Update golang.org/x/net to address two CVEs

[matthewbjones]

Addresses two CVEs in golang/net by upgrading to 0.39.0 (latest)

CVE-2025-22870 (4.4 score, fixed in 0.36.0)
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

CVE-2025-22872 (5.3 score, fixed in 0.38.0)
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Fixes Issue #73

[matthewbjones]

Related to #71, but updates to latest version 0.37.0

[MattKitmanLabs]

@kevinmcconnell Any chance you could cut a release with the CVE fixes in?

Just wanted to ask politely.

[matthewbjones]

@kevinmcconnell just wanted to touch base on addressing this CVE, and the already-merged-but-not-released CVE fix 5f38465

[matthewbjones]

@kevinmcconnell updated PR to address another CVE (CVE-2025-22872)

[kevinmcconnell]

Thanks @matthewbjones, I'll get this shipped!

[matthewbjones]

@kevinmcconnell I got one more CVE fix incoming

[kevinmcconnell]

@matthewbjones ah, I just shipped a new version before seeing that message! But I had also bumped the Go version to latest, so I think we're all good?

https://github.com/basecamp/thruster/tree/v0.1.13

[matthewbjones]

@kevinmcconnell no worries, I see you've released thruster 0.1.13, I'm updating now and will have Docker Scout analyze the docker image and confirm all 4 CVEs from the last few weeks have been addressed via the various updates

[matthewbjones]

@kevinmcconnell I can confirm that thruster 0.1.13 addresses the four CVEs:
CVE-2025-22871
CVE-2025-22872
CVE-2025-22870
CVE-2025-22869

Thanks for working with me to get those dependencies updated

[kevinmcconnell]

Great, thanks @matthewbjones. I appreciate your help with these!