chore(deps): update go module directive to v1.27.1

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
go (source)	golang	minor	1.25.6 → 1.27.1	1.27.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ezekiel-alexrod]

On hold for now.

• Branch is stale (based on main from June 15): only detect-modules ran, no tests/lint. Needs a rebase and a full green CI first.
• GO_VERSION: 1.25 in pre-merge.yaml should be bumped along with this, otherwise CI relies on implicit GOTOOLCHAIN auto-download.
• raidmgmt is a library: bumping the go directive forces Go ≥ 1.26.4 on all consumers. We'll check they're ready before merging.

Will rebase and merge once the above is aligned.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 -> 1.26.6 (minor)
Semver bump type: minor

Changes:

• Go module directive bumped from 1.25.6 to 1.26.6
• Removed unused github.com/vektra/mockery/v3 dependency from go.mod and go.sum

Breaking changes: None affecting this codebase. Go 1.26 introduces stricter net/url.Parse validation, Green Tea GC as default, linker section reorganization, and deprecates some crypto APIs -- but this codebase uses none of these patterns (verified: no net/url imports, no url.Parse, no crypto/ecdsa or crypto/rsa, no GODEBUG settings, no reflect.Type or reflect.Value).

Security concerns: None. Go 1.26 enables post-quantum TLS key exchanges by default and includes various standard library hardening. No supply chain concerns -- this is a Go toolchain update from the official Go project.

Impact on codebase:

• mockery/v3 removal is safe -- no references found anywhere in the codebase (no imports, no go:generate directives)
• No code uses Go 1.26 breaking-change-affected APIs

Recommendation: REVIEW REQUIRED

Notes:

• CI is failing: The build-e2e job fails because .github/workflows/pre-merge.yaml hardcodes GO_VERSION: 1.25 with GOTOOLCHAIN=local. Go 1.25.13 refuses to build a module requiring Go 1.26.6. Fix: update GO_VERSION from 1.25 to 1.26 in .github/workflows/pre-merge.yaml (line 11).
• Once CI is green, this PR should be safe to merge.

-- Claude Code

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 -> 1.27.1 (minor bump, skips 1.26 entirely)
Semver bump type: minor (two minor versions)

Changes:

• Updates go directive in go.mod from 1.25.6 to 1.27.1
• Removes unused github.com/vektra/mockery/v3 dependency
• Spans two Go releases (1.26 and 1.27) with significant behavioral changes

Breaking changes:

• encoding/json v2 backend (Go 1.27): Rejects invalid UTF-8 and duplicate JSON object keys by default. Error messages changed. This is high risk for this codebase which extensively parses CLI tool JSON output (storcli2, perccli2, ssacli) via json.Unmarshal and json.NewDecoder across 7+ files. If any vendor CLI produces duplicate keys or non-UTF-8 bytes, parsing will silently start failing. Opt-out available via GOEXPERIMENT=nojsonv2 temporarily.
• net/url.Parse (Go 1.26): Rejects malformed hosts with unbracketed colons. Not used in codebase.
• Timer channels always unbuffered (Go 1.27). No timer usage found in codebase.
• compress/flate output changed (Go 1.27). Not directly used.
• Closure symbol names changed (Go 1.27) in compiled binaries.

Security concerns: None identified. No suspicious patterns in the dependency changes. Post-quantum TLS key exchanges enabled by default in Go 1.26, and multiple legacy TLS GODEBUG overrides permanently removed in 1.27 (TLS 1.0 server, RSA key exchange, 3DES), but this codebase does not use crypto/tls or net/http.

Impact on codebase:

• JSON parsing (HIGH): 6 json.Unmarshal/json.NewDecoder calls across 4 files (pkg/utils/json.go, pkg/implementation/storcli2/decode.go, pkg/implementation/raidcontroller/megaraid/runner.go, tests). 80+ JSON struct tags across entity types. All testdata fixtures (120+ JSON files) will be parsed under the new v2 engine.
• CI workflow mismatch (BLOCKER): .github/workflows/pre-merge.yaml hardcodes GO_VERSION: 1.25. A module declaring go 1.27.1 cannot be built with Go 1.25 -- this is the direct cause of the build-e2e failure.
• No usage of net/http, io.ReadAll, timers, or compress/flate found.

Recommendation: REVIEW REQUIRED

Notes:

1. CI is broken. The build-e2e job fails because the pre-merge workflow pins GO_VERSION: 1.25 while this PR sets go 1.27.1 in go.mod. The GO_VERSION env var (also renovate-managed) must be updated to 1.27 in the same PR or coordinated.
2. encoding/json v2 is the highest-risk change. Before merging, run the full test suite under Go 1.27 to validate that all JSON testdata fixtures (120+ files from storcli2/perccli2 CLI output captures) parse correctly under the stricter v2 engine. Pay special attention to duplicate keys and non-UTF-8 bytes in vendor CLI output.
3. Two-version jump (1.25 -> 1.27) means reviewing both Go 1.26 and 1.27 release notes for behavioral changes.
4. The removal of mockery/v3 appears to be unrelated cleanup bundled with the version bump.

-- Claude Code

[claude]

golangci-lint v2.4.0 (line 13) was built with Go 1.25. It refuses to run on a module that targets a newer Go version ("the Go language version used to build golangci-lint is lower than the targeted Go version"), so the lint job will fail with go 1.27.1. Bump GOLANGCI_LINT_VERSION to a release built with Go ≥ 1.27 in this same PR.

[claude]

This is an imported library. The go directive is the minimum Go version for every downstream module, so go 1.27.1 makes all consumers move to Go ≥ 1.27.1 (or auto-download a toolchain). Unless the code needs 1.27 features, keep the directive at the lowest version you support and bump only the CI GO_VERSION. A toolchain line can pin the build version for this repo.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 → 1.27.1 (two minor versions)
Semver bump type: minor (x2: spans Go 1.26 and 1.27)

Changes (Go 1.26):

• Green Tea GC enabled by default
• net/url.Parse rejects malformed URLs with colons in host
• crypto/rsa.PrivateKey.Validate stricter
• cmd/doc / go tool doc deleted (use go doc)
• Post-quantum TLS cipher suites enabled by default
• image/jpeg encoder/decoder replaced (different bit-for-bit output)
• Heap base address randomization on 64-bit
• Multiple GODEBUG settings scheduled for removal in 1.27

Changes (Go 1.27):

• encoding/json backed by v2 implementation — rejects invalid UTF-8 and duplicate JSON keys by default (opt-out: GOEXPERIMENT=nojsonv2)
• compress/flate output changes (affects archive/zip, compress/gzip, image/png)
• gofmt whitespace changes
• go mod tidy merges duplicate require blocks
• stdversion vet check now runs by default
• Multiple GODEBUG settings permanently removed
• net.UnixConn EOF handling change
• Minimum macOS version raised to 13 (Ventura)
• Bazaar VCS support removed

Breaking changes: encoding/json v2 is the highest-impact change for this codebase

Security concerns: None identified. No crypto packages used, no TLS handling, no URL parsing.

Impact on codebase:

• encoding/json v2 (MEDIUM risk): 7 files import encoding/json, all for parsing storcli2/perccli2 CLI JSON output. 122+ JSON test fixtures are valid UTF-8 with no duplicate keys (verified). No code matches on JSON error message text. However, if vendor CLI tools ever emit invalid UTF-8 in production (e.g., from drive firmware strings), json v2 will reject the entire response where v1 silently accepted it. No UTF-8 sanitization exists in the pipeline.
• net/url, timers, crypto: Not used in codebase — no impact.
• gofmt changes: May cause minor whitespace diffs on next format pass.

CI status:

• tests: SUCCESS
• build-e2e: SUCCESS
• golangci-lint: FAILURE — panic: file requires newer Go version go1.27 (application built with go1.25). The golangci-lint v2.4.0 binary was built with Go 1.25 and panics when type-checking Go 1.27 code. A golangci-lint version built with Go 1.27+ is required.

Recommendation: REVIEW REQUIRED

Notes:

1. CI blocker: golangci-lint v2.4.0 must be updated to a version compiled with Go 1.27+. Check for a newer release of golangci-lint that supports Go 1.27.
2. Non-bot commits detected: PR contains commits from both scality-renovate[bot] and g-carre. Manual review of all commits is required.
3. encoding/json v2 runtime risk: While all test fixtures pass and no error-message matching exists, consider adding a UTF-8 sanitization step before json.Unmarshal in pkg/implementation/storcli2/decode.go:20 and pkg/implementation/raidcontroller/megaraid/runner.go:118 as a defensive measure against malformed vendor CLI output.
4. Two minor version jump: This spans Go 1.25 → 1.26 → 1.27 with cumulative breaking changes. Test thoroughly on real hardware if possible.

— Claude Code

[g-carre]

We have to wait for this: bumping this lib to 1.27.1 would force to bump go in the following projects:

• artesca (wrapper/) - go version: 1.26.2 and raidmgmt version: v0.18.1
• platform-raid-report-generator - go version: 1.25.6 and raidmgmt version: v0.18.1
• disk-management-agent - go version: 1.25.6 and raidmgmt version: v0.16.0