Bump the toolchain group with 3 updates

[dependabot]

Bumps the toolchain group with 3 updates: @abaplint/cli, @abap2ui5/linter and @abap2ui5/render-runtime.

Updates @abaplint/cli from 2.120.39 to 2.120.42

Commits

• c42023f chore(release): v2.120.42 (#4263)
• 40f09ee allow in open-abap (#4262)
• 1b016e4 chore(release): v2.120.41 (#4261)
• db59281 bugfixes (#4260)
• c9e292e chore(release): v2.120.40 (#4259)
• f6e85ff FORMs fix (#4245)
• See full diff in compare view

Updates @abap2ui5/linter from 0.5.1 to 0.6.1

Release notes

Sourced from @​abap2ui5/linter's releases.

v0.6.1

See CHANGELOG.md.

v0.6.0

See CHANGELOG.md.

Changelog

Sourced from @​abap2ui5/linter's changelog.

0.6.1 - 2026-08-30

• A bound control in a FOREIGN namespace makes its children rows again. The property walk declines to look into a non-sap. namespace - abap2UI5's own z2ui5.cc controls, raw XHTML, any in-house library - because the UI5 metadata can say nothing about it. It handed the children null for both owner and context, and "no aggregation here" quietly became "no ROW here":

  <z2ui5:CameraSelector items="{path:'/DEVICES'}">
    <core:Item key="{KEY}" text="{TEXT}"/>
  

  is the ordinary bound-template form, and relative-binding-without-context reported both attributes as resolving against nothing (abap2UI5/samples app 306). Every one of these controls extends a real one - CameraSelector extends sap.m.ComboBox and inherits its items - so this fires on any bound custom control, as an error.

  The owner handed across stays opaque in every other respect (control: null, empty aggRows), so nothing guesses at an aggregation, which is what the foreign-namespace rule is actually protecting. Any binding on the tag counts, not only one that looks like an aggregation: on a control the metadata does not carry the two are indistinguishable, and being wrong is asymmetric - reading a property binding as a context only makes the two "is there a context here" rules go quiet on that subtree, while reading a real aggregation binding as none invents a defect.

  A foreign tag with no binding still opens no context, and its children are judged exactly as before; the regression test asserts both directions. Measured: no change over abap2UI5/samples-controls (752 findings before and after), which is the corpus with no custom controls in it.

0.6.0 - 2026-08-30

• WITH DEFAULT KEY parses, and the rules that resolve against a row see something again. A table declaration is anchored on its terminating dot, and only WITH EMPTY KEY was allowed in front of it — so DATA t TYPE STANDARD TABLE OF ty WITH DEFAULT KEY, the commonest spelling in ABAP, fell through to the scalar branch: the model carried '' where a row array belongs, and every rule resolving against a ROW went quiet on it. SORTED and HASHED tables were not recognized as tables at all. This outranks any single rule below, because it decides whether those rules see anything.

• 17 new rules, mined from what was already written down. The frontend's own declarations are read in full now rather than in projections: control-call-arg-count and control-call-arg-kind (arity and argument kinds, from the whole method map), frontend-action-too-new — a global target resolved through a lazy require is silent below its release, and member-too-new judged what the view writes while nothing judged what the class sends — and invalid-aggregation-item, where an <id>/<aggregation>/<index> reference was judged on its head segment only.

... (truncated)

Commits

• 798d520 release v0.6.1
• 5f736ec Give a bound control in a foreign namespace its row context back (#82)
• d42d70e release v0.6.0
• 7263cb5 Read a chained DATA: past its first name in the two section collectors (#81)
• f16f4cc Mine the staging areas: 17 rules, a metadata harvest and a reconstructor fix ...
• e8c7b93 Reconstruct the _bind cell binding instead of dropping its attribute (#79)
• 602494c Read abap2UI5's arg shorthand in the two event-argument rules (#78)
• 89013ce Three places where the escaping stops one character short (#77)
• 674b183 The third windows-latest failure, plus a check that checks and timeouts on ...
• b0efc6d Two of the three windows-latest failures, and a drift gate that names the dri...
• Additional commits viewable in compare view

Updates @abap2ui5/render-runtime from 0.5.1 to 0.6.1

Release notes

Sourced from @​abap2ui5/render-runtime's releases.

v0.6.1

See CHANGELOG.md.

v0.6.0

See CHANGELOG.md.

Changelog

Sourced from @​abap2ui5/render-runtime's changelog.

0.6.1 - 2026-08-30

• A bound control in a FOREIGN namespace makes its children rows again. The property walk declines to look into a non-sap. namespace - abap2UI5's own z2ui5.cc controls, raw XHTML, any in-house library - because the UI5 metadata can say nothing about it. It handed the children null for both owner and context, and "no aggregation here" quietly became "no ROW here":

  <z2ui5:CameraSelector items="{path:'/DEVICES'}">
    <core:Item key="{KEY}" text="{TEXT}"/>
  

  is the ordinary bound-template form, and relative-binding-without-context reported both attributes as resolving against nothing (abap2UI5/samples app 306). Every one of these controls extends a real one - CameraSelector extends sap.m.ComboBox and inherits its items - so this fires on any bound custom control, as an error.

  The owner handed across stays opaque in every other respect (control: null, empty aggRows), so nothing guesses at an aggregation, which is what the foreign-namespace rule is actually protecting. Any binding on the tag counts, not only one that looks like an aggregation: on a control the metadata does not carry the two are indistinguishable, and being wrong is asymmetric - reading a property binding as a context only makes the two "is there a context here" rules go quiet on that subtree, while reading a real aggregation binding as none invents a defect.

  A foreign tag with no binding still opens no context, and its children are judged exactly as before; the regression test asserts both directions. Measured: no change over abap2UI5/samples-controls (752 findings before and after), which is the corpus with no custom controls in it.

0.6.0 - 2026-08-30

• WITH DEFAULT KEY parses, and the rules that resolve against a row see something again. A table declaration is anchored on its terminating dot, and only WITH EMPTY KEY was allowed in front of it — so DATA t TYPE STANDARD TABLE OF ty WITH DEFAULT KEY, the commonest spelling in ABAP, fell through to the scalar branch: the model carried '' where a row array belongs, and every rule resolving against a ROW went quiet on it. SORTED and HASHED tables were not recognized as tables at all. This outranks any single rule below, because it decides whether those rules see anything.

• 17 new rules, mined from what was already written down. The frontend's own declarations are read in full now rather than in projections: control-call-arg-count and control-call-arg-kind (arity and argument kinds, from the whole method map), frontend-action-too-new — a global target resolved through a lazy require is silent below its release, and member-too-new judged what the view writes while nothing judged what the class sends — and invalid-aggregation-item, where an <id>/<aggregation>/<index> reference was judged on its head segment only.

... (truncated)

Commits

• 798d520 release v0.6.1
• d42d70e release v0.6.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions