build(deps): bump the development-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the development-dependencies group with 2 updates in the / directory: github.com/coreos/go-oidc/v3 and github.com/go-jose/go-jose/v4.

Updates github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0

Release notes

Sourced from github.com/coreos/go-oidc/v3's releases.

v3.21.0

What's Changed

• oidc: ignore JWKs with unsupported key types rather than failing by @​nicoske in coreos/go-oidc#499

New Contributors

• @​nicoske made their first contribution in coreos/go-oidc#499

Full Changelog: coreos/go-oidc@v3.20.0...v3.21.0

Commits

• c914bd3 oidc: ignore JWKs with unsupported key types rather than failing
• See full diff in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.5

Fixed security issues

• cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• cipher/cbc_hmac: don't panic on invalid key (#291)
• json: limit stack depth (#290)
• jwt: reject out-of-range NumericDate values (#278)
• Check alg against pubkey curve during verify. (#293)
• Reject malformed Ed25519 JWKs (#250)
• jws: choose verification key per-signature (#243)

Changed

• Verify OpaqueSigner's Public() return is public (#260)
• jws: skip signature on ErrJWKSKidNotFound (#248)
• Handle JWE JSON without protected header (#240)
• jws: don't strip internal whitespace before parsing JSON (#239)
• jws: fewer calls to OpaqueSigner.Public() (#224)
• Return a specific error when parsing empty string (#216)
• Reject typed nil at Verify time (#285)

Commits

• b10771e Reject typed nil at Verify time
• 56f3866 Check alg against pubkey curve during verify. (#293)
• 74114c2 cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• 6b364f3 cipher/cbc_hmac: don't panic on invalid key (#291)
• a31af25 json: limit stack depth (#290)
• 7f5beb3 jwt: reject out-of-range NumericDate values (#278)
• e37f31a Test on Go 1.26 and 1.27 (#284)
• 5b371ae Reject malformed Ed25519 JWKs (#250)
• ad7f32d Bump actions/setup-python from 6 to 7 (#275)
• 1563054 Bump actions/setup-go from 6 to 7 (#274)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions