chore(deps): upgrade go-jose to v4.1.6 for CVE-2026-116587 (#393)

* chore(deps): upgrade go-jose to v4.1.6 for CVE-2026-116587

* chore(deps): regenerate third-party notices for go-jose v4.1.6

Author: vishr

THIRD_PARTY_NOTICES

@@ -23,7 +23,7 @@ COMPONENT INVENTORY
 - Go: github.com/duckdb/duckdb-go-bindings v0.10506.0
 - Go: github.com/duckdb/duckdb-go/v2 v2.10506.0
 - Go: github.com/dustin/go-humanize v1.1.0
-- Go: github.com/go-jose/go-jose/v4 v4.1.5
+- Go: github.com/go-jose/go-jose/v4 v4.1.6
 - Go: github.com/go-viper/mapstructure/v2 v2.5.0
 - Go: github.com/google/jsonschema-go v0.4.3
 - Go: github.com/google/uuid v1.6.0
@@ -536,7 +536,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 --- Applies to -------------------------------------------------------------
 - Go: cel.dev/expr v0.25.3 / LICENSE
-- Go: github.com/go-jose/go-jose/v4 v4.1.5 / LICENSE
+- Go: github.com/go-jose/go-jose/v4 v4.1.6 / LICENSE
 - Go: github.com/prometheus/client_golang v1.25.0 / LICENSE
 - Go: github.com/prometheus/client_model v0.6.3 / LICENSE
 - Go: github.com/prometheus/common v0.72.0 / LICENSE

go.mod

@@ -46,7 +46,7 @@ require (
 	github.com/duckdb/duckdb-go-bindings/lib/linux-arm64 v0.10506.0 // indirect
 	github.com/duckdb/duckdb-go-bindings/lib/windows-amd64 v0.10506.0 // indirect
 	github.com/dustin/go-humanize v1.1.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/goccy/go-json v0.11.2 // indirect
 	github.com/google/flatbuffers v25.12.19+incompatible // indirect

go.sum

@@ -42,8 +42,8 @@ github.com/duckdb/duckdb-go/v2 v2.10506.0 h1:mcZjUQ/kSNeZdtGCqyj5/JEDUdj7/kvILfI
 github.com/duckdb/duckdb-go/v2 v2.10506.0/go.mod h1:6pLO+4GMcb0q36+z+RlQ7h+MMxum1lL0eAVf4GsPAxs=
 github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
 github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
-github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
-github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/goccy/go-json v0.11.2 h1:jdZv93Tt4ioR8yW1CoNsvSxrcZlCXAUU1aZXN7gpXUA=