[DoDiODev]

Summary

backend/go.mod pins github.com/go-jose/go-jose/v4 at v4.1.4. That version
is affected by GHSA-mgcc-cww5-fp2q
(CVE-2026-116587, severity high). A JWK with an RSA key can trigger a denial
of service while it is being parsed.

DevLake uses go-jose indirectly, through coreos/go-oidc/v3:

github.com/apache/devlake/helpers/oidchelper
github.com/coreos/go-oidc/v3/oidc
github.com/go-jose/go-jose/v4

helpers/oidchelper (used by server/api/auth) fetches the OIDC provider's
JWKS and verifies ID tokens against it. That is the code path the advisory
describes.

This PR bumps go-jose to v4.1.6 (go get github.com/go-jose/go-jose/v4@v4.1.6 && go mod tidy). Only backend/go.mod and backend/go.sum change.

The regular Dependabot version updates do not pick this up. The weekly
go-minor-patch group (#9268) only contains direct dependencies, and
go-jose is // indirect.

Does this close any open issues?

N/A

Screenshots

N/A

Other Information

• Behaviour change in v4.1.6: JWK parsing now rejects RSA keys whose modulus
  is larger than 4096 bits (configurable via jose.MaxRSAModulusBits).
  Common OIDC providers sign with 2048- or 3072-bit keys, so I did not
  change the default.
• Verified locally: go build ./..., make mock,
  scripts/unit-test-go.sh pass (including helpers/oidchelper and
  server/api/auth).
• Fork CI on the same change (golangci-lint, unit-test, e2e on MySQL,
  config-ui, license header, Grafana check; 14/14 jobs green):
  https://github.com/DoDiODev/devlake/actions/runs/40847595592
• No overlap with open PRs; build(deps): bump github.com/viant/afs from 1.30.0 to 1.30.1 in /backend in the go-minor-patch group across 1 directory #9268 touches a different line in go.mod.