chore(deps): update go module directive to v1.27.1

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.26.0 → 1.27.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.0 -> 1.26.6 (patch)
Breaking changes: None -- all six patch releases are strictly security and bug fix releases.

Security fixes (1.26.1-1.26.6):

• CVE-2026-56862 (crypto/tls): DoS via unbounded KeyUpdate messages -- this project configures TLS in agent/cmd/main.go
• CVE-2026-56853 (net/http): ReadHeaderTimeout bypass on unencrypted HTTP/2 -- used transitively via controller-runtime and go-containerregistry
• CVE-2026-56858 (html/template): XSS via unescaped content injection
• CVE-2026-56860 (net/url): Quadratic complexity in relative path resolution
• CVE-2026-56859 (encoding/xml): Stack exhaustion via DecodeElement
• CVE-2026-33818 (encoding/asn1): Stack exhaustion from deeply nested structures
• CVE-2026-56864/56865 (cmd/go): Forged module content via malicious GOSUMDB/GOPROXY
• Earlier patches fixed issues in crypto/x509, archive/tar, net/mail, net/http/httputil, mime, net/textproto, syscall, crypto/fips140

Bug fixes: Compiler, runtime (Green Tea GC stabilization), linker, and go fix fixes across all six patches. No behavioral changes.

Impact on codebase: This project uses crypto/tls (webhook/metrics server), archive/tar (image layer extraction), and net/http transitively (registry communication, API server). Multiple CVE fixes directly benefit this codebase.

CI status: Some checks still in progress (test, lint). Completed checks are passing.

Recommendation: SAFE TO MERGE (after CI passes)

Notes: This is a security-positive update. The bump only changes the go directive in agent/go.mod with no code changes required. All six patch releases contain important security fixes for packages this project actively uses.

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.0 -> 1.27.1 (minor)
Files changed: agent/go.mod (go directive only)

Key Go 1.27 changes reviewed:

• encoding/json now backed by v2 implementation (stricter: rejects invalid UTF-8, duplicate keys)
• asynctimerchan GODEBUG removed -- timer channels always unbuffered
• compress/flate output changed (affects exact compressed bytes)
• Several TLS GODEBUG settings removed (tlsrsakex, tls3des, tls10server)
• go test now runs stdversion vet check by default
• Compiler generates simpler closure names (may affect symbol-name checks)
• net.UnixConn read methods now return io.EOF directly
• bzr VCS support removed

Breaking changes impact: None applicable to this codebase:

• encoding/json: Only 4 straightforward Marshal/Unmarshal calls on simple structs -- no edge cases with duplicate keys or invalid UTF-8
• time.After: Used only in test select timeout guards -- safe with unbuffered channels
• No unsafe, no CGO, no go:linkname, no deprecated stdlib usage
• No compress/flate direct usage, no net.UnixConn, no bzr dependencies
• No crypto/ecdsa signing, no version-gated build constraints
• Modern Go idioms already in use (maps, slices, any)

Security concerns: None -- removed TLS GODEBUG settings (tlsrsakex, tls3des, tls10server) only affected legacy cipher suites not used by this project

Impact on codebase: No affected patterns found. This is a pure-Go Kubernetes operator with clean, modern code.

CI status: Checks were still in progress at time of review -- verify CI passes before merging.

Recommendation: SAFE TO MERGE (once CI is green)

— Claude Code