import UBI git-lfs-3.7.1-5.el10_2.5

git-lfs.spec

@@ -1,8 +1,8 @@
 ## START: Set by rpmautospec
-## (rpmautospec version 0.8.3)
+## (rpmautospec version 0.8.4)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 4;
+    release_number = 5;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -26,7 +26,7 @@ Git extension for versioning large files.}
                         CONTRIBUTING.md README.md
 
 Name:           git-lfs
-Release:        %autorelease
+Release:        5%{?dist}.%{autorelease -n}
 Summary:        Git extension for versioning large files
 
 # See LICENSE.md for details.
@@ -38,6 +38,10 @@ Source1:        README.Fedora
 # https://github.com/git-lfs/git-lfs/pull/6237
 Patch0:         0001-commands-fix-format-string-type-mismatch-in-lockveri.patch
 
+# CVE-2026-39821: idna: fix ToUnicode and all-ASCII xn-- labels
+# https://github.com/golang/net/commit/8c4c965e028475082408749b50ed7a686df0d265
+Patch1:         git-lfs-3.7.1-CVE-2026-39821.patch
+
 # Generated provides by vendor2provides.py
 # https://src.fedoraproject.org/rpms/syncthing/blob/603e4e03a92a7d704d199629dd85304018e8279d/f/vendor2provides.py
 Provides:       bundled(golang(github.com/alexbrainman/sspi)) = 909beea
@@ -189,6 +193,9 @@ PATH=%{buildroot}%{_bindir}:%{gobuilddir}/bin:$PATH \
 
 %changelog
 ## START: Generated by rpmautospec
+* Thu Jun 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.7.1-5
+- Fix CVE-2026-39821 in vendored golang.org/x/net idna package
+
 * Tue Apr 28 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-4
 - Rebuild with new Golang