chore(deps): update go module directive to v1.27.2

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	patch	1.27.0 → 1.27.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Packages:

• golang (build stage): digest 792443b -> f96cc55 (same golang:1.26 tag)
• mcr.microsoft.com/devcontainers/go (devcontainer): digest 232b16d -> 638cb8e (same 1.26-trixie tag)

Bump type: Docker digest rotation (no semver change)

Changes:

• Picks up the latest rebuild of both Go Docker images, which typically includes OS-level security patches and minor updates to the base layer
• Go toolchain version remains 1.26 -- no compiler or stdlib changes

Breaking changes: None -- same Go version, same tags, only the underlying OS packages are refreshed

Security concerns: None -- digest rotations are the standard mechanism for receiving OS-level security patches in pinned Docker images. This is a positive security update.

Impact on codebase: No impact. The Dockerfile uses a multi-stage build: the golang:1.26 builder compiles a statically linked binary (CGO_ENABLED=0), which is then copied to a distroless/static:nonroot runtime image. OS-layer changes in the builder do not affect the final artifact. The devcontainer change only affects the development environment.

CI status: lint passed, test passed, build in progress

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.27.0 -> 1.27.1 (patch)
Files changed: go.mod only (go directive)

Changes (Go 1.27.1 bug fixes):

• database/sql: deadlock fix in Rows.Next vs concurrent Rows.Close
• encoding/json: regression fix for quoted null with ,string tag; v2 decoder EOF fix
• net/http: Request.Body.Close returning io.EOF on partially-read bodies
• Compiler: linker symbol fix for generic methods; s390x and ARM64 SIGILL fixes
• debug/elf, cmd/fix: minor fixes

Breaking changes: None -- standard patch release with bug fixes only

Security concerns: None -- no CVEs referenced

Impact on codebase:

• database/sql (#81151): Not affected -- project uses pgx directly, no database/sql import
• encoding/json (#81083, #81012): Not affected -- no ,string JSON tag usage; uses json.Marshal/json.Unmarshal only (not v2 decoder)
• net/http (#81027): Not affected -- no Body.Close patterns; request body reading handled by snappy/protobuf decoder
• Compiler s390x/ARM64 fixes: Not affected -- builds target linux/amd64
• debug/elf, simd: Not used

CI status: All checks passing (build, lint, test, integration-test on PG 16/17/18)

Recommendation: SAFE TO MERGE

Notes: This is a straightforward Go patch bump. None of the 12 bug fixes in Go 1.27.1 affect code paths used by this project. All CI checks pass.

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: go 1.27.0 → 1.27.2 (patch)

Note: PR title says v1.27.1 but renovate has since updated the branch to v1.27.2.

Changes (1.27.1):

• Bug fixes in cgo, compiler, runtime, database/sql, encoding/json, net/http, os

Changes (1.27.2):

• 15 security fixes including:
  • Critical: net/http/internal/http2 — transport accepts multiple Content-Length headers
  • 2 XSS vulnerabilities in html/template
  • 2 GOMODPROXY checksum bypass issues in cmd/go
  • Fixes in crypto/tls, net/textproto, os
  • 10 additional CVEs (CVE-2026-97032, CVE-2026-78667, CVE-2026-78659, CVE-2026-97031, CVE-2026-94439, CVE-2026-78663, CVE-2026-78669, CVE-2026-94440, CVE-2026-56866, CVE-2026-56857)
• Bug fixes in compiler, linker, runtime, compress/flate, encoding/json, encoding/json/v2, net/http, os

Breaking changes: None — both are patch releases with only bug and security fixes.

Security concerns: This is a security-critical update. The project uses net/http extensively (7 files across handlers, DI container, and HTTP server) and is directly affected by the Critical HTTP/2 Content-Length vulnerability. The crypto/tls and net/textproto fixes are also relevant to a network-facing service.

Impact on codebase: The go directive bump in go.mod changes the minimum Go version. No API-level changes — Go patch releases are backwards-compatible.

CI status: FAILING — The build / build job fails at the "Build image" step. The Dockerfile pins golang:1.27 with a specific digest (sha256:f44f6e...) that resolves to an older 1.27.x image. When go.mod declares go 1.27.2, the Go toolchain in the container rejects the version mismatch. The Dockerfile digest must be updated to a golang:1.27.2 image for the build to pass.

Recommendation: REVIEW REQUIRED

Notes:

1. This update should be prioritized — it fixes a Critical HTTP/2 vulnerability in a package this project directly uses.
2. To unblock CI, update the Dockerfile FROM golang:1.27@sha256:... line to use the golang:1.27.2 image digest.
3. Author is scality-renovate[bot] — renovate only updated go.mod but not the Dockerfile digest. Consider configuring renovate to also manage the Dockerfile Go version, or update it manually in this PR.

— Claude Code