chore(deps): update go module directive to v1.27.0

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.26.4 → 1.27.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.4 → 1.27.0 (minor)
Semver bump type: minor

CI Status: lint FAILED, build FAILED

• lint: golangci-lint v2.12.2 was built with Go 1.26 and refuses to lint code targeting Go 1.27.
• build: Dockerfile uses golang:1.26 base image with GOTOOLCHAIN=local, so go mod download fails.

Changes (Go 1.27 highlights relevant to this project):

• encoding/json is now backed by the v2 implementation. Marshaling/unmarshaling behavior is preserved for standard types, but error message text may differ. This project uses json.Marshal/json.Unmarshal with simple map types (map[string]string, map[string]any) — low risk. Errors are wrapped via sentinels (ErrUnmarshalLabels, ErrMarshalLabelsJSON), not string-matched, so changed error text is safe.
• asynctimerchan GODEBUG removed — time channels always unbuffered. Already the default since Go 1.23; no impact (project uses time.NewTicker in the metric writer, which was already on unbuffered behavior at Go 1.26).
• stdversion vet check now runs by default, flagging use of stdlib symbols too new for the module go directive. May surface new lint findings once golangci-lint is updated.
• go mod tidy auto-merges duplicate require blocks. Cosmetic only.
• Generic methods, struct literal keys, and function type inference language changes — additive, no impact on existing code.
• Several crypto/tls GODEBUGs permanently removed (tlsunsafeekm, tlsrsakex, tls3des, tls10server) — not used by this project.
• Unicode upgraded from 15 to 17 — could theoretically affect regex matching in the query builder for label values with Unicode, very low risk.
• macOS 13 minimum requirement — not relevant (project runs in containers).

Breaking changes: None that directly affect this codebase usage patterns.

Security concerns: None. No new transitive dependencies introduced (only the go directive changed). The encoding/json v2 backend can be opted out via GOEXPERIMENT=nojsonv2 if issues arise.

Impact on codebase: No affected code patterns found. JSON usage is limited to simple map marshal/unmarshal. Timer usage already on unbuffered semantics.

Recommendation: REVIEW REQUIRED

Notes: This PR cannot be merged as-is. Two companion changes are needed:

1. Dockerfile (Dockerfile:3): The golang:1.26 base image must be updated to golang:1.27 (with a fresh digest).
2. CI golangci-lint (.github/workflows/pre-merge.yaml:32): golangci-lint v2.12.2 is built with Go 1.26. Update to a version built with Go 1.27+.

Once those are addressed and CI is green, the Go directive bump itself is safe for this codebase.

— Claude Code