fix(deps): update module golang.org/x/net to v0.38.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
golang.org/x/net	v0.33.0 -> v0.38.0

GitHub Vulnerability Alerts

CVE-2025-22870

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

CVE-2025-22872

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.31.0 -> v0.36.0
golang.org/x/sync	v0.10.0 -> v0.12.0
golang.org/x/sys	v0.28.0 -> v0.31.0
golang.org/x/text	v0.21.0 -> v0.23.0

[druid-infra]

Renovate audit (druid-infra): inspected metadata, diff, head 2700d3f, reviews, and check runs.

• Diff: golang.org/x/net 0.33.0 -> 0.38.0 with coordinated x/crypto, x/sync, x/sys, and x/text updates; no application code changed.
• Test: Docker golang:1.23 go test -vet=off ./... -run ^$ passed (compile-only). A full go test ./... attempt did not complete within 600s; no dependency-specific failure was isolated.
• Browser: not applicable (Go dependency-only diff).
• Decision: not merged. PR is conflicting/dirty and has no check runs; refresh/rebase is required before evaluating the security update.

[druid-infra]

Daily Renovate audit (2026-09-04): inspected metadata, changed files/diff, head 2700d3f, reviews, mergeability, and check runs. Diff updates golang.org/x/net v0.33.0 to v0.38.0 and associated x/crypto, x/sync, x/sys, x/text versions in go.mod/go.sum; PR notes CVE-2025-22870 and CVE-2025-22872. Tests: Dockerized Go 1.24 go test ./... (timed out after 300s during module downloads); git diff --check (PASS). Browser coverage: not applicable (Go dependency metadata only). Release review: security update with transitive module changes; no usable upstream release endpoint was available for golang.org/x/net during this run. Merge decision: NOT MERGED — PR is conflicted (mergeable_state=dirty), has no check runs, and security-sensitive dependency updates are excluded from autonomous merge.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata, head 2700d3f6b7e12ee1b96be29e0b155fcb5fcc59a3, diff (go.mod/go.sum only), the listed x/net security advisories/release notes, review state, mergeability, and check runs. The update is golang.org/x/net v0.33.0 → v0.38.0 with coordinated x/crypto, x/sync, x/sys, and x/text bumps. Checks: no check runs reported. Dockerized narrow test (rerun after one transient failure): docker run --rm -v /tmp/druid-cli-pr-58:/app -w /app golang:1.24 bash -lc 'export PATH=/usr/local/go/bin:$PATH; go test ./test' — PASS on rerun. Broader go test ./... compiled packages but hit the repository's pre-existing debug/exec.go:54 vet/build error and timed out while integration work continued. Browser coverage: not applicable (Go dependency-only diff). Decision: NOT MERGED; GitHub reports mergeable_state=dirty, and CI/check evidence is absent.

[druid-infra]

Daily Renovate audit (2026-09-12), authenticated as druid-infra.

Inspected head 2700d3f6b7e12ee1b96be29e0b155fcb5fcc59a3, metadata, diff, review state, mergeability, and check runs. Diff is scoped to go.mod/go.sum, updating golang.org/x/net 0.33.0 → 0.38.0 plus the associated x/crypto, x/sync, x/sys, and x/text versions for the listed security advisories; no source files changed. No check runs are reported; GitHub reports mergeability dirty.

Tests in an isolated worktree using Docker golang:1.23:

• go test -timeout 120s ./test — PASS
• go test -count=1 -timeout 120s ./test — PASS (rerun after one earlier mock expectation failure)
• go build ./... — PASS
• git diff --check — PASS

Browser coverage: not applicable; this is a Go dependency/lockfile-only change with no UI surface. Decision: not merged. Blockers are the dirty/non-clean merge state, absent required check runs, and the explicit audit policy requiring user instruction before merging security-sensitive dependency changes.

[druid-infra]

Correction to this run's audit note: the first combined command on PR #58 stopped at the initial go test ./test mock-expectation failure, so go build ./... was not executed in that command. The subsequent independent go test -count=1 -timeout 120s ./test rerun passed. No build result is claimed for this run; the merge decision is unchanged because the PR is dirty, has no check runs, and is security-sensitive.

[druid-infra]

Renovate audit (druid-infra, 2026-09-13): inspected PR metadata, head 2700d3f6b7e12ee1b96be29e0b155fcb5fcc59a3, mergeability/review state, all check runs (0 check runs; combined status pending), and the full diff (go.mod/go.sum, golang.org/x/net 0.33.0→0.38.0 plus related x/* updates). Reviewed the PR’s release/security notes for CVE-2025-22870 and CVE-2025-22872; module sums are internally consistent and git diff --check passed. Dockerized compile coverage passed: docker run --rm -v <checkout>:/src -w /src golang:1.24.7 /usr/local/go/bin/go test -vet=off -run '^$' ./.... Full runtime tests were not claimed because the repository’s untagged integration packages run long-lived Docker tests; the compile-only command covered all packages. No browser test applies to this Go-only dependency diff. Decision: NOT MERGED — security-sensitive dependency change requires explicit instruction, and required checks are absent/pending with mergeability reported unknown.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata/head 2700d3f6b7e12ee1b96be29e0b155fcb5fcc59a3, diff (go.mod, go.sum), mergeability, reviews, and check runs. Release/security notes reviewed for golang.org/x/net v0.38.0 and its x/crypto, x/sync, x/sys, x/text updates (CVE-2025-22870 and CVE-2025-22872 noted). git diff --check passed. Attempted Dockerized Go validation with golang:1.24 and go test ./...; dependency download did not complete within the audit run, so no passing test result is claimed. Browser coverage: not applicable (Go dependency-only diff). Decision: not merged; GitHub reports mergeable_state=dirty, with no check runs, so clean/required-check criteria are not met.

[druid-infra]

Daily Renovate audit (druid-infra): inspected head 2700d3f6b7e12ee1b96be29e0b155fcb5fcc59a3, metadata/diff/reviews/check-runs. Diff is limited to go.mod/go.sum; golang.org/x/net 0.33.0→0.38.0 also updates indirect x/* modules and addresses the two documented CVEs. No reviews and zero check runs reported; mergeability is dirty. Reproduced in Dockerized Go 1.24: go test -vet=off ./... -run ^$ passed (compile-only); full go test ./... && go vet ./... did not pass because existing debug/exec.go:54 triggers the Go vet int-to-string diagnostic and TestProcessManager failed, then the command hit the 600s timeout. No browser coverage applicable (Go dependency-only diff). Decision: not merged; blocked by dirty mergeability, absent checks, and incomplete/full-test failure.