upgrade linter and fix/ignore all new lint warnings

test/integration/formposthtml_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -121,11 +121,13 @@ func formpostCallbackServer(t *testing.T) (string, func(*testing.T, url.Values))
 		// Allow CORS requests.
 		w.Header().Set("Access-Control-Allow-Origin", "*")
 
+		//nolint:gosec // this is a test, so we don't care about limiting request body size
 		assert.NoError(t, r.ParseForm())
 
 		// Extract only the POST parameters (r.Form also contains URL query parameters).
 		postParams := url.Values{}
 		for k := range r.Form {
+			//nolint:gosec // this is a test, so we don't care about limiting request body size
 			if v := r.PostFormValue(k); v != "" {
 				postParams.Set(k, v)
 			}

test/integration/leaderelection_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -213,7 +213,7 @@ func waitForIdentity(ctx context.Context, t *testing.T, namespace *corev1.Namesp
 
 func runWriteRequest(ctx context.Context, client *kubeclient.Client) error {
 	_, err := client.Kubernetes.AuthenticationV1().TokenReviews().Create(ctx, &authenticationv1.TokenReview{
-		Spec: authenticationv1.TokenReviewSpec{Token: "any-non-empty-value"},
+		Spec: authenticationv1.TokenReviewSpec{Token: "any-non-empty-value"}, //nolint:gosec // not a real credential
 	}, metav1.CreateOptions{})
 	return err
 }

test/integration/supervisor_login_test.go

@@ -1815,6 +1815,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 					body)
 			},
 		},
+		//nolint:gosec // no credentials here
 		{
 			name:      "disallowed requested audience using specific reserved name of a dynamic client on token exchange results in token exchange error",
 			maybeSkip: skipNever,
@@ -1835,6 +1836,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 					body)
 			},
 		},
+		//nolint:gosec // no credentials here
 		{
 			name:      "disallowed requested audience pinniped-cli on token exchange results in token exchange error",
 			maybeSkip: skipNever,
@@ -2977,7 +2979,7 @@ func testSupervisorLogin(
 	// Create an HTTP client that can reach the downstream discovery endpoint using the CA certs.
 	httpClient := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{RootCAs: federationDomainSelfSignedCA.Pool()}, //nolint:gosec // not concerned with TLS MinVersion here
+			TLSClientConfig: &tls.Config{RootCAs: federationDomainSelfSignedCA.Pool()},
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				if strings.HasPrefix(req.URL.Host, "127.0.0.1") {
 					// don't proxy requests to localhost to avoid proxying calls to our local callback listener

test/testlib/env.go

@@ -226,6 +226,7 @@ func IntegrationEnv(t *testing.T, opts ...TestEnvOption) *TestEnv {
 		"must specify either PINNIPED_TEST_CLUSTER_CAPABILITY_YAML or PINNIPED_TEST_CLUSTER_CAPABILITY_FILE env var for integration tests",
 	)
 	if capabilitiesDescriptionYAML == "" {
+		//nolint:gosec // not concerned with tainted file path input for this test helper
 		bytes, err := os.ReadFile(capabilitiesDescriptionFile)
 		capabilitiesDescriptionYAML = string(bytes)
 		require.NoError(t, err)

test/testlib/securetls.go

@@ -1,4 +1,4 @@
-// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package testlib
@@ -83,7 +83,7 @@ func GetExpectedCiphers(config *tls.Config, preference string) string {
 			} else {
 				group = rsa2048
 			}
-			s.WriteString(fmt.Sprintf(tls12Item, name, group))
+			s.WriteString(fmt.Sprintf(tls12Item, name, group)) //nolint:staticcheck // this is better than fmt.Fprintf because this cannot error
 			if i == len(config.CipherSuites)-1 {
 				break
 			}
@@ -96,7 +96,7 @@ func GetExpectedCiphers(config *tls.Config, preference string) string {
 		var s strings.Builder
 		tls13CipherSuites := tlsserver.GetExpectedTLS13Ciphers()
 		for i, id := range tls13CipherSuites {
-			s.WriteString(fmt.Sprintf(tls13Item,
+			s.WriteString(fmt.Sprintf(tls13Item, //nolint:staticcheck // this is better than fmt.Fprintf because this cannot error
 				strings.Replace(tls.CipherSuiteName(id), "TLS_", "TLS_AKE_WITH_", 1),
 				tlsserver.GetExpectedTLS13CipherNMapKeyExchangeInfoValue(id)),
 			)