Release v0.48.0

Release Image

These images can also be referenced by their digest: sha256:c98ed3977081d7e18be6a5176656371621a1deea1a67b5a42f8b152b856ce4c8.

Changes

This release fixes some bugs and upgrades the project's dependencies to the latest versions.

Bug Fixes

• The Pinniped Supervisor's refresh token(s) for user sessions will no longer allow the user to extend their session beyond 9 hours from the initial authorization time. After at most 9 hours, the user will need to start a new session, which forces them to authenticate again with their external identity provider. This makes the behavior of the Supervisor better match what was previously documented, for example in this document: https://pinniped.dev/docs/reference/tokens-and-credentials/. The various checks performed against the external identity provider during each refresh are not changed, so sessions can still end earlier than the maximum 9 hours based on those checks. (#3385)
• Some additional limits are applied to requests for the Pinniped Supervisor's FederationDomain endpoints to prevent misbehaving clients from causing certain availability issues. This helps mitigate CVE-2026-116586 (of github.com/go-jose/go-jose/v3) by making the affected code paths unreachable. go-jose v3 is an indirect dependency inherited from github.com/ory/fosite, so we are applying this mitigation while we wait for fosite to upgrade to v4. (#3394)

Minor Changes

• Updates the Kubernetes libraries to v0.37.2, Golang to v1.27.4, and updates all other project dependencies. (#3403, #3395, #3392, #3380, #3379, #3378, #3370, #3365, #3359, #3357, #3355, #3354, #3352, #3346, #3337, #3336, #3334, #3333, #3269, #3252, #3249, #3247, #3236, #3224, #3215, #3210, #3211, #3208, #3202, #3199, #3197, #3187, #3182, #3177)
• Fixes some flaky unit tests (#3212)

Diffs

A complete list of changes (102 commits, 374 changed files with 14,916 additions and 8,938 deletions) can be found here.