fix: update github.com/go-jose/go-jose/v4 to v4.1.4 — CVE-2026-34986

Upgrade github.com/go-jose/go-jose/v4 from v4.0.5 to v4.1.4 to address CVE-2026-34986.

Jira: SRVKP-12885
govulncheck scan: N/A
Test result: failed

Co-Assisted-By: CVE Fixer Bot <cve-fixer@redhat.com>

Author: jkhelil

artifacts/already-fixed-CVE-2026-34986-tektoncd-operator.md

@@ -0,0 +1,10 @@
+# Not Applicable / Already Fixed: CVE-2026-34986
+
+**Repository**: tektoncd/operator
+**Branch**: release-v0.78.x
+**Scan toolchain**: go1.25.11
+**Check date**: Thu Jul 16 06:02:14 UTC 2026
+**Verdict**: not_reachable_or_already_fixed
+
+Package '' (unknown unknown) is present in go.mod but the module may already be at a patched version or the CVE is not reachable from any code path in this repository.
+No PR required. Human reviewer to confirm and close.

go.mod

@@ -42,7 +42,6 @@ require (
 
 replace (
 	github.com/alibabacloud-go/cr-20160607 => github.com/vdemeester/cr-20160607 v1.0.1
-	github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.0.5
 
 	github.com/openshift-pipelines/pipelines-as-code => github.com/tektoncd/pipelines-as-code v0.39.7
 	k8s.io/api => k8s.io/api v0.32.4

go.sum

@@ -1760,8 +1760,8 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=