fix(deps): update module github.com/coreos/go-oidc/v3 to v3.19.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/coreos/go-oidc/v3	v3.18.0 → v3.19.0

---

Release Notes

coreos/go-oidc (github.com/coreos/go-oidc/v3)

v3.19.0

Compare Source

What's Changed

• fix: Key refresh should set no-cache to get most up to date keys by @​Yanni8 in #​485
• oidc: add support for validating back-channel logout tokens by @​ericchiang in #​486

New Contributors

• @​Yanni8 made their first contribution in #​485

Full Changelog: coreos/go-oidc@v3.18.0...v3.19.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cursor]

Security review — no findings

Reviewed PR #3986 (go-oidc/v3 3.18.0 → 3.19.0). The diff is limited to go.mod / go.sum; no application code changes.

Scope checked

• OIDC usage in api/login.go (getOidcProvider, oidcRedirect, ID token verification via verifier.Verify, optional UserInfo fallback).
• Upstream changes in v3.19.0: JWKS refresh Cache-Control: no-cache (#485), back-channel logout token support (#486), and a verifyJWT refactor in verify.go (no change to signature-before-claims ordering).

Assessment

• No new attacker-controlled sinks or auth bypass paths are introduced by this bump.
• Semaphore does not use the new logout-token APIs; the refactor does not alter ID-token verification behavior used at login.
• The JWKS cache fix reduces stale-key risk after provider key rotation (security improvement).
• Known DoS in go-oidc ≤3.14.1 (CVE-2025-27144) was already fixed in 3.15.0; both old and new versions are unaffected.
• go-jose/go-jose/v4 remains a direct dependency (pkg/jwt); removing it from the indirect block is a tidy-up only.

Prior automation threads: none found on this PR.

Outcome: No medium, high, or critical vulnerabilities identified. Safe to merge from a security perspective.

  

_{Sent by Cursor Automation: Find vulnerabilities}