Skip to content

build(plugin-hana): build the helper with Go 1.27.3 for GO-2026-6809 (#3796) #3799

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
datlechin merged 1 commit into from
Oct 22, 2026
Merged

build(plugin-hana): build the helper with Go 1.27.3 for GO-2026-6809 (#3796) #3799

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Native/HanaBridge/THIRD_PARTY_NOTICES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ everything below is statically linked into it. The helper ships inside the SAP H
| --- | --- | --- | --- |
| [go-hdb](https://github.com/SAP/go-hdb) | v1.18.12 | Apache-2.0 | 2014-2026 SAP SE or an SAP affiliate company and go-hdb contributors |
| [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | v0.42.0 | BSD-3-Clause | 2009 The Go Authors |
| [Go runtime and standard library](https://go.dev) | go1.27.2 | BSD-3-Clause | 2009 The Go Authors |
| [Go runtime and standard library](https://go.dev) | go1.27.3 | BSD-3-Clause | 2009 The Go Authors |

The Go standard library vendors golang.org/x/crypto, x/net, x/sys and x/text. They carry the same BSD-3-Clause notice
from The Go Authors as the standard library itself.
Expand All @@ -20,6 +20,6 @@ The full license texts:

- go-hdb: <https://github.com/SAP/go-hdb/blob/v1.18.12/LICENSE.md>
- golang.org/x/text: <https://github.com/golang/text/blob/v0.42.0/LICENSE>
- Go: <https://github.com/golang/go/blob/go1.27.2/LICENSE>
- Go: <https://github.com/golang/go/blob/go1.27.3/LICENSE>

The app's acknowledgements carry the same three texts in `TablePro/Resources/ThirdPartyLicenses/texts/`.
2 changes: 1 addition & 1 deletion Native/HanaBridge/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ module github.com/TableProApp/TablePro/Native/HanaBridge

go 1.27.0

toolchain go1.27.2
toolchain go1.27.3

require (
github.com/SAP/go-hdb v1.18.12
Expand Down
2 changes: 1 addition & 1 deletion Native/HanaBridge/tools.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ module github.com/TableProApp/TablePro/Native/HanaBridge/tools

go 1.27.0

toolchain go1.27.2
toolchain go1.27.3

tool honnef.co/go/tools/cmd/staticcheck

Expand Down
8 changes: 4 additions & 4 deletions TablePro/Resources/ThirdPartyLicenses/licenses.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,20 +215,20 @@
ships.'
- id: go
name: Go (runtime and standard library)
version: 1.27.2
version: 1.27.3
spdx: BSD-3-Clause
copyrights:
- Copyright 2009 The Go Authors
homepageURL: https://go.dev
licenseTextURL: https://github.com/golang/go/blob/go1.27.2/LICENSE
licenseTextURL: https://github.com/golang/go/blob/go1.27.3/LICENSE
textFile: texts/go.txt
source: manual
patched: false
notes: 'The toolchain line of Native/HanaBridge/go.mod pins go1.27.2. scripts/build-hana.sh builds
notes: 'The toolchain line of Native/HanaBridge/go.mod pins go1.27.3. scripts/build-hana.sh builds
the bridge into tablepro-hana-helper, a CGO_ENABLED=0 executable the SAP HANA plugin carries in
Contents/MacOS and runs as a separate process, so the Go runtime and every standard library package
the helper reaches are linked into that executable. The standard
library vendors golang.org/x/crypto, x/net, x/sys and x/text (src/vendor/modules.txt at go1.27.2),
library vendors golang.org/x/crypto, x/net, x/sys and x/text (src/vendor/modules.txt at go1.27.3),
all under this same BSD-3-Clause notice from The Go Authors. PATENTS beside LICENSE is an extra
patent grant from Google and adds no notice duty. source is manual because the pin lives in go.mod,
not in a build-*.sh variable, so scripts/ci/check-license-inventory.py does not check this version.
Expand Down
1 change: 1 addition & 0 deletions changelog.d/3796.security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
SAP HANA connections accepting a server certificate issued through a compromised intermediate CA (GO-2026-6809).
Loading