upgrade linter and fix/ignore all new lint warnings

test/integration/formposthtml_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2025 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -121,11 +121,13 @@ func formpostCallbackServer(t *testing.T) (string, func(*testing.T, url.Values))
 		// Allow CORS requests.
 		w.Header().Set("Access-Control-Allow-Origin", "*")
 
+		//nolint:gosec // this is a test, so we don't care about limiting request body size
 		assert.NoError(t, r.ParseForm())
 
 		// Extract only the POST parameters (r.Form also contains URL query parameters).
 		postParams := url.Values{}
 		for k := range r.Form {
+			//nolint:gosec // this is a test, so we don't care about limiting request body size
 			if v := r.PostFormValue(k); v != "" {
 				postParams.Set(k, v)
 			}

test/integration/leaderelection_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -213,7 +213,7 @@ func waitForIdentity(ctx context.Context, t *testing.T, namespace *corev1.Namesp
 
 func runWriteRequest(ctx context.Context, client *kubeclient.Client) error {
 	_, err := client.Kubernetes.AuthenticationV1().TokenReviews().Create(ctx, &authenticationv1.TokenReview{
-		Spec: authenticationv1.TokenReviewSpec{Token: "any-non-empty-value"},
+		Spec: authenticationv1.TokenReviewSpec{Token: "any-non-empty-value"}, //nolint:gosec // not a real credential
 	}, metav1.CreateOptions{})
 	return err
 }

test/integration/supervisor_login_test.go

@@ -1815,6 +1815,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 					body)
 			},
 		},
+		//nolint:gosec // no credentials here
 		{
 			name:      "disallowed requested audience using specific reserved name of a dynamic client on token exchange results in token exchange error",
 			maybeSkip: skipNever,
@@ -1835,6 +1836,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 					body)
 			},
 		},
+		//nolint:gosec // no credentials here
 		{
 			name:      "disallowed requested audience pinniped-cli on token exchange results in token exchange error",
 			maybeSkip: skipNever,
@@ -2977,7 +2979,7 @@ func testSupervisorLogin(
 	// Create an HTTP client that can reach the downstream discovery endpoint using the CA certs.
 	httpClient := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{RootCAs: federationDomainSelfSignedCA.Pool()}, //nolint:gosec // not concerned with TLS MinVersion here
+			TLSClientConfig: &tls.Config{RootCAs: federationDomainSelfSignedCA.Pool()},
 			Proxy: func(req *http.Request) (*url.URL, error) {
 				if strings.HasPrefix(req.URL.Host, "127.0.0.1") {
 					// don't proxy requests to localhost to avoid proxying calls to our local callback listener