fix(deps): update module golang.org/x/net to v0.36.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
golang.org/x/net	v0.35.0 -> v0.36.0

GitHub Vulnerability Alerts

CVE-2025-22870

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: renovate[bot]
Once this PR has been reviewed and has the lgtm label, please assign luap99 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[packit-as-a-service]

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

[danishprakash]

Does CVE-2025-22870 affect podman? I couldn't find a direct code path even though podman vendors the affected piece of code.

[Luap99]

@danishprakash I have no done a proper look but I think we are using the standard library for our http requests so in that case I don't think it would matter. Reading the description doesn't sounds like it is an actual real issue. Bypassing a proxy when talking to link local addresses, I am not sure we can 0even use such addresses anywhere. DNS cannot resolve them and the direct ipv6 syntax for registry pushes/pulls is not support by c/image. Sounds totally unlikely that someone has a NO_PROXY that matches a link local zone ID that would work.