chore(deps): update go module directive to v1.27.0

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.25.6 → 1.27.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 → 1.27.0 (two minor version jump)
Semver bump type: minor (x2 — spans Go 1.26 and 1.27)

Changes (Go 1.26):

• Green Tea GC enabled by default
• io.ReadAll returns minimally sized final slice
• net/url.Parse stricter about colons in host
• net/http: cookie scoping changed, ServeMux redirects changed from 301 to 307
• crypto/*: random parameter now ignored (uses internal secure source)
• Timer/Ticker channels now unbuffered (completed in 1.27)
• Several GODEBUG settings announced for removal in 1.27

Changes (Go 1.27):

• Generic methods (language addition)
• encoding/json backed by v2 implementation (error messages may differ; opt-out: GOEXPERIMENT=nojsonv2)
• compress/flate output changes (affects gzip, zlib, zip, png)
• net.UnixConn read methods now return io.EOF directly instead of wrapping in net.OpError
• net/http HTTP/1 auto-drains Response.Body on Close
• net/http HTTP/2 server respects client priority signals (RFC 9218)
• Unicode upgraded from 15 to 17
• Several GODEBUG settings permanently removed (asynctimerchan, tlsrsakex, tls3des, tls10server, etc.)
• go test now runs stdversion vet check by default
• bzr VCS support removed

Breaking changes: Multiple behavioral changes across two Go minor releases (see above). However, codebase exposure is low.

Security concerns: None specific. Crypto changes improve security defaults (random parameter ignored, TLS hardening). No supply chain concerns — this is a Go toolchain update from the official Go project.

Impact on codebase:

• encoding/json: Used in test/e2e/e2e_test.go (one json.Unmarshal) and api/v1alpha1/discoveredphysicaldisk_types.go (struct tags). Standard usage, no custom marshalers or error string matching. Low risk.
• time.NewTicker: Used in internal/controller/discovery_ticker.go. Correct pattern with defer Stop() and select loop. Low risk.
• net/http: No direct usage; HTTP handled entirely through controller-runtime abstractions. Low risk.
• crypto/tls: Used in cmd/main.go for TLS config only (no direct crypto primitives). Low risk.
• No GODEBUG settings, no benchmarks, no io.ReadAll, no net/url.Parse, no compress/*, no image/jpeg, no httputil.ReverseProxy, no crypto/x509 direct usage.

Recommendation: REVIEW REQUIRED

Notes:

⚠️ CI is broken — PR is incomplete as-is. Two failures:

1. Build failure: Dockerfile (line 2) still uses golang:1.25 base image. The Go 1.27 go.mod directive causes go mod download to fail: go: go.mod requires go >= 1.27.0 (running go 1.25.11; GOTOOLCHAIN=local). Fix: update Dockerfile to use golang:1.27.

2. Lint failure: golangci-lint v2.5.0 (pinned in .github/workflows/pre-merge.yaml:45) was built with Go 1.25 and rejects Go 1.27 targets: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.27.0). Fix: update golangci-lint to a version built with Go >= 1.27.

The dependency bump itself is low-risk for this codebase, but the PR cannot be merged until the Dockerfile and CI tooling are updated to match.

— Claude Code