests.
  • ODataRequestRead, ODataRequestCount, ODataRequesReadByKey, ODataRequestFunction and ServiceWithNavigableEntitiesImpl now create a defensive copy of the ODataResourcePath to prevent unintended side effects from shared mutable state.

5.27.0 - March 13, 2026​

All Release Changes

🔧 Compatibility Notes​

  • [Connectivity Destination Service] Migrated to Apache Httpclient 5.
    • The replacement for HttpClientAccessor is ApacheHttpClient5Accessor
  • New minimum version required for com.sap.cloud.security: 3.6.0

✨ New Functionality​

  • [OpenAPI] SAP Cloud SDK OpenAPI Generator now supports apache-httpclient library besides Spring RestTemplate through the newly introduced module openapi-core-apache.
  • [IAS] Add IasOptions.withTokenFormat() to allow specifying token format

🐛 Fixed Issues​

  • [OData v4] Binary deserialization can now handle both Base64URL and Base64.

5.26.0 - January 23, 2026​

All Release Changes

🔧 Compatibility Notes​

  • We noticed an implicit behavior change for updated Apache HttpClient from 5.5.1 to 5.6. TLS/SSL connections are now checked for hostname verification on behalf of the provided server certificate. Even with enabled trust-all-certificates flag, connections to servers with mismatching hostnames will be rejected.

✨ New Functionality​

  • DestinationService.tryGetDestination now checks if the given destination exists before trying to call it directly. This behaviour is enabled by default and can be disabled via DestinationService.Cache.disablePreLookupCheck.
  • Temporary: Use email as fallback principal id when user_uuid is missing. Will switch to using sub once IAS exposes idtype (tracked in SCICAI-1323).

🐛 Fixed Issues​

  • Fixed IAS OAuth2 token requests to use correct refresh_expiry=0 parameter instead of refresh_token=0 to disable refresh token issuance in certain cases.

5.25.0 - December 22, 2025​

All Release Changes

🚧 Known Issues​

🔧 Compatibility Notes​

✨ New Functionality​

  • Added native DestinationLoader implementation through the TransparentProxy class. This enables seamless destination retrieval via tryGetDestination and provides full SAP Cloud SDK integration for applications running in Kubernetes environments where Transparent Proxy is available.

📈 Improvements​

🐛 Fixed Issues​

  • Fix unintended modification of serviceNameMappings.properties during OData service regeneration altering stored mappings. Additionally, service name cleanup is now case-insensitive for consistency. Please make sure, a serviceNameMappings.properties file is present to avoid breaking changes to your generated code.

5.24.0 - October 30, 2025​

All Release Changes

✨ New Functionality​

  • Add support for using the Zero Trust Identity Service (ZTIS) on Kyma by detecting the well-known environment variable SPIFFE_ENDPOINT_SOCKET.
  • Add support for explicitly passing the clientid of the target system when using the IAS App2App authentication flow. Use the new methods withProviderClient(clientid) and withProviderClient(clientid, apptid) under BtpServiceOptions.IasOptions.

📈 Improvements​

  • When the circuit breaker opens, the resulting ResilienceRuntimeException will have the original CallNotPermittedException from the circuit breaker stored as a suppressed exception.

5.23.0 - October 08, 2025​

All Release Changes

🔧 Compatibility Notes​

  • The builder methods for TransparentProxyDestination have been renamed:
    • staticDestination() to destination()
    • dynamicDestination() to gateway()

📈 Improvements​

  • Circuit breaker exceptions CallNotPermittedException have been replaced in favor of the previously thrown exception to provide more context on the failure.

5.22.0 - August 29, 2025​

All Release Changes

✨ New Functionality​

  • Add built-in support for the Transparent Proxy via a new TransparentProxyDestination. For more information, refer to the documentation.
  • Add experimental support for cross-level destination consumption via a new CrossLevelScope setting under DestinationServiceOptionsAugmenter.
  • Add experimental support for setting custom headers in requests to the destination service via the new DestinationServiceOptionsAugmenter#customHeaders.

🐛 Fixed Issues​

  • [OpenAPI] Fix code generator for transitive dependency version inconsistencies for Jackson.
  • [ODatav4] Fix incorrect HTTP header name when sending entity version identifier in bound-action requests.
  • [ODatav4] Fix an issue when generating clients.
    • Property names: value, item and properties are now allowed.

5.21.0 - August 01, 2025​

All Release Changes

✨ New Functionality​

  • Add TokenCacheParameters to OAuth2Options to configurate token cache duration, expiration delta and cache size.

📈 Improvements​

  • Relax OAuth2 token cache duration to 1hr to avoid unnecessary token refreshes.
  • Disable refresh tokens when obtaining user tokens from IAS. This acts as a workaround for a limitation of IAS, where obtaining a refresh token invalidates the original token.

🐛 Fixed Issues​

  • OData v2 and OData v4: Fix eager HTTP response evaluation for Create, Update, and Delete request builders in convenience APIs. Previous change of 5.20.0 may have resulted in the HTTP connection being left open after the request was executed.
  • Generic OData Client: Revert behavior change introduced in 5.20.0 that let to HTTP responses not being consumed by default. If you want to use disableBufferingHttpResponse() on ODataRequestRead or ODataRequestReadByKey please switch to withoutResponseBuffering() instead.

🐛 Known Issues​

  • Using the openapi-generator-plugin in combination with a Swagger v2 specification file will likely lead to dependency convergence issue. If you have a MethodNotFoundException please use 5.20.0 or 5.22.0 (or later).

5.20.0 - June 20, 2025​

All Release Changes

🐛 Fixed Issues​

  • Fix CVE-2025-48734 by transitive dependency update in connectivity-ztis.
  • For OData Generic Client: Fix disableBufferingHttpResponse() in ODataRequestResultGeneric.

🐛 Known Issues​

  • For OData clients: This release changed the default HTTP response lifecycle for OData request-execution results.

    Until 5.19.0 the underlying OData Generic Client was "eagerly" consuming the HTTP response. With 5.20.0 it changed to "lazily" consuming the HTTP response while buffering the content. While this is considered a fix and acceptable change for the expert OData Generic Client, we unintentionally changed the behavior in the convenience classes for OData v2 and OData v4 as well. This behavior change in convenience API will be reverted with next 5.21.0.

    Affected users may observe the following exception message due to HTTP responses not being consumed and HTTP connections not being closed automatically:

    ConnectionPoolTimeoutException: Timeout waiting for connection from pool

    Please use 5.19.0 until this is fixed in 5.21.0.

5.19.0 - May 26, 2025​

All Release Changes

📈 Improvements​

  • Improve the detection and masking of secrets when logging data to debug.

🐛 Fixed Issues​

  • Fix OData v2 error: Disable Validation in the absence of DOCTYPE
  • Fix OData v2/v4 error: Navigating nextLink in paginated result-set no longer results in duplicate query parameters.

5.18.0 - April 16, 2025​

All Release Changes

🔧 Compatibility Notes​

  • Changed a behavior details when obtaining tokens from IAS with the default strategy CURRENT_TENANT. In case the current tenant is the provider tenant, and TenantAccessor.getCurrentTenant() is returning a Tenant object, this object is now required to have a subdomain != null.

🐛 Fixed Issues​

  • OpenAPI: When apiMaturity is set to beta, generated enums will now be @Beta annotated.

5.17.0 - February 20, 2025​

All Release Changes

🔧 Compatibility Notes​

  • Changes regarding the TLS Upgrade header thanks to Apache httpclient5 5.4.2
    • TlsUpgrade.DISABLED no changes
    • TlsUpgrade.ENABLED will not send the Upgrade header for non-proxy connections anymore
    • TlsUpgrade.AUTOMATIC Default behaviour will not send the Upgrade header anymore
      • Except for proxyType(ProxyType.INTERNET)

✨ New Functionality​

  • OpenAPI: Add toMap() and deprecate getCustomField(String) on generated model classes.

5.16.0 - January 29, 2025​

All Release Changes

✨ New Functionality​

  • Add experimental support for updating nested fields in OData v2 complex types via PATCH requests
    • Use optional argument FluentHelperUpdate#modifyingEntity( ModifyPatchStrategy ) to control updates with delta or full complex property payloads.

📈 Improvements​

  • Improve the OData v4 class BatchRequestBuilder to now also implement the ModificationRequestBuilder interface.

🐛 Fixed Issues​

  • Fix non-compilable code using OpenAPI generator with schema definitions having additionalProperties: true. Previously they would result in model classes extending HashMap, which disabled proper deserialization and serialization.

5.15.0 - December 19, 2024​

All Release Changes

✨ New Functionality​

  • Add support for TypeDefinition entries in OData V4 EDMX files.
  • Add generateApis and generateModels options to the openapi-generator-maven-plugin to disable the generation of APIs and models respectively.

📈 Improvements​

  • Stabilize most of the remaining experimental APIs without changes, e.g.
    • RequestHeaderAccessor
    • ServiceBindingDestinationLoader
  • OData v2 and v4 generators now use LinkedHashMap for the properties of the generated classes to maintain the order of the properties.

🐛 Fixed Issues​

  • Fix ApacheHttpClient5Wrapper to propagate the configuration to Spring RestTemplate.
  • Fix OData v2 and v4 generators to work when property name is value or values and is of collection type.
    • The internal variable is now respectively cloudSdkValue or cloudSdkValues to avoid conflicts with the value or values property.