upgrade linter and fix/ignore all new lint warnings

pkg/oidcclient/filesession/filesession_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package filesession
@@ -310,6 +310,7 @@ func TestPutToken(t *testing.T) {
 							Type:   "Bearer",
 							Expiry: metav1.NewTime(now.Add(-1 * time.Hour)),
 						},
+						//nolint:gosec // not a real credential
 						IDToken: &oidctypes.IDToken{
 							Token:  "old-id-token2",
 							Expiry: metav1.NewTime(now.Add(-1 * time.Hour)),
@@ -508,6 +509,7 @@ func (e *errorCollector) require(want []string, subs ...string) {
 	require.Len(e.t, e.saw, len(want))
 	for i, w := range want {
 		for i := 0; i < len(subs); i += 2 {
+			//nolint:gosec // these indices will not be out of bounds as long as callers pass the expected number of arguments
 			w = strings.ReplaceAll(w, subs[i], subs[i+1])
 		}
 		require.EqualError(e.t, e.saw[i], w)

pkg/oidcclient/login.go

@@ -76,7 +76,10 @@ const (
 )
 
 // stdin returns the file descriptor for stdin as an int.
-func stdin() int { return int(os.Stdin.Fd()) }
+func stdin() int {
+	//nolint:gosec // casting like this is the documented way to pass file descriptors to the term package
+	return int(os.Stdin.Fd())
+}
 
 type handlerState struct {
 	// Basic parameters.
@@ -1234,7 +1237,7 @@ func (h *handlerState) handleRefresh(ctx context.Context, refreshToken *oidctype
 // these messages would be the same. Note that using httperr.Wrap will cause the details of the wrapped
 // err to be printed by the CLI, but not printed in the browser due to the way that the httperr package
 // works, so avoid using httperr.Wrap in this function.
-func (h *handlerState) handleAuthCodeCallback(w http.ResponseWriter, r *http.Request) (returnedErr error) {
+func (h *handlerState) handleAuthCodeCallback(w http.ResponseWriter, r *http.Request) (returnedErr error) { //nolint:funlen
 	defer func() {
 		// If we returned an error, then also report it back over the channel to the main CLI goroutine.
 		// Because returnedErr is the named return value, inside this defer returnedErr will hold the value
@@ -1286,6 +1289,7 @@ func (h *handlerState) handleAuthCodeCallback(w http.ResponseWriter, r *http.Req
 		return nil // keep listening for more requests
 
 	case http.MethodPost:
+		r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // Limit request body size to 1 MB
 		// Parse and pull the response parameters from an application/x-www-form-urlencoded request body.
 		if err = r.ParseForm(); err != nil {
 			// Avoid using httperr.Wrap because that would hide the details of err from the browser output.

pkg/oidcclient/login_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package oidcclient
@@ -148,6 +148,7 @@ func TestLogin(t *testing.T) { //nolint:gocyclo
 			TokenURL string `json:"token_endpoint"`
 			JWKSURL  string `json:"jwks_uri"`
 		}
+		//nolint:gosec // no credentials here
 		_ = json.NewEncoder(w).Encode(&providerJSON{
 			Issuer:   insecureTokenURLServer.URL,
 			AuthURL:  insecureTokenURLServer.URL + "/authorize",
@@ -324,6 +325,7 @@ func TestLogin(t *testing.T) { //nolint:gocyclo
 			http.Error(w, "unexpected method", http.StatusMethodNotAllowed)
 			return
 		}
+		//nolint:gosec // this is a test, so we don't care about limiting request body size
 		if err := r.ParseForm(); err != nil {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return