chore(deps): update go module directive to v1.27.1

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.25.6 → 1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 → 1.27.1 (two minor versions)
Semver bump type: minor (x2)

Changes:
This bumps the Go module directive across two minor releases (1.26 and 1.27), which include significant language and runtime changes:

• encoding/json now backed by v2 implementation -- stricter defaults (rejects invalid UTF-8, duplicate object keys), different error message text
• Timer/Ticker channels are now always unbuffered (asynctimerchan GODEBUG removed)
• compress/flate output changed (affects archive/zip, compress/gzip, image/png)
• Green Tea GC enabled by default, with no opt-out in 1.27
• Post-quantum TLS key exchanges enabled by default
• go mod tidy merges require blocks for go 1.27+ modules
• go test enables stdversion vet check by default
• Multiple GODEBUG settings permanently removed (build errors if set to non-default)
• net/url.Parse rejects malformed URLs with bare colons in host

Breaking changes: Many potential breaking changes in Go 1.26-1.27 (see above), but codebase impact is low (see below).

Security concerns: None identified. The Go 1.26/1.27 releases include security hardening (post-quantum TLS, stricter JSON parsing, deprecated PKCS#1 v1.5 encryption).

Impact on codebase:

• encoding/json: Only direct usage is in test/e2e/e2e_test.go:313 (json.Unmarshal on well-formed Kubernetes API output) -- safe with json/v2
• crypto/tls: Used in cmd/main.go and webhook test suite with standard, idiomatic patterns -- no risk
• time.Ticker: Used in internal/controller/discovery_ticker.go:57-65 with idiomatic select loop -- compatible with unbuffered channels
• No usage of: net/url.Parse, io.ReadAll, compress/*, image/*, net/http.ServeMux, net.UnixConn, crypto/rsa PKCS#1 v1.5, //go:debug directives
• Error string assertions in tests use application-level messages, not stdlib error text -- safe

Recommendation: REVIEW REQUIRED

Issues that must be resolved before merge:

1. CI lint failure: golangci-lint v2.5.0 was built with Go 1.25 and cannot lint Go 1.27.1 code. Error: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.27.1). The golangci-lint version must be bumped (v2.6+ or whichever version is built with Go 1.27).

2. Dockerfile base image mismatch: Dockerfile:2 pins golang:1.25 with a SHA256 digest. With go.mod now declaring go 1.27.1, the Dockerfile must be updated to golang:1.27 with the corresponding digest. Builds will fail otherwise.

3. Build and test jobs were still in progress at time of evaluation -- verify they pass.

Once the golangci-lint version and Dockerfile are updated and all CI checks pass, the code-level risk of this bump is low for this codebase.

— Claude Code