upgrade linter to 2.13.1

Signed-off-by: Ryan Richard <richardry@vmware.com>

hack/lib/lint-version.txt

@@ -1 +1 @@
-2.11.4
+2.13.1

internal/controller/authenticator/authncache/cache_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package authncache
@@ -74,6 +74,7 @@ func TestCache(t *testing.T) {
 	}
 	for range 10 {
 		cache := New()
+		//nolint:gosec // this is a test, and the shuffle does not need to be cryptographically random
 		for _, i := range rand.Perm(len(keysInExpectedOrder)) {
 			cache.Store(keysInExpectedOrder[i], nil)
 		}

internal/controllerinit/controllerinit.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package controllerinit
@@ -78,7 +78,7 @@ func anyToFullname(a any) string {
 }
 
 func typeToFullname(typ reflect.Type) string {
-	if typ.Kind() == reflect.Ptr {
+	if typ.Kind() == reflect.Pointer {
 		typ = typ.Elem()
 	}
 	return typ.PkgPath() + "." + typ.Name()

internal/federationdomain/endpoints/auth/auth_handler.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // Package auth provides a handler for the OIDC authorization endpoint.
@@ -139,6 +139,7 @@ func (h *authorizeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if shouldShowIDPChooser(h.idpFinder, idpNameQueryParamValue, requestedBrowserlessFlow) {
 		// Redirect to the IDP chooser page with all the same query/form params. When the user chooses an IDP,
 		// it will redirect back to here with all the same params again, with the pinniped_idp_name param added.
+		//nolint:gosec // not an open redirect: the destination is always this server's own issuer URL
 		http.Redirect(w, r,
 			fmt.Sprintf("%s%s?%s", h.downstreamIssuerURL, oidc.ChooseIDPEndpointPath, r.Form.Encode()),
 			http.StatusSeeOther,
@@ -289,6 +290,7 @@ func (h *authorizeHandler) authorizeWithBrowser(
 		return "", err
 	}
 
+	//nolint:gosec // not an open redirect: redirectURL is built from operator-configured IDP settings
 	http.Redirect(w, r, redirectURL,
 		http.StatusSeeOther, // match fosite and https://tools.ietf.org/id/draft-ietf-oauth-security-topics-18.html#section-4.11
 	)
@@ -509,6 +511,7 @@ func addCSRFSetCookieHeader(w http.ResponseWriter, csrfValue csrftoken.CSRFToken
 		return fmt.Errorf("error encoding CSRF cookie: %w", err)
 	}
 
+	//nolint:gosec // SameSite=None is intentional and required for response_mode=form_post
 	http.SetCookie(w, &http.Cookie{
 		// Because of the other settings below, this value can only be known by the end user's browser, not by other sites.
 		Value: encodedCSRFValue,

internal/federationdomain/endpoints/login/post_login_handler.go

@@ -139,6 +139,7 @@ func redirectToLoginPage(
 		return err
 	}
 
+	//nolint:gosec // not an open redirect: the destination is always this server's own issuer URL
 	http.Redirect(w, r,
 		loginURL,
 		http.StatusSeeOther, // match fosite and https://tools.ietf.org/id/draft-ietf-oauth-security-topics-18.html#section-4.11

internal/federationdomain/endpointsmanager/manager_test.go

@@ -200,6 +200,7 @@ func TestManager(t *testing.T) {
 			numberOfKubeActionsBeforeThisRequest := len(kubeClient.Actions())
 
 			getRequest := newGetRequest(requestIssuer + oidc.CallbackEndpointPath + requestURLSuffix)
+			//nolint:gosec // this is a request cookie in a test, so response-only attributes do not apply
 			getRequest.AddCookie(&http.Cookie{
 				Name:  "__Host-pinniped-csrf-v2",
 				Value: csrfCookieValue,

internal/groupsuffix/groupdata.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package groupsuffix
@@ -25,13 +25,8 @@ func ConciergeAggregatedGroups(apiGroupSuffix string) (login, identity GroupData
 		panic("static group input is invalid")
 	}
 
-	return GroupData{
-			Group:   loginConciergeAPIGroup,
-			Version: loginv1alpha1.SchemeGroupVersion.Version,
-		}, GroupData{
-			Group:   identityConciergeAPIGroup,
-			Version: identityv1alpha1.SchemeGroupVersion.Version,
-		}
+	return GroupData{Group: loginConciergeAPIGroup, Version: loginv1alpha1.SchemeGroupVersion.Version},
+		GroupData{Group: identityConciergeAPIGroup, Version: identityv1alpha1.SchemeGroupVersion.Version}
 }
 
 func SupervisorAggregatedGroups(apiGroupSuffix string) (clientSecret GroupData) {

internal/net/phttp/warning.go

@@ -40,7 +40,6 @@ func getWarningHandler() rest.WarningHandler {
 	// the client-go rest.WarningHandlers all log warnings with non-empty message and code=299, agent is ignored
 
 	// no deduplication or color output when running from a non-terminal such as a pod
-	//nolint:gosec // casting to an int is the documented way to call this function
 	if isTerm := term.IsTerminal(int(os.Stderr.Fd())); !isTerm {
 		return rest.WarningLogger{}
 	}

internal/upstreamgithub/upstreamgithub_test.go

@@ -126,7 +126,6 @@ func TestExchangeAuthcode(t *testing.T) {
 				require.NotEmpty(t, r.Header.Get("Content-Length"))
 
 				// Get the params.
-				//nolint:gosec // this is a test, so we don't care about limiting request body size
 				err := r.ParseForm()
 				require.NoError(t, err)
 				params := r.PostForm

internal/upstreamoidc/upstreamoidc_test.go

@@ -284,7 +284,6 @@ func TestProviderConfig(t *testing.T) {
 			t.Run(tt.name, func(t *testing.T) {
 				tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					require.Equal(t, http.MethodPost, r.Method)
-					//nolint:gosec // this is a test, so we don't care about limiting request body size
 					require.NoError(t, r.ParseForm())
 					require.Equal(t, 6, len(r.Form))
 					require.Equal(t, "password", r.Form.Get("grant_type"))
@@ -457,7 +456,6 @@ func TestProviderConfig(t *testing.T) {
 			t.Run(tt.name, func(t *testing.T) {
 				tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					require.Equal(t, http.MethodPost, r.Method)
-					//nolint:gosec // this is a test, so we don't care about limiting request body size
 					require.NoError(t, r.ParseForm())
 					require.Equal(t, 4, len(r.Form))
 					require.Equal(t, "test-client-id", r.Form.Get("client_id"))
@@ -696,7 +694,6 @@ func TestProviderConfig(t *testing.T) {
 					numRequests++
 					require.LessOrEqual(t, numRequests, 2)
 					require.Equal(t, http.MethodPost, r.Method)
-					//nolint:gosec // this is a test, so we don't care about limiting request body size
 					require.NoError(t, r.ParseForm())
 					if numRequests == 1 {
 						// First request should use client_id/client_secret params.
@@ -1455,7 +1452,6 @@ func TestProviderConfig(t *testing.T) {
 			t.Run(tt.name, func(t *testing.T) {
 				tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					require.Equal(t, http.MethodPost, r.Method)
-					//nolint:gosec // this is a test, so we don't care about limiting request body size
 					require.NoError(t, r.ParseForm())
 					require.Len(t, r.Form, 6)
 					require.Equal(t, "test-client-id", r.Form.Get("client_id"))

pkg/oidcclient/login.go

@@ -77,7 +77,6 @@ const (
 
 // stdin returns the file descriptor for stdin as an int.
 func stdin() int {
-	//nolint:gosec // casting like this is the documented way to pass file descriptors to the term package
 	return int(os.Stdin.Fd())
 }
 

pkg/oidcclient/login_test.go

@@ -325,7 +325,6 @@ func TestLogin(t *testing.T) { //nolint:gocyclo
 			http.Error(w, "unexpected method", http.StatusMethodNotAllowed)
 			return
 		}
-		//nolint:gosec // this is a test, so we don't care about limiting request body size
 		if err := r.ParseForm(); err != nil {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return

test/integration/formposthtml_test.go

@@ -121,13 +121,11 @@ func formpostCallbackServer(t *testing.T) (string, func(*testing.T, url.Values))
 		// Allow CORS requests.
 		w.Header().Set("Access-Control-Allow-Origin", "*")
 
-		//nolint:gosec // this is a test, so we don't care about limiting request body size
 		assert.NoError(t, r.ParseForm())
 
 		// Extract only the POST parameters (r.Form also contains URL query parameters).
 		postParams := url.Values{}
 		for k := range r.Form {
-			//nolint:gosec // this is a test, so we don't care about limiting request body size
 			if v := r.PostFormValue(k); v != "" {
 				postParams.Set(k, v)
 			}