Fix CVE-2026-39821 in vendored golang.org/x/net idna package

Backport upstream golang/net commit 8c4c965e02847508 to fix
CVE-2026-39821 in the vendored golang.org/x/net/idna package.

The fix corrects ToUnicode to properly reject xn-- labels that
decode to all-ASCII labels. The patch was adapted to target
the vendored copy under vendor/golang.org/x/net/idna/.

CVE: CVE-2026-33811, CVE-2026-39821
Upstream patches:
 - 8c4c965e02.patch
Resolves: RHEL-183843, RHEL-187313

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

git-lfs.spec

@@ -9,7 +9,7 @@ Version:                3.7.1
 %global gobuilddir %{_builddir}/%{name}-%{version}/_build
 
 Name:           git-lfs
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        Git extension for versioning large files
 
 License:        MIT
@@ -20,6 +20,9 @@ Source1:        README.Fedora
 # https://github.com/git-lfs/git-lfs/pull/6237
 Patch0:         0001-commands-fix-format-string-type-mismatch-in-lockveri.patch
 
+# https://github.com/golang/net/commit/8c4c965e028475082408749b50ed7a686df0d265
+Patch1:         git-lfs-3.7.1-CVE-2026-39821.patch
+
 # Generated provides by vendor2provides.py
 # https://src.fedoraproject.org/rpms/syncthing/blob/603e4e03a92a7d704d199629dd85304018e8279d/f/vendor2provides.py
 Provides:       bundled(golang(github.com/alexbrainman/sspi)) = 909beea
@@ -159,6 +162,10 @@ PATH=%{buildroot}%{_bindir}:%{gobuilddir}/bin:$PATH \
 
 
 %changelog
+* Tue Jul 14 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.7.1-6
+- Fix CVE-2026-39821 in vendored golang.org/x/net/idna
+- Resolves: RHEL-183843, RHEL-187313
+
 * Mon May 19 2026 Ondřej Pohořelský <opohorel@redhat.com> - 3.7.1-5
 - Rebuild with new Golang
 - Resolves: RHEL-156656, RHEL-166700, RHEL-167695, RHEL-167389, RHEL-166345, RHEL-177321