Resolves: RHEL-183733

.gitignore

@@ -11,3 +11,5 @@ SOURCES/grafana-pcp-webpack-3.2.0-1.tar.gz
 /grafana-pcp-vendor-5.1.1-8.tar.xz
 /grafana-pcp-vendor-5.1.1-15.tar.xz
 /grafana-pcp-webpack-5.1.1-15.tar.gz
+/grafana-pcp-vendor-5.1.1-16.tar.xz
+/grafana-pcp-webpack-5.1.1-16.tar.gz

1001-vendor-fix-idna-unicode-version-gate.patch

@@ -0,0 +1,12 @@
+diff --git a/vendor/golang.org/x/net/idna/idna.go b/vendor/golang.org/x/net/idna/idna.go
+--- a/vendor/golang.org/x/net/idna/idna.go
++++ b/vendor/golang.org/x/net/idna/idna.go
+@@ -400,7 +400,7 @@
+ 				// Spec says keep the old label.
+ 				continue
+ 			}
+-			if unicode16 && err == nil && len(u) > 0 && isASCII(u) {
++			if err == nil && len(u) > 0 && isASCII(u) {
+ 				err = punyError(enc)
+ 			}
+ 			isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight

grafana-pcp.spec

@@ -16,7 +16,7 @@ end}
 
 Name:           grafana-pcp
 Version:        5.1.1
-Release:        15%{?dist}
+Release:        16%{?dist}
 Summary:        Performance Co-Pilot Grafana Plugin
 License:        ASL 2.0
 URL:            https://github.com/performancecopilot/grafana-pcp
@@ -40,6 +40,9 @@ Patch1:         0001-remove-unused-frontend-crypto.patch
 Patch2:         0002-add-uwsgi-dashboard.patch
 Patch3:         0003-fix-x-net-CVE.patch
 
+# Patches affecting the vendor tarball
+Patch1001:      1001-vendor-fix-idna-unicode-version-gate.patch
+
 # Intersection of go_arches and nodejs_arches
 ExclusiveArch: %{grafanapcp_arches}
 
@@ -139,6 +142,8 @@ bpftrace scripts from pmdabpftrace(1), as well as several dashboards.
 %patch -P 2 -p1
 %patch -P 3 -p1
 
+%patch -P 1001 -p1
+
 %build
 # Build frontend data sources
 %if %{compile_frontend}
@@ -196,6 +201,9 @@ yarn test
 
 
 %changelog
+* Wed Jul 01 2026 Sam Feifer <sfeifer@redhat.com> - 5.1.1-16
+- Resolves RHEL-183733: CVE-2026-39821
+
 * Tue Jun 23 2026 Sam Feifer <sfeifer@redhat.com> - 5.1.1-15
 - Resolves RHEL-183733: CVE-2026-39821