From 204a405ec2f0ee7834353e77705657d8c90fea5e Mon Sep 17 00:00:00 2001 From: Ngo Quoc Dat Date: Fri, 23 Oct 2026 00:12:41 +0700 Subject: [PATCH] build(plugin-hana): build the helper with Go 1.27.3 for GO-2026-6809 --- apple/Native/HanaBridge/THIRD_PARTY_NOTICES.md | 4 ++-- apple/Native/HanaBridge/go.mod | 2 +- apple/Native/HanaBridge/tools.mod | 2 +- apple/TablePro/Resources/ThirdPartyLicenses/licenses.yml | 8 ++++---- apple/changelog.d/3796.security.md | 1 + 5 files changed, 9 insertions(+), 8 deletions(-) create mode 100644 apple/changelog.d/3796.security.md diff --git a/apple/Native/HanaBridge/THIRD_PARTY_NOTICES.md b/apple/Native/HanaBridge/THIRD_PARTY_NOTICES.md index 15e6bf7ccc..d06651b110 100644 --- a/apple/Native/HanaBridge/THIRD_PARTY_NOTICES.md +++ b/apple/Native/HanaBridge/THIRD_PARTY_NOTICES.md @@ -8,7 +8,7 @@ everything below is statically linked into it. The helper ships inside the SAP H | --- | --- | --- | --- | | [go-hdb](https://github.com/SAP/go-hdb) | v1.18.12 | Apache-2.0 | 2014-2026 SAP SE or an SAP affiliate company and go-hdb contributors | | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | v0.42.0 | BSD-3-Clause | 2009 The Go Authors | -| [Go runtime and standard library](https://go.dev) | go1.27.2 | BSD-3-Clause | 2009 The Go Authors | +| [Go runtime and standard library](https://go.dev) | go1.27.3 | BSD-3-Clause | 2009 The Go Authors | The Go standard library vendors golang.org/x/crypto, x/net, x/sys and x/text. They carry the same BSD-3-Clause notice from The Go Authors as the standard library itself. @@ -20,6 +20,6 @@ The full license texts: - go-hdb: - golang.org/x/text: -- Go: +- Go: The app's acknowledgements carry the same three texts in `TablePro/Resources/ThirdPartyLicenses/texts/`. diff --git a/apple/Native/HanaBridge/go.mod b/apple/Native/HanaBridge/go.mod index 9e319be22c..8d4beb0f97 100644 --- a/apple/Native/HanaBridge/go.mod +++ b/apple/Native/HanaBridge/go.mod @@ -2,7 +2,7 @@ module github.com/TableProApp/TablePro/Native/HanaBridge go 1.27.0 -toolchain go1.27.2 +toolchain go1.27.3 require ( github.com/SAP/go-hdb v1.18.12 diff --git a/apple/Native/HanaBridge/tools.mod b/apple/Native/HanaBridge/tools.mod index 9db5eefaa2..79163769f5 100644 --- a/apple/Native/HanaBridge/tools.mod +++ b/apple/Native/HanaBridge/tools.mod @@ -2,7 +2,7 @@ module github.com/TableProApp/TablePro/Native/HanaBridge/tools go 1.27.0 -toolchain go1.27.2 +toolchain go1.27.3 tool honnef.co/go/tools/cmd/staticcheck diff --git a/apple/TablePro/Resources/ThirdPartyLicenses/licenses.yml b/apple/TablePro/Resources/ThirdPartyLicenses/licenses.yml index 541fddee71..2b833cd81f 100644 --- a/apple/TablePro/Resources/ThirdPartyLicenses/licenses.yml +++ b/apple/TablePro/Resources/ThirdPartyLicenses/licenses.yml @@ -215,20 +215,20 @@ ships.' - id: go name: Go (runtime and standard library) - version: 1.27.2 + version: 1.27.3 spdx: BSD-3-Clause copyrights: - Copyright 2009 The Go Authors homepageURL: https://go.dev - licenseTextURL: https://github.com/golang/go/blob/go1.27.2/LICENSE + licenseTextURL: https://github.com/golang/go/blob/go1.27.3/LICENSE textFile: texts/go.txt source: manual patched: false - notes: 'The toolchain line of Native/HanaBridge/go.mod pins go1.27.2. scripts/build-hana.sh builds + notes: 'The toolchain line of Native/HanaBridge/go.mod pins go1.27.3. scripts/build-hana.sh builds the bridge into tablepro-hana-helper, a CGO_ENABLED=0 executable the SAP HANA plugin carries in Contents/MacOS and runs as a separate process, so the Go runtime and every standard library package the helper reaches are linked into that executable. The standard - library vendors golang.org/x/crypto, x/net, x/sys and x/text (src/vendor/modules.txt at go1.27.2), + library vendors golang.org/x/crypto, x/net, x/sys and x/text (src/vendor/modules.txt at go1.27.3), all under this same BSD-3-Clause notice from The Go Authors. PATENTS beside LICENSE is an extra patent grant from Google and adds no notice duty. source is manual because the pin lives in go.mod, not in a build-*.sh variable, so scripts/ci/check-license-inventory.py does not check this version. diff --git a/apple/changelog.d/3796.security.md b/apple/changelog.d/3796.security.md new file mode 100644 index 0000000000..c20de7e056 --- /dev/null +++ b/apple/changelog.d/3796.security.md @@ -0,0 +1 @@ +SAP HANA connections accepting a server certificate issued through a compromised intermediate CA (GO-2026-6809).