Bump @cap-js/attachments from 3.13.3 to 4.0.0

[dependabot]

Bumps @cap-js/attachments from 3.13.3 to 4.0.0.

Release notes

Sourced from @​cap-js/attachments's releases.

v4.0.0

BREAKING CHANGE: The attachments plugin comes now without hyperscaler dependencies, please make sure to install them accordingly! BREAKING CHANGE: Projects that explicitly set attachments.outbox: true in their own CDS configuration must rename the key to outboxed.

Changed

• The outbox configuration key under cds.requires.attachments has been renamed to outboxed. A deprecation warning is logged at startup when the old key is detected.
• Cloud storage SDKs (@aws-sdk/client-s3, @aws-sdk/lib-storage, @azure/storage-blob, @google-cloud/storage) are now optional peer dependencies. Install only the SDK(s) for the provider you use (e.g. npm install @aws-sdk/client-s3 @aws-sdk/lib-storage for AWS S3). A clear error message with the exact install command is shown if a required SDK is missing at runtime.

Fixed

• Attachments are now served with Content-Disposition: attachment by default with inline being a toggle

v3.13.4

Fixed

• Fixed a race condition where a download-triggered re-scan could leave an attachment stuck in Scanning (causing clean files to be rejected on download). The redundant request-path status write in rescan has been removed; the spawned scan (_scanAttachmentsFile) already sets the status to Scanning as its first step. This also avoids holding a DB connection across the request rejection, which could drain the pool on single-connection databases.
• Non-draft PATCH now allows for deleting attachment arrays from the database.

Changelog

Sourced from @​cap-js/attachments's changelog.

Version 4.0.0 - 2026-08-03

BREAKING CHANGE: The attachments plugin comes now without hyperscaler dependencies, please make sure to install them accordingly! BREAKING CHANGE: Projects that explicitly set attachments.outbox: true in their own CDS configuration must rename the key to outboxed.

Changed

• The outbox configuration key under cds.requires.attachments has been renamed to outboxed. A deprecation warning is logged at startup when the old key is detected.
• Cloud storage SDKs (@aws-sdk/client-s3, @aws-sdk/lib-storage, @azure/storage-blob, @google-cloud/storage) are now optional peer dependencies. Install only the SDK(s) for the provider you use (e.g. npm install @aws-sdk/client-s3 @aws-sdk/lib-storage for AWS S3). A clear error message with the exact install command is shown if a required SDK is missing at runtime.

Fixed

• Attachments are now served with Content-Disposition: attachment by default with inline being a toggle

Version 3.13.4 - 2026-07-31

Fixed

• Fixed a race condition where a download-triggered re-scan could leave an attachment stuck in Scanning (causing clean files to be rejected on download). The redundant request-path status write in rescan has been removed; the spawned scan (_scanAttachmentsFile) already sets the status to Scanning as its first step. This also avoids holding a DB connection across the request rejection, which could drain the pool on single-connection databases.
• Non-draft PATCH now allows for deleting attachment arrays from the database.

Commits

• 147bae5 Prep for cds10 (#465)
• 03d2e2c Remove Inline Type from index.cds (#490)
• 1a972ed Optional deps (#453)
• 692d15d update: version 13.4 (#508)
• d55a30b fix: patch for array deletion (#507)
• 68beb38 fix: scan status race (#504)
• eddfde8 chore: Adjust unit tests (#500)
• fd04b18 Bump the github-actions group across 1 directory with 4 updates (#493)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)