chore(all): update module golang.org/x/net to v0.36.0 [SECURITY]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
golang.org/x/net	v0.34.0 -> v0.36.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-22870

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: endpoints/go.sum

Command failed: install-tool golang 1.21.13

File name: run/h2c/go.sum

Command failed: install-tool golang 1.21.13

File name: run/testing/go.sum

Command failed: install-tool golang 1.21.13

[gemini-code-assist]

Hello @renovate-bot, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

This pull request updates the golang.org/x/net module from version v0.34.0 to v0.36.0 in two go.mod files. This update is marked as a security update by Mend Renovate due to CVE-2025-22870. The vulnerability involves improper matching of hosts against proxy patterns, potentially leading to requests bypassing proxies when they should not.

Highlights

• Dependency Update: The pull request updates the golang.org/x/net module to version v0.36.0.
• Security Patch: This update addresses CVE-2025-22870, a security vulnerability related to proxy pattern matching.

Changelog

• run/h2c/go.mod
  • Updated golang.org/x/net from v0.34.0 to v0.36.0.
• run/testing/go.mod
  • Updated golang.org/x/net from v0.34.0 to v0.36.0.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Trivia time!

What is the purpose of the go.mod file in a Go project?

Click here for the answer

The `go.mod` file defines the module's module path and its dependency requirements, which are used for reproducible builds.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This PR updates the golang.org/x/net module to v0.36.0 to address CVE-2025-22870. The changes involve updating the go.mod files in the run/h2c and run/testing directories. Overall, the update seems straightforward.

Summary of Findings

• Security Vulnerability: The primary purpose of this update is to address CVE-2025-22870, which involves improper handling of IPv6 zone IDs in proxy matching. It's crucial to ensure that this update effectively mitigates the vulnerability.

Merge Readiness

The pull request updates a dependency to address a security vulnerability. Given the nature of the fix, it is recommended to merge this pull request after verifying that the updated version resolves the reported vulnerability and doesn't introduce any regressions. I am unable to directly approve the pull request, and users should have others review and approve this code before merging.

[gemini-code-assist]

This line updates the golang.org/x/net dependency. Ensure that all dependent modules are compatible with this new version.

require golang.org/x/net v0.36.0

[forking-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.