chore(deps): update go module directive to v1.27.0

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
go (source)	golang	minor	1.26.5 → 1.27.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.26.5 -> 1.26.6 (patch)
Files changed: go.mod only (1 line - go directive)

Changes (Go 1.26.6, released 2026-08-13):

Security fixes (7):

• html/template: XSS caused by wrong JavaScript regexp context tracking
• net/url: quadratic complexity in resolvePath (DoS vector)
• encoding/xml: (*Decoder).DecodeElement bypasses recursion-depth guard
• net / x/net/dns/dnsmessage: panic when parsing invalid SVCB record
• CVE-2026-33818, CVE-2026-56864, CVE-2026-56865
• crypto/tls: FIPS 140-3 Extended Master Secret enforcement escape hatch

Bug fixes (5): compiler correctness (prove bug, MIPS spill/miscompile), runtime SIGSEGV under high panic load.

Breaking changes: None

Security concerns: None negative -- this bump fixes 7 security issues. Merging promptly is recommended.

Impact on codebase: This project does not directly import the most critical affected packages (html/template, encoding/xml, net/url, net/http). crypto/tls is used in cmd/main.go and the webhook test suite; net appears in the webhook test suite. All standard library fixes are picked up at compile time and also benefit the project transitively through controller-runtime, client-go, and other dependencies.

CI status: Checks are in progress (build, generate, lint, test, test-e2e). Merge once CI is green.

Recommendation: SAFE TO MERGE (once CI passes)

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go module directive 1.26.5 -> 1.27.0 (minor)
Files changed: go.mod only (1 line)

Key Go 1.27 changes reviewed:

• encoding/json now backed by v2 implementation (rejects invalid UTF-8, rejects duplicate object keys)
• asynctimerchan GODEBUG permanently removed (timer channels always unbuffered)
• go test now runs stdversion vet check by default
• crypto/tls legacy GODEBUG settings removed
• Unicode upgraded from 15 to 17
• compress/flate output changed
• net.UnixConn EOF handling changed

Breaking changes: Go 1.27 has several behavioral changes (see above), but none affect patterns used in this codebase.

Security concerns: None. The Go 1.27 release includes stricter JSON validation and removal of legacy TLS fallbacks, both of which improve security posture.

Impact on codebase:

• encoding/json -- only direct usage is json.Unmarshal in test/e2e/e2e_test.go (line 508) for parsing kubectl token output. Standard kubectl JSON output contains no invalid UTF-8 or duplicate keys -- no impact.
• No use of time.After/time.NewTimer/time.NewTicker -- asynctimerchan removal has no impact.
• No use of net.UnixConn, compress/flate, crypto/ecdsa.PrivateKey.Sign, reflect.Value.Pointer, or runtime/pprof labels -- no impact.
• CI uses go-version-file: go.mod, so all CI jobs (build, lint, test, test-e2e) will run with Go 1.27 and validate compatibility end-to-end, including Kubernetes client libraries that use encoding/json internally.

Recommendation: SAFE TO MERGE once CI is green

Notes: CI checks (build, lint, test, test-e2e) are still in progress. Wait for all checks to pass before merging -- they are the definitive validation that the Go 1.27 toolchain works with the full dependency tree (controller-runtime, client-go, etc.).

— Claude Code