From a1b4c0abbf07b1ad8c7dd0c81096d85ac8106390 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?= Date: Fri, 23 Oct 2026 01:10:23 +0700 Subject: [PATCH] build(plugin-hana): build the helper with Go 1.27.3 for GO-2026-6809 (#3796) (cherry picked from commit 532e957e8c581ffb9137a8ffc86874e2bc61f1bf) --- Native/HanaBridge/THIRD_PARTY_NOTICES.md | 4 ++-- Native/HanaBridge/go.mod | 2 +- Native/HanaBridge/tools.mod | 2 +- TablePro/Resources/ThirdPartyLicenses/licenses.yml | 8 ++++---- changelog.d/3796.security.md | 1 + 5 files changed, 9 insertions(+), 8 deletions(-) create mode 100644 changelog.d/3796.security.md diff --git a/Native/HanaBridge/THIRD_PARTY_NOTICES.md b/Native/HanaBridge/THIRD_PARTY_NOTICES.md index 15e6bf7ccc..d06651b110 100644 --- a/Native/HanaBridge/THIRD_PARTY_NOTICES.md +++ b/Native/HanaBridge/THIRD_PARTY_NOTICES.md @@ -8,7 +8,7 @@ everything below is statically linked into it. The helper ships inside the SAP H | --- | --- | --- | --- | | [go-hdb](https://github.com/SAP/go-hdb) | v1.18.12 | Apache-2.0 | 2014-2026 SAP SE or an SAP affiliate company and go-hdb contributors | | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | v0.42.0 | BSD-3-Clause | 2009 The Go Authors | -| [Go runtime and standard library](https://go.dev) | go1.27.2 | BSD-3-Clause | 2009 The Go Authors | +| [Go runtime and standard library](https://go.dev) | go1.27.3 | BSD-3-Clause | 2009 The Go Authors | The Go standard library vendors golang.org/x/crypto, x/net, x/sys and x/text. They carry the same BSD-3-Clause notice from The Go Authors as the standard library itself. @@ -20,6 +20,6 @@ The full license texts: - go-hdb: - golang.org/x/text: -- Go: +- Go: The app's acknowledgements carry the same three texts in `TablePro/Resources/ThirdPartyLicenses/texts/`. diff --git a/Native/HanaBridge/go.mod b/Native/HanaBridge/go.mod index 9e319be22c..8d4beb0f97 100644 --- a/Native/HanaBridge/go.mod +++ b/Native/HanaBridge/go.mod @@ -2,7 +2,7 @@ module github.com/TableProApp/TablePro/Native/HanaBridge go 1.27.0 -toolchain go1.27.2 +toolchain go1.27.3 require ( github.com/SAP/go-hdb v1.18.12 diff --git a/Native/HanaBridge/tools.mod b/Native/HanaBridge/tools.mod index 9db5eefaa2..79163769f5 100644 --- a/Native/HanaBridge/tools.mod +++ b/Native/HanaBridge/tools.mod @@ -2,7 +2,7 @@ module github.com/TableProApp/TablePro/Native/HanaBridge/tools go 1.27.0 -toolchain go1.27.2 +toolchain go1.27.3 tool honnef.co/go/tools/cmd/staticcheck diff --git a/TablePro/Resources/ThirdPartyLicenses/licenses.yml b/TablePro/Resources/ThirdPartyLicenses/licenses.yml index 029dea3b2f..b12a449300 100644 --- a/TablePro/Resources/ThirdPartyLicenses/licenses.yml +++ b/TablePro/Resources/ThirdPartyLicenses/licenses.yml @@ -215,20 +215,20 @@ ships.' - id: go name: Go (runtime and standard library) - version: 1.27.2 + version: 1.27.3 spdx: BSD-3-Clause copyrights: - Copyright 2009 The Go Authors homepageURL: https://go.dev - licenseTextURL: https://github.com/golang/go/blob/go1.27.2/LICENSE + licenseTextURL: https://github.com/golang/go/blob/go1.27.3/LICENSE textFile: texts/go.txt source: manual patched: false - notes: 'The toolchain line of Native/HanaBridge/go.mod pins go1.27.2. scripts/build-hana.sh builds + notes: 'The toolchain line of Native/HanaBridge/go.mod pins go1.27.3. scripts/build-hana.sh builds the bridge into tablepro-hana-helper, a CGO_ENABLED=0 executable the SAP HANA plugin carries in Contents/MacOS and runs as a separate process, so the Go runtime and every standard library package the helper reaches are linked into that executable. The standard - library vendors golang.org/x/crypto, x/net, x/sys and x/text (src/vendor/modules.txt at go1.27.2), + library vendors golang.org/x/crypto, x/net, x/sys and x/text (src/vendor/modules.txt at go1.27.3), all under this same BSD-3-Clause notice from The Go Authors. PATENTS beside LICENSE is an extra patent grant from Google and adds no notice duty. source is manual because the pin lives in go.mod, not in a build-*.sh variable, so scripts/ci/check-license-inventory.py does not check this version. diff --git a/changelog.d/3796.security.md b/changelog.d/3796.security.md new file mode 100644 index 0000000000..c20de7e056 --- /dev/null +++ b/changelog.d/3796.security.md @@ -0,0 +1 @@ +SAP HANA connections accepting a server certificate issued through a compromised intermediate CA (GO-2026-6809).