diff --git a/main.go b/main.go
index 28edcd2..a962acd 100644
--- a/main.go
+++ b/main.go
@@ -1344,7 +1344,7 @@ func (t *TraefikOidc) verifyToken(token string) error {
 // safeLog provides nil-safe logging helpers
 func (t *TraefikOidc) safeLogDebug(msg string) {
 	if t.logger != nil {
-		t.logger.Debug(msg)
+		t.logger.Debug("%s", msg)
 	}
 }
 
@@ -1356,7 +1356,7 @@ func (t *TraefikOidc) safeLogDebugf(format string, args ...interface{}) {
 
 func (t *TraefikOidc) safeLogError(msg string) {
 	if t.logger != nil {
-		t.logger.Error(msg)
+		t.logger.Error("%s", msg)
 	}
 }
 
@@ -1368,7 +1368,7 @@ func (t *TraefikOidc) safeLogErrorf(format string, args ...interface{}) {
 
 func (t *TraefikOidc) safeLogInfo(msg string) {
 	if t.logger != nil {
-		t.logger.Info(msg)
+		t.logger.Info("%s", msg)
 	}
 }
 
diff --git a/session.go b/session.go
index 9b6509c..adae151 100644
--- a/session.go
+++ b/session.go
@@ -942,7 +942,7 @@ func (sd *SessionData) Save(r *http.Request, w http.ResponseWriter) error {
 		}
 		if err := s.Save(r, w); err != nil {
 			errMsg := fmt.Errorf("failed to save %s session: %w", name, err)
-			sd.manager.logger.Error(errMsg.Error())
+			sd.manager.logger.Error("%s", errMsg.Error())
 			if firstErr == nil {
 				firstErr = errMsg
 			}
diff --git a/settings.go b/settings.go
index 455c4b7..1fc3997 100644
--- a/settings.go
+++ b/settings.go
@@ -577,6 +577,6 @@ func newNoOpLogger() *Logger {
 //
 //lint:ignore U1000 Kept for potential future error handling
 func handleError(w http.ResponseWriter, message string, code int, logger *Logger) {
-	logger.Error(message)
+	logger.Error("%s", message)
 	http.Error(w, message, code)
 }
diff --git a/vendor/golang.org/x/time/rate/rate.go b/vendor/golang.org/x/time/rate/rate.go
index 93a798a..794b2e3 100644
--- a/vendor/golang.org/x/time/rate/rate.go
+++ b/vendor/golang.org/x/time/rate/rate.go
@@ -85,7 +85,7 @@ func (lim *Limiter) Burst() int {
 // TokensAt returns the number of tokens available at time t.
 func (lim *Limiter) TokensAt(t time.Time) float64 {
 	lim.mu.Lock()
-	_, tokens := lim.advance(t) // does not mutate lim
+	tokens := lim.advance(t) // does not mutate lim
 	lim.mu.Unlock()
 	return tokens
 }
@@ -186,7 +186,7 @@ func (r *Reservation) CancelAt(t time.Time) {
 		return
 	}
 	// advance time to now
-	t, tokens := r.lim.advance(t)
+	tokens := r.lim.advance(t)
 	// calculate new number of tokens
 	tokens += restoreTokens
 	if burst := float64(r.lim.burst); tokens > burst {
@@ -307,7 +307,7 @@ func (lim *Limiter) SetLimitAt(t time.Time, newLimit Limit) {
 	lim.mu.Lock()
 	defer lim.mu.Unlock()
 
-	t, tokens := lim.advance(t)
+	tokens := lim.advance(t)
 
 	lim.last = t
 	lim.tokens = tokens
@@ -324,7 +324,7 @@ func (lim *Limiter) SetBurstAt(t time.Time, newBurst int) {
 	lim.mu.Lock()
 	defer lim.mu.Unlock()
 
-	t, tokens := lim.advance(t)
+	tokens := lim.advance(t)
 
 	lim.last = t
 	lim.tokens = tokens
@@ -347,7 +347,7 @@ func (lim *Limiter) reserveN(t time.Time, n int, maxFutureReserve time.Duration)
 		}
 	}
 
-	t, tokens := lim.advance(t)
+	tokens := lim.advance(t)
 
 	// Calculate the remaining number of tokens resulting from the request.
 	tokens -= float64(n)
@@ -380,10 +380,11 @@ func (lim *Limiter) reserveN(t time.Time, n int, maxFutureReserve time.Duration)
 	return r
 }
 
-// advance calculates and returns an updated state for lim resulting from the passage of time.
+// advance calculates and returns an updated number of tokens for lim
+// resulting from the passage of time.
 // lim is not changed.
 // advance requires that lim.mu is held.
-func (lim *Limiter) advance(t time.Time) (newT time.Time, newTokens float64) {
+func (lim *Limiter) advance(t time.Time) (newTokens float64) {
 	last := lim.last
 	if t.Before(last) {
 		last = t
@@ -396,7 +397,7 @@ func (lim *Limiter) advance(t time.Time) (newT time.Time, newTokens float64) {
 	if burst := float64(lim.burst); tokens > burst {
 		tokens = burst
 	}
-	return t, tokens
+	return tokens
 }
 
 // durationFromTokens is a unit conversion function from the number of tokens to the duration
@@ -405,8 +406,15 @@ func (limit Limit) durationFromTokens(tokens float64) time.Duration {
 	if limit <= 0 {
 		return InfDuration
 	}
-	seconds := tokens / float64(limit)
-	return time.Duration(float64(time.Second) * seconds)
+
+	duration := (tokens / float64(limit)) * float64(time.Second)
+
+	// Cap the duration to the maximum representable int64 value, to avoid overflow.
+	if duration > float64(math.MaxInt64) {
+		return InfDuration
+	}
+
+	return time.Duration(duration)
 }
 
 // tokensFromDuration is a unit conversion function from a time duration to the number of tokens
diff --git a/vendor/golang.org/x/time/rate/sometimes.go b/vendor/golang.org/x/time/rate/sometimes.go
index 6ba99dd..9b83932 100644
--- a/vendor/golang.org/x/time/rate/sometimes.go
+++ b/vendor/golang.org/x/time/rate/sometimes.go
@@ -61,7 +61,9 @@ func (s *Sometimes) Do(f func()) {
 		(s.Every > 0 && s.count%s.Every == 0) ||
 		(s.Interval > 0 && time.Since(s.last) >= s.Interval) {
 		f()
-		s.last = time.Now()
+		if s.Interval > 0 {
+			s.last = time.Now()
+		}
 	}
 	s.count++
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index c867a1d..56b1196 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -18,8 +18,8 @@ github.com/pmezard/go-difflib/difflib
 github.com/stretchr/testify/assert
 github.com/stretchr/testify/assert/yaml
 github.com/stretchr/testify/require
-# golang.org/x/time v0.7.0
-## explicit; go 1.18
+# golang.org/x/time v0.13.0
+## explicit; go 1.24.0
 golang.org/x/time/rate
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit