[bkohenkel]

Fixes #155

@sap/cds-dk is only needed for the cds build plugin, and cds-plugin.js already
guards that with cds.build?.register?.(...) — at runtime the plugin works
without cds-dk.

Because the peer is currently required, npm 7+ auto-installs @sap/cds-dk into
every consuming app's production dependency tree. Its bundled dependencies
(e.g. handlebars) then show up in security scans and cannot be fixed via
overrides, forcing apps to use legacy-peer-deps.

Marking the peer as optional preserves compatibility validation when
@sap/cds-dk is installed, while preventing npm from installing it
automatically for runtime-only consumers.

Verified in a clean consumer project that installing @cap-js/notifications
without @sap/cds-dk no longer installs cds-dk, while the runtime plugin still
loads; with @sap/cds-dk installed, the notifications build task is still
registered.

[daogrady]

Thanks for your contribution!
Without being too deep into this particular code base, I believe your proposed change makes sense.

I am no sure why the Node22 test suite fails, but since it works properly on Node24, I'd say we're good.

[bkohenkel]

Hi @daogrady
Looks to me test Node 22 is breaking because cf login fails.

Thanks
Branimir

[daogrady]

Hi @bkohenkel ,

pipeline is green and merged, thanks again for the contribution!
I can not give you a strict timeline on when the next release will take place that includes this fix, as that is under the governance of the team picking this project up.

Best,
Daniel